Desktop app 1.1.17:  COPILOT_ENTRA_AUTH_AUD  (EMU audience) breaks MCP Entra sign-in with  ENTRA_CONFIG 2002 - CLI on the same machine works

Describe the bug

Environment

The bug

Windows devices configured for GitHub Enterprise Managed Users carry a machine-scope variable:

COPILOT_ENTRA_AUTH_AUD = "some-value"
                     = "GitHub Enterprise Managed User (OIDC)"  (GitHub's tenant)

It exists for Copilot's own Entra to GitHub token exchange. Since the WAM/OneAuth MCP path landed (#4660), it also reaches MCP sign-in, pinning a cross-tenant audience while the authority is the customer's own tenant. OneAuth rejects the configuration before any network call:

Request session.mcp.oauth.login failed: Microsoft Entra sign-in for
https://<our-mcp-server>/mcp/ failed: ENTRA_CONFIG: the authenticator
rejected the configuration [code 2002, tag 7q6cl].
Set COPILOT_ENTRA_DISABLE_ONEAUTH=1 to sign in through the browser instead.

Three observations that isolate it to the OneAuth path

1. Clearing the variable for a single process fixes it, with no client or server change:

Remove-Item Env:\COPILOT_ENTRA_AUTH_AUD
Start-Process "$env:LOCALAPPDATA\Programs\GitHub Copilot\github.exe"

Sign-in then succeeds immediately.

2. The CLI works on the same machine with the machine-scope variable still set, consistent with the release note that machines without the broker library keep the browser flow.

3. macOS 1.1.17 works. That build contains no OneAuth strings at all, so the variable is never consumed.

Steps to reproduce

1. Windows machine with COPILOT_ENTRA_AUTH_AUD set machine-wide (any EMU-configured device).
2. Add an Entra-protected MCP server whose API lives in a different tenant.
3. Sign in from the MCP tab. Fails 100%.
4. Same server, same machine, via the CLI. Succeeds.

Expected behavior

MCP token acquisition ignores COPILOT_ENTRA_AUTH_AUD, and an ENTRA_CONFIG rejection falls back to the browser flow rather than failing hard.

Commencez par comparer le runtime CLI fourni avec l’application de bureau dans resources/copilot-sdk/cliVersion.d.ts avec le comportement fonctionnel de la CLI @github/copilot sous Windows. Reproduisez la connexion MCP avec COPILOT_ENTRA_AUTH_AUD défini, puis sans cette variable et avec COPILOT_ENTRA_DISABLE_ONEAUTH=1. C’est terminé lorsque la connexion MCP ignore l’audience Copilot et revient au navigateur après un rejet ENTRA_CONFIG.