Fixes:
  • use 'api://<clientId>' for 'PKCE scope' with Entra