Remote Power BI MCP connector requests retired scope user_impersonation (AADSTS650053)

### What happened?

Connecting the official remote Power BI MCP server (https://api.fabric.microsoft.com/v1/mcp/powerbi) via a custom connector fails during authorization, on Claude Desktop (Windows 11).

The connector requests an Entra (Azure AD) token using the scope "https://analysis.windows.net/powerbi/api/user_impersonation". Microsoft retired the generic "user_impersonation" scope from the Power BI Service resource (00000009-0000-0000-c000-000000000000) when it merged into Fabric, so Entra rejects it with:

AADSTS650053: The application 'PowerBI MCP - Claude' asked for scope 'user_impersonation' that doesn't exist on the resource '00000009-0000-0000-c000-000000000000'. Contact the app vendor.

However, the server's own protected-resource metadata advertises a different scope. A GET to:
https://api.fabric.microsoft.com/.well-known/oauth-protected-resource/v1/mcp/powerbi
returns scopes_supported = ["https://analysis.windows.net/powerbi/api/.default"]

So the server expects ".default", but the connector ignores scopes_supported and forces "/user_impersonation", which no longer exists on the resource.

I verified the app and endpoint are correctly configured:
- Requesting ".default" via MSAL returns a valid token, and POST initialize to the endpoint succeeds (HTTP 200, serverInfo: PowerBIMCPServer 1.0.0).
- Requesting ".../user_impersonation" fails with AADSTS650053.
- Creating a "user_impersonation" scope on my own Entra app (api:///user_impersonation) issues tokens fine, confirming the problem is that Claude requests the scope against the Power BI resource (where it no longer exists) instead of using ".default".

The custom connector's advanced settings only expose OAuth Client ID and Client Secret, with no field to override the requested scope, so there is no user-side workaround. For reference, VS Code + GitHub Copilot connect to the same remote server successfully using their own pre-registered client, which isolates the issue to how the Claude connector derives the OAuth scope.

Entra app: single tenant, public client, redirect https://claude.ai/api/mcp/auth_callback. Delegated permissions (admin-consented): Dataset.Read.All, Workspace.Read.All, MLModel.Execute.All, User.Read. Power BI tenant setting for the MCP endpoint is enabled. Last reproduced 2026-06-30 ~17:00 CEST.

### What did you expect to happen?

The connector should honor scopes_supported from the protected-resource metadata and request ".default" instead of forcing "{resource}/user_impersonation". With ".default", authorization succeeds (verified manually). Alternatively, expose an advanced setting to override the OAuth scope.

### Steps to reproduce

1. In Claude Desktop, go to Connectors > Add custom connector.
2. Set URL to https://api.fabric.microsoft.com/v1/mcp/powerbi and optionally an Entra app Client ID.
3. Click Connect and sign in with a Microsoft Entra account with Power BI Pro/PPU.
4. Authorization fails. Entra sign-in log shows AADSTS650053 (scope user_impersonation doesn't exist on resource 00000009-0000-0000-c000-000000000000).
5. GET https://api.fabric.microsoft.com/.well-known/oauth-protected-resource/v1/mcp/powerbi returns scopes_supported = ["https://analysis.windows.net/powerbi/api/.default"].
6. Requesting ".default" via MSAL works (HTTP 200 on initialize); requesting ".../user_impersonation" fails with AADSTS650053.

### Area

MCP Connector (adding/managing servers)

### MCP Server (if applicable)

Power BI (remote) - https://api.fabric.microsoft.com/v1/mcp/powerbi

### Error messages or logs

```shell
AADSTS650053: The application 'PowerBI MCP - Claude' asked for scope 'user_impersonation' that doesn't exist on the resource '00000009-0000-0000-c000-000000000000'. Contact the app vendor.

Connector requested scope: https://analysis.windows.net/powerbi/api/user_impersonation
Server advertises (scopes_supported): https://analysis.windows.net/powerbi/api/.default
```

### Additional context

Power BI tenant setting for the MCP endpoint is enabled. As a workaround I run a local stdio MCP server that authenticates with .default, which works correctly — so the issue is specifically the remote connector's OAuth scope handling, not my Entra configuration. Creating a "user_impersonation" scope on my own app issues tokens fine, which confirms Claude requests the scope against the Power BI resource (where Microsoft retired it) rather than using ".default" as the server's metadata indicates.