get-azaccesstoken -resourceURL "https://graph.microsoft.com/" error 400 - unauthorized

### Description

Following doc here - https://learn.microsoft.com/en-us/powershell/module/az.accounts/get-azaccesstoken?view=azps-9.0.0#example-3-get-the-access-token-for-microsoft-graph-endpoint.

command used as GA account within tenant;
get-azaccesstoken -resourceURL "https://graph.microsoft.com/"
Get-AzAccessToken: ManagedIdentityCredential authentication failed: Service request failed.

_Status: 400 (Bad Request)
Content:
Headers:
X-Powered-By: REDACTED
ETag: W/"7e-AtyJbQt9VqLG5RxtNN/7cqAVKqA"
Date: Thu, 20 Oct 2022 09:26:24 GMT
Connection: keep-alive
Keep-Alive: REDACTED
Content-Type: application/json; charset=utf-8
Content-Length: 126
See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/managedidentitycredential/troubleshoot_

The doc seems to conflict with best practise MSGraph approach i.e. using a new AAD app registration with msgraph API permissions.

Start with the Get-AzAccessToken Example 3 documentation linked in the issue and reproduce the exact -ResourceUrl command in the reported tenant context. Determine whether the failure is in the managed-identity authentication path or in the documented Microsoft Graph permission assumptions; done means the command behavior and documentation agree and the 400 response has a clear resolution.

Written by the indexing model from the issue text.