[Microsoft internal] Microsoft tenant forbids accessing Microsoft Graph with browser flow

## Symptom

Recently, Microsoft tenant (`72f988bf-86f1-41af-91ab-2d7cd011db47`) started to forbid accessing Microsoft Graph (`https://graph.microsoft.com/`) with browser-based authentication flow ([authorization code flow](https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow)) on Windows.

After running

```
az config set core.enable_broker_on_windows=false
az login --scope https://graph.microsoft.com//.default --tenant 72f988bf-86f1-41af-91ab-2d7cd011db47
```

and selecting the `@microsoft.com` account in the browser, the login page shows error:

> **Sorry, a security policy is preventing access**
> An organization security policy requiring token protection is preventing this application from accessing the resource. You may be able to use a different application.

Troubleshooting details:

```
Error Code: 53003
Request Id: ...
Correlation Id: ...
Timestamp: 2025-03-13T12:31:05.542Z
App name: Microsoft Azure CLI
App id: 04b07795-8ddb-461a-bbee-02f9e1bf7b46
IP address: ...
Device identifier: ...
Device platform: Windows 10
Device state: Compliant
```

## Solution

Enable WAM and run `az login`:

```sh
az config unset core.enable_broker_on_windows
# When you are using an Azure CLI < 2.61.0
# az config set core.enable_broker_on_windows=true
az login --scope https://graph.microsoft.com//.default --tenant 72f988bf-86f1-41af-91ab-2d7cd011db47
```