DeviceProfileSample results in a 404 not found

The DeviceProfileSample sample results in a 404 not found. What am I doing wrong?

When I use the following I get results using the same identity for retrieving an access token through a device code:

az login --use-device-code
az rest --method get --url "https://dev.azure.com/myorgname/_apis/projects?api-version=2.2" --resource 499b84ac-1321-427f-aa17-267ca6975798

App registration manifest:

{
	"id": "someguid-a89c-430f-8179-024b9be5cd1f",
	"acceptMappedClaims": null,
	"accessTokenAcceptedVersion": null,
	"addIns": [],
	"allowPublicClient": true,
	"appId": "someguid-d10b-46d5-908f-60b0bb4b3e66",
	"appRoles": [],
	"oauth2AllowUrlPathMatching": false,
	"createdDateTime": "2021-11-28T15:51:11Z",
	"certification": null,
	"disabledByMicrosoftStatus": null,
	"groupMembershipClaims": null,
	"identifierUris": [],
	"informationalUrls": {
		"termsOfService": null,
		"support": null,
		"privacy": null,
		"marketing": null
	},
	"keyCredentials": [],
	"knownClientApplications": [],
	"logoUrl": null,
	"logoutUrl": null,
	"name": "PAT API Test App",
	"oauth2AllowIdTokenImplicitFlow": false,
	"oauth2AllowImplicitFlow": false,
	"oauth2Permissions": [],
	"oauth2RequirePostResponse": false,
	"optionalClaims": null,
	"orgRestrictions": [],
	"parentalControlSettings": {
		"countriesBlockedForMinors": [],
		"legalAgeGroupRule": "Allow"
	},
	"passwordCredentials": [],
	"preAuthorizedApplications": [],
	"publisherDomain": "mytenant.onmicrosoft.com",
	"replyUrlsWithType": [],
	"requiredResourceAccess": [
		{
			"resourceAppId": "499b84ac-1321-427f-aa17-267ca6975798",
			"resourceAccess": [
				{
					"id": "ee69721e-6c3a-468f-a9ec-302d16a4c599",
					"type": "Scope"
				}
			]
		},
		{
			"resourceAppId": "00000003-0000-0000-c000-000000000000",
			"resourceAccess": [
				{
					"id": "e1fe6dd8-ba31-4d61-89e7-88639da4683d",
					"type": "Scope"
				}
			]
		}
	],
	"samlMetadataUrl": null,
	"signInUrl": null,
	"signInAudience": "AzureADMyOrg",
	"tags": [],
	"tokenEncryptionKeyId": null
}

The issue does not name a file or test; start by locating the DeviceProfileSample entry point and compare its token resource and request with the working az rest example. Done means identifying the cause of the 404 and recording or correcting the sample with a reproducible verification.