Microsoft OAuth "scope that doesn't exist" error response

Question

I'm using Microsoft oauth2 authorization; usually it works fine - but not for one user. He get's this error:

AADSTS650053: The application *** asked for scope 'openid,profile,offline_access,user.read,calendars.readwrite' that doesn't exist on the resource '00000003-0000-0000-c000-000000000000'. Contact the app vendor. Trace ID: 4d2d1b15-cd7c-4b62-beda-e2013dd58500 Correlation ID: b6f14fc5-d781-4901-a4eb-6dc235e28e03

So the scope is always the same but for some clients "that doesn't exist". Does anybody know the issue?

Some of my Azure app details:

Supported account types: All Microsoft account users
API permissions: Calendars.ReadWrite offline_access openid profile User.Read

In the manifest:

"acceptMappedClaims": null,
"accessTokenAcceptedVersion": 2,
"addIns": [],
"allowPublicClient": null,
"appRoles": [],
"oauth2AllowUrlPathMatching": false,
"description": null,
"certification": null,
"disabledByMicrosoftStatus": null,
"groupMembershipClaims": null,
"identifierUris": [],
"oauth2AllowIdTokenImplicitFlow": false,
"oauth2AllowImplicitFlow": false,
"oauth2Permissions": [],
"oauth2RequirePostResponse": false,
"optionalClaims": {
    "idToken": [],
    "accessToken": [],
    "saml2Token": []
},
"orgRestrictions": [],
"parentalControlSettings": {
    "countriesBlockedForMinors": [],
    "legalAgeGroupRule": "Allow"
},
...
"samlMetadataUrl": null,
"signInAudience": "AzureADandPersonalMicrosoftAccount",
"tokenEncryptionKeyId": null