The & character in a CMD Prompt is command separator. It says "execute the command on the left of the & character, then execute the command to the right of the & when the left command has completed execution".
To get CMD to process that character as part of the URL, you would have to escape the & characters by preceding them with the ^ character:
@echo off
setlocal
set CLIENTID=41eeebbd-ea7f-4f49-a936-1624b6cb9c72
set CLIENTSECRET=UIC8Q~nj3cDetR4XQlSNbm19WpywweJMi.CuwbGA
set RESOURCE=api:
set TENANTID=90fff3ee-9a7c-4eb1-8259-4d8c6bf6ca90
set AZURESITE=https:
set COMMANDLINE="curl -s grant_type=client_credentials^&client_id=%CLIENTID%^&client_secret=%CLIENTSECRET%^&resource=%RESOURCE%"
echo "Command line is %COMMANDLINE%"