Desktop app 1.1.17:  COPILOT_ENTRA_AUTH_AUD  (EMU audience) breaks MCP Entra sign-in with  ENTRA_CONFIG 2002 - CLI on the same machine works

Describe the bug

Environment

The bug

Windows devices configured for GitHub Enterprise Managed Users carry a machine-scope variable:

COPILOT_ENTRA_AUTH_AUD = "some-value"
                     = "GitHub Enterprise Managed User (OIDC)"  (GitHub's tenant)

It exists for Copilot's own Entra to GitHub token exchange. Since the WAM/OneAuth MCP path landed (#4660), it also reaches MCP sign-in, pinning a cross-tenant audience while the authority is the customer's own tenant. OneAuth rejects the configuration before any network call:

Request session.mcp.oauth.login failed: Microsoft Entra sign-in for
https://<our-mcp-server>/mcp/ failed: ENTRA_CONFIG: the authenticator
rejected the configuration [code 2002, tag 7q6cl].
Set COPILOT_ENTRA_DISABLE_ONEAUTH=1 to sign in through the browser instead.

Three observations that isolate it to the OneAuth path

1. Clearing the variable for a single process fixes it, with no client or server change:

Remove-Item Env:\COPILOT_ENTRA_AUTH_AUD
Start-Process "$env:LOCALAPPDATA\Programs\GitHub Copilot\github.exe"

Sign-in then succeeds immediately.

2. The CLI works on the same machine with the machine-scope variable still set, consistent with the release note that machines without the broker library keep the browser flow.

3. macOS 1.1.17 works. That build contains no OneAuth strings at all, so the variable is never consumed.

Steps to reproduce

1. Windows machine with COPILOT_ENTRA_AUTH_AUD set machine-wide (any EMU-configured device).
2. Add an Entra-protected MCP server whose API lives in a different tenant.
3. Sign in from the MCP tab. Fails 100%.
4. Same server, same machine, via the CLI. Succeeds.

Expected behavior

MCP token acquisition ignores COPILOT_ENTRA_AUTH_AUD, and an ENTRA_CONFIG rejection falls back to the browser flow rather than failing hard.

Inizia confrontando il runtime CLI incluso nell’app desktop in resources/copilot-sdk/cliVersion.d.ts con il comportamento funzionante della CLI @github/copilot su Windows. Riproduci l’accesso MCP con COPILOT_ENTRA_AUTH_AUD impostato, poi rimuovilo e ripeti con COPILOT_ENTRA_DISABLE_ONEAUTH=1. Il lavoro è completato quando l’accesso MCP ignora l’audience di Copilot e ricorre al browser dopo un rifiuto ENTRA_CONFIG.