I have a MAUI app. I am using Entra ID for authentication. Users can successfully authenticate using Google. However I cannot get their profile information such as first name, last name and profile pic. All I can get is their email address. If I go into my User Flow and select First Name and Family Name etc then my app asks users for this information even though they have signed in with a Google account that already contains this. I've wasted 2 days on this :(

Here's my existing code:

builder.Services.AddSingleton<IPublicClientApplication>(sp => 
{
    var settingsService = sp.GetRequiredService<ISettingsService>(); 
    return PublicClientApplicationBuilder 
        .Create(settingsService.ClientId)
        .WithAuthority(settingsService.Authority)
        .WithIosKeychainSecurityGroup(settingsService.IOSKeychainSecurityGroup)
        .WithRedirectUri($"msal{settingsService.ClientId}://auth")
        .Build();
});

Note that these are the scopes I'm using: "openid profile email User.Read"

public async Task<AuthenticationResult?> LoginAsync()
{
    AuthenticationResult? result = null;

    try
    {
        var accounts = await _publicClientApplicationBuilder.GetAccountsAsync();
        if (accounts.Any())
        {
            result = await _publicClientApplicationBuilder.AcquireTokenSilent(_mobileSettingsService.Scopes, accounts.First()).ExecuteAsync();
        }
        else
        {
            result = await _publicClientApplicationBuilder
                .AcquireTokenInteractive(_mobileSettingsService.Scopes)
                .WithParentActivityOrWindow(UiContext.ParentWindow)
                .ExecuteAsync().ConfigureAwait(false);
        }
    }
    catch (MsalException ex)
    {
        result = await _publicClientApplicationBuilder.AcquireTokenInteractive(_mobileSettingsService.Scopes)
            .WithParentActivityOrWindow(UiContext.ParentWindow)
            .ExecuteAsync().ConfigureAwait(false);
    }

    string accessToken = result.AccessToken;
    HttpClient client = new HttpClient();
    client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);

    // ###### There is no user information in this string. Only the email address. ######
    string graphApiResponse = await client.GetStringAsync(".0/me");

    return result;
}

Here is my Entra config:

Users can sign in perfectly OK using Google but I cannot get their first/last name and profile pic or anything else except their email address.

UPDATE: I've been able to get the first and last names from the token by following the instructions here. This means I can get this data when users create an account manually in my app. But I still can't get this data if they sign in with Google.