fail multi-resource access token requests

The emphasis on the word 'erroneously' in [this
doc](https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/ef0a1ae38249ba2cf6ec5d75731e711a6ae62cba/lib/msal-browser/docs/resources-and-scopes.md?plain=1#L36)
makes this behaviour pretty compelling.

Signed-off-by: Jamie Klassen <jklassen@vmware.com>

packages/core-app-api/src/apis/implementations/auth/microsoft/MicrosoftAuth.test.ts

@@ -69,6 +69,16 @@ describe('MicrosoftAuth', () => {
 
       expect(accessToken).toEqual('tokenForOtherResource');
     });
+
+    it('fails when requesting scopes for multiple resources at once', async () => {
+      const accessTokenPromise = microsoftAuth.getAccessToken(
+        'one-resource/scope other-resource/scope',
+      );
+
+      await expect(accessTokenPromise).rejects.toThrow(
+        'Requested access token with scopes from multiple Azure resources: one-resource, other-resource. Access tokens can only have a single audience.',
+      );
+    });
   });
 
   describe('without a refresh token', () => {

packages/core-app-api/src/apis/implementations/auth/microsoft/MicrosoftAuth.ts

@@ -91,11 +91,20 @@ export default class MicrosoftAuth {
   }
 
   private static resourceForScopes(scope: string): Promise<string> {
-    const audience =
-      scope
-        .split(' ')
-        .map(MicrosoftAuth.resourceForScope)
-        .find(aud => aud !== 'openid') ?? MicrosoftAuth.MicrosoftGraphID;
+    const audiences = scope
+      .split(' ')
+      .map(MicrosoftAuth.resourceForScope)
+      .filter(aud => aud !== 'openid');
+    if (audiences.length > 1) {
+      return Promise.reject(
+        new Error(
+          `Requested access token with scopes from multiple Azure resources: ${audiences.join(
+            ', ',
+          )}. Access tokens can only have a single audience.`,
+        ),
+      );
+    }
+    const audience = audiences[0] ?? MicrosoftAuth.MicrosoftGraphID;
     return Promise.resolve(audience);
   }