diff --git a/providers/azure.go b/providers/azure.go
index 5ce210e1..baff0bc3 100644
--- a/providers/azure.go
+++ b/providers/azure.go
@@ -206,7 +206,11 @@ func (p *AzureProvider) GetLoginURL(redirectURI, state string) string {
 	params.Add("state", state)
 	params.Set("prompt", p.ApprovalPrompt)
 	params.Set("nonce", "FIXME")
+	if p.ProtectedResource != nil && p.ProtectedResource.String() != "" {
+		params.Add("resource", p.ProtectedResource.String())
+	}
 	a.RawQuery = params.Encode()
+
 	return a.String()
 }
 
diff --git a/providers/azure_test.go b/providers/azure_test.go
index c8102901..09768cf2 100644
--- a/providers/azure_test.go
+++ b/providers/azure_test.go
@@ -351,3 +351,18 @@ func TestAzureRightPermittedGroups(t *testing.T) {
 
 	assert.Equal(t, true, result)
 }
+
+func TestAzureLoginURLnoResource(t *testing.T) {
+	p := testAzureProvider("")
+	p.ProtectedResource = nil
+
+	result := p.GetLoginURL("http://redirect/url", "state")
+	assert.Equal(t, "?client_id=&nonce=FIXME&prompt=&redirect_uri=http%3A%2F%2Fredirect%2Furl&response_mode=form_post&response_type=id_token+code&scope=openid&state=state", result)
+}
+
+func TestAzureLoginURL(t *testing.T) {
+	p := testAzureProvider("")
+
+	result := p.GetLoginURL("http://redirect/url", "state")
+	assert.Equal(t, "?client_id=&nonce=FIXME&prompt=&redirect_uri=http%3A%2F%2Fredirect%2Furl&resource=https%3A%2F%2Fgraph.microsoft.com&response_mode=form_post&response_type=id_token+code&scope=openid&state=state", result)
+}