Desktop app 1.1.17:  COPILOT_ENTRA_AUTH_AUD  (EMU audience) breaks MCP Entra sign-in with  ENTRA_CONFIG 2002 - CLI on the same machine works

Describe the bug

Environment

The bug

Windows devices configured for GitHub Enterprise Managed Users carry a machine-scope variable:

COPILOT_ENTRA_AUTH_AUD = "some-value"
                     = "GitHub Enterprise Managed User (OIDC)"  (GitHub's tenant)

It exists for Copilot's own Entra to GitHub token exchange. Since the WAM/OneAuth MCP path landed (#4660), it also reaches MCP sign-in, pinning a cross-tenant audience while the authority is the customer's own tenant. OneAuth rejects the configuration before any network call:

Request session.mcp.oauth.login failed: Microsoft Entra sign-in for
https://<our-mcp-server>/mcp/ failed: ENTRA_CONFIG: the authenticator
rejected the configuration [code 2002, tag 7q6cl].
Set COPILOT_ENTRA_DISABLE_ONEAUTH=1 to sign in through the browser instead.

Three observations that isolate it to the OneAuth path

1. Clearing the variable for a single process fixes it, with no client or server change:

Remove-Item Env:\COPILOT_ENTRA_AUTH_AUD
Start-Process "$env:LOCALAPPDATA\Programs\GitHub Copilot\github.exe"

Sign-in then succeeds immediately.

2. The CLI works on the same machine with the machine-scope variable still set, consistent with the release note that machines without the broker library keep the browser flow.

3. macOS 1.1.17 works. That build contains no OneAuth strings at all, so the variable is never consumed.

Steps to reproduce

1. Windows machine with COPILOT_ENTRA_AUTH_AUD set machine-wide (any EMU-configured device).
2. Add an Entra-protected MCP server whose API lives in a different tenant.
3. Sign in from the MCP tab. Fails 100%.
4. Same server, same machine, via the CLI. Succeeds.

Expected behavior

MCP token acquisition ignores COPILOT_ENTRA_AUTH_AUD, and an ENTRA_CONFIG rejection falls back to the browser flow rather than failing hard.

まず、resources/copilot-sdk/cliVersion.d.ts にあるデスクトップアプリのバンドル済み CLI ランタイムを、Windows で動作する @github/copilot CLI の挙動と比較します。COPILOT_ENTRA_AUTH_AUD を設定した状態で MCP サインインを再現し、次にそれを削除した状態、さらに COPILOT_ENTRA_DISABLE_ONEAUTH=1 を設定した状態で再現します。MCP サインインが Copilot の audience を無視し、ENTRA_CONFIG による拒否の後にブラウザーへフォールバックすれば完了です。