`azd auth token --scope https://graph.microsoft.com/.default` fails with AADSTS530084 for some internal users

```
ERROR: AADSTS530084: Access has been blocked by conditional access token protection policy configured by this organization. To learn more, see https://aka.ms/TBCADocs. Trace ID: Correlation ID: Timestamp: 2026-04-13 19:04:12Z

Suggestion: reauthentication required, run `azd auth login --tenant-id --scope https://graph.microsoft.com/.default` to acquire a new token.
```

This error happens for some internal Microsoft users that are part of a MSIT content access policy that prevents them from getting a MS Graph token.

Only users in this policy can reproduce the issue with `azd auth token -o json --scope https://graph.microsoft.com/.default --tenant-id `

The ideal solution would be to enable Web Account Manager (WAM) based login on Windows devices [like Azure CLI](https://learn.microsoft.com/en-us/cli/azure/authenticate-azure-cli-interactively?view=azure-cli-latest#sign-in-with-web-account-manager-wam-on-windows). We did add support for it in #3216 but it's not enabled yet in our public releases due to some pending work:

- #3431
- #3252

The only known workaround is to contact the internal help desk and request for a token protection exception on this policy.

Related Azure CLI issue: https://github.com/Azure/azure-cli/issues/31030