In scenarios where a route may optionally require a token if the user is logged in, you can now mark ProtectedResourceScopes definitions as optional.  These requests will attach (after acquiring, if necessary) the required token if a user is authenticated.  If no user is currently authenticated, the request will simply go through as if it is an unprotected endpoint, and not force the user to authenticate.

AzureAD#3758