[Bugs] Title: Copilot MCP OAuth uses wrong client/resource for remote Dataverse MCP ...

**Mood:** 😔
**Category:** Bugs

Title: Copilot MCP OAuth uses wrong client/resource for remote Dataverse MCP server → AADSTS65002 on (re)auth & refresh

Summary:
When connecting to or refreshing a remote Dataverse MCP server (https://.crm.dynamics.com/api/mcp, Entra/Azure AD auth), the app's interactive auth requests a token as client 04b07795-8ddb-461a-bbee-02f9e1bf7b46 (Azure CLI) for resource 00000007-0000-0000-c000-000000000000 (generic Dataverse Web API). Entra rejects this first-party→first-party combination with AADSTS65002 ("Consent … must be configured via preauthorization"). The auth popup therefore always fails and recurs.

Expected behavior:
The client should honor the server's published protected-resource metadata. GET https://.crm.dynamics.com/.well-known/oauth-protected-resource returns:

authorization_servers: the org tenant authority
scopes_supported: https://.crm.dynamics.com/api/mcp/mcp.tools
Auth should use the dynamically-registered client (e.g. the Microsoft GitHub Copilot App, aebc6443-996d-45c2-90f0-388ff96faa56) requesting scope …/api/mcp/mcp.tools, not Azure CLI / the generic Dataverse audience.

Evidence it's a client-side bug (server is correctly configured):

A direct MCP initialize to /api/mcp with a token for client aebc6443-… + scope mcp.tools returns 200 and a working session.
The refresh_token grant against that client + mcp.tools scope renews silently (HTTP 200), returning fresh tokens.
So the protected-resource metadata, the registered client, and refresh all work — the app is just using the wrong client/resource on the interactive (and refresh-fallback) path.
Impact:
Recurring auth-failure popups; risk of the MCP connection dropping at access-token expiry even when the Dataverse environment is fully configured (MCP client allow-listing enabled, valid mcp.tools token already issued).

Repro steps:

Register a remote Dataverse MCP server https://.crm.dynamics.com/api/mcp (Entra auth) in Copilot.
Trigger (re)authentication.
Browser returns AADSTS65002, naming client 04b07795-… and resource 00000007-….
Environment:

GitHub Copilot CLI 1.0.64-1, desktop bundle gh 2.95.0, git helper 2.53.0-3
OS: Windows
(Tenant ID, org URL, and Entra Trace/Correlation IDs available privately on request.)
Suggested fix:
On both initial interactive auth and token refresh for remote MCP servers, derive the client + scope from the server's /.well-known/oauth-protected-resource (use the registered/DCR client and the advertised …/mcp.tools scope) instead of defaulting to the Azure CLI client ID and the generic Dataverse resource.

---
| Field | Value |
| --- | --- |
| App version | 1.0.6 |
| OS | Windows 10.0.26200 |
| Theme | GitHub |
| Path | /chat |
| Tenure | Week 2 |

Start by fetching the remote server's /.well-known/oauth-protected-resource metadata and compare its authorization server and advertised /api/mcp/mcp.tools scope with the interactive and refresh-fallback OAuth requests. Trace both remote MCP authentication paths, then verify that authentication and token renewal use the discovered client and scope and that the MCP initialize request succeeds without AADSTS65002.

Vom Indexierungsmodell aus dem Issue-Text verfasst.