How to check if Work IQ service principal exists when using OBO?

See the following issue:

1. Tenant lacks the Work IQ service principal
2. Client calls a service API with a service scoped token
3. Service tries to exchange the token for a Work IQ token
4. Request fails with the following error:

{"AADSTS65001: The user or administrator has not consented to use the application with ID '***' named '***'. Send an interactive authorization request for this user and resource. Trace ID: 9f99349c-9be6-4355-b506-793c3e8b1a00 Correlation ID: 3231d65f-4624-4de8-ba71-fac50ccb5c8c Timestamp: 2026-08-25 00:30:31Z"}

5. Admin approves the permission scopes, leading to the following error in their browser (or MSAL client):

The app is trying to access a service fdcc1f02-fc51-4226-8753-f668596af7f7 (Work+IQ) that your organization *** lacks a service principal for. Contact your IT Admin to review the configuration of your service subscriptions or consent to the application in order to create the required service principal. Trace ID: 1d0e58b3-f2f1-41a7-b635-ccf4a5751900 Correlation ID: 2dae0876-704d-4f28-ac80-825b7711e51d

Why is the subsequent error not returned after the initial attempt at the token exchange? If this were the case, a message could be surfaced to the client indicating what the underlying issue is, instead of trying to direct them to approve permissions for a resource that doesn't exist yet.

Is there a mechanism for detecting whether the service principal exists, specifically in a delegated context for any type of user? The following Graph API endpoint fails with a 403 Forbidden for non-admin users: https://learn.microsoft.com/en-us/graph/api/serviceprincipal-get?view=graph-rest-1.0&tabs=http

Does anyone have any insight as to whether this service principal will automatically be added to tenants? If I'm an ISV, asking end users to follow the steps in this guide is quite clunky, and I haven't found a way to detect whether or not they've completed this step on my end.

Start by reproducing the delegated OBO token exchange described in the issue and compare its initial error with the later service-principal error. Review the linked Microsoft Graph servicePrincipal endpoint and the Work IQ enablement guide, then establish whether a non-admin delegated check is available and what client-facing result should indicate a missing service principal.