OIDC with Entra ID cannot be set up due to AADSTS1002012

Describe the bug

It is not possible to enter/check OIDC settings for Entra ID successfully via the admin UI.

Error message: "Unexpected response from token endpoint (HTTP 400): AADSTS1002012: The provided value for scope openid is not valid. Client credential flows must have a scope value with /.default suffixed to the resource identifier (application ID URI). Trace ID: 2da7d0ed-dae2-4fac-95ab-a28643252c00 Correlation ID: ae925c45-bddf-4bc5-9e98-035fa0610a0c Timestamp: 2026-09-17 17:34:43Z"

Metabase 1.63.18

To Reproduce

1. Go to /admin/settings/authentication/oidc
2. Enter Entra ID client settings
3. Click on check or save

Expected behavior

Check succeeds & does not block saving the settings

Logs

2026-09-17T19:50:50+02:00 INFO metabase.sso.oidc.discovery Fetching OIDC discovery document from https://login.microsoftonline.com/x-x-x-x-x/v2.0/.well-known/openid-configuration
2026-09-17T19:50:50+02:00 INFO metabase.sso.oidc.discovery Invalidated discovery cache for issuer https://login.microsoftonline.com/x-x-x-x-x/v2.0
2026-09-17T19:50:50+02:00 DEBUG metabase.server.middleware.log POST /api/ee/sso/oidc/check 400 225ms (0 DB calls) {:metabase-user-id 7}

Information about your Metabase installation

{
  "browser-info": {
    "language": "en",
    "platform": "MacIntel",
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36",
    "vendor": "Google Inc."
  },
  "metabase-info": {
    "databases": [
      "postgres",
      "sqlite"
    ],
    "run-mode": "prod",
    "plan-alias": "pro-self-hosted-yearly",
    "version": {
      "date": "2026-09-15",
      "tag": "v1.63.18",
      "hash": "2ba2485"
    },
    "settings": {
      "report-timezone": "Europe/Vienna"
    },
    "hosting-env": "unknown",
    "application-database": "postgres",
    "application-database-details": {
      "database": {
        "name": "PostgreSQL",
        "version": "16.13"
      },
      "jdbc-driver": {
        "name": "PostgreSQL JDBC Driver",
        "version": "42.7.12"
      }
    }
  },
  "system-info": {
    "file.encoding": "UTF-8",
    "java.runtime.name": "OpenJDK Runtime Environment",
    "java.runtime.version": "25.0.4+7-LTS",
    "java.vendor": "Eclipse Adoptium",
    "java.vendor.url": "https://adoptium.net/",
    "java.version": "25.0.4",
    "java.vm.name": "OpenJDK 64-Bit Server VM",
    "java.vm.version": "25.0.4+7-LTS",
    "jvm.available-processors": 2,
    "jvm.max-memory": "750.0 MB",
    "os.name": "Linux",
    "os.version": "6.12.90-120.164.amzn2023.x86_64",
    "system.total-memory": "2.9 GB",
    "user.language": "en",
    "user.timezone": "Europe/Vienna"
  }
}

Severity

Blocking

Additional context

We are in trial period and this feature is essential for us to work - the reason we purchase the Pro license.