Desktop app 1.1.17:  COPILOT_ENTRA_AUTH_AUD  (EMU audience) breaks MCP Entra sign-in with  ENTRA_CONFIG 2002 - CLI on the same machine works

Describe the bug

Environment

The bug

Windows devices configured for GitHub Enterprise Managed Users carry a machine-scope variable:

COPILOT_ENTRA_AUTH_AUD = "some-value"
                     = "GitHub Enterprise Managed User (OIDC)"  (GitHub's tenant)

It exists for Copilot's own Entra to GitHub token exchange. Since the WAM/OneAuth MCP path landed (#4660), it also reaches MCP sign-in, pinning a cross-tenant audience while the authority is the customer's own tenant. OneAuth rejects the configuration before any network call:

Request session.mcp.oauth.login failed: Microsoft Entra sign-in for
https://<our-mcp-server>/mcp/ failed: ENTRA_CONFIG: the authenticator
rejected the configuration [code 2002, tag 7q6cl].
Set COPILOT_ENTRA_DISABLE_ONEAUTH=1 to sign in through the browser instead.

Three observations that isolate it to the OneAuth path

1. Clearing the variable for a single process fixes it, with no client or server change:

Remove-Item Env:\COPILOT_ENTRA_AUTH_AUD
Start-Process "$env:LOCALAPPDATA\Programs\GitHub Copilot\github.exe"

Sign-in then succeeds immediately.

2. The CLI works on the same machine with the machine-scope variable still set, consistent with the release note that machines without the broker library keep the browser flow.

3. macOS 1.1.17 works. That build contains no OneAuth strings at all, so the variable is never consumed.

Steps to reproduce

1. Windows machine with COPILOT_ENTRA_AUTH_AUD set machine-wide (any EMU-configured device).
2. Add an Entra-protected MCP server whose API lives in a different tenant.
3. Sign in from the MCP tab. Fails 100%.
4. Same server, same machine, via the CLI. Succeeds.

Expected behavior

MCP token acquisition ignores COPILOT_ENTRA_AUTH_AUD, and an ENTRA_CONFIG rejection falls back to the browser flow rather than failing hard.

首先，将桌面应用在 resources/copilot-sdk/cliVersion.d.ts 中捆绑的 CLI runtime 与 Windows 上正常工作的 @github/copilot CLI 行为进行比较。在设置 COPILOT_ENTRA_AUTH_AUD 的情况下复现 MCP 登录，然后移除该变量，再使用 COPILOT_ENTRA_DISABLE_ONEAUTH=1 进行复现。当 MCP 登录忽略 Copilot audience，并在 ENTRA_CONFIG 拒绝后回退到浏览器时，即表示完成。