diff --git a/server/modules/authentication/oidc/authentication.js b/server/modules/authentication/oidc/authentication.js
index bfda8c2fdc..d8bab77dee 100644
--- a/server/modules/authentication/oidc/authentication.js
+++ b/server/modules/authentication/oidc/authentication.js
@@ -22,6 +22,7 @@ module.exports = {
         passReqToCallback: true,
         skipUserProfile: conf.skipUserProfile,
         acrValues: conf.acrValues
+        scope: conf.scope
       }, async (req, iss, uiProfile, idProfile, context, idToken, accessToken, refreshToken, params, cb) => {
         const profile = Object.assign({}, idProfile, uiProfile)
         const picture = _.get(profile, '_json.' + conf.pictureClaim, '')
diff --git a/server/modules/authentication/oidc/definition.yml b/server/modules/authentication/oidc/definition.yml
index 266ea7e9f2..afce7efc24 100644
--- a/server/modules/authentication/oidc/definition.yml
+++ b/server/modules/authentication/oidc/definition.yml
@@ -92,3 +92,8 @@ props:
     title: ACR Values
     hint: (optional) Authentication Context Class Reference
     order: 14
+  scope:
+    type: String
+    title: Scope
+    hint: (optional) Additional permission scopes to request. 'openid profile email' are always included. Add extra scopes here, e.g. 'roles'.
+    order: 15