Connect-MgGraph fails when requesting Policy.ReadWriteApplicationConfiguration scope and some other scopes

[adamedx]

It turns out that there are scenarios with newer applications that fail when you sign in via https://login.microsoftonline.com/common. When all of the following are true at sign-in, some permissions scopes may be treated as invalid and result in an error returned by Connect-MgGraph during authentication:

1. Sign-in is device code flow (this is what Connect-MgGraph uses for delegated auth)
2. The app was created relatively recently (i.e. in last ~2 years or so)
3. The scope is one of a specific set of scopes -- Policy.ReadWrite.ApplicationConfiguration is one example
4. You are using https://login.microsoftonline.com/common

This apparently is not a problem when you use /organizations. Unfortunately, this means you can't sign-in with MSA, unless we allow an option to specify that MSA sign-in is desired via a parameter to Connect-MgGraph.
AB#7384

[peombwa]

@adamedx This is no longer a major issue (v1.6.0+) since we have changed our default authentication mode to interactive sign-in with a browser pop-up. Policy.ReadWriteApplicationConfiguration scope works as expected in this mode.

For cases where a customer explicitly uses Connect-MgGraph -UseDeviceAuthentication and this exception is thrown, we can update the error message by adding Please retry with either Connect-MgGraph -TenantId "your tenant id" or Connect-MgGraph -Audience "organizations. In this case, -Audience will be an alias to -TenantId since they are mutually exclusive.