[Hou (SciencePotato)]

Summary

• accept Microsoft Graph's unrestrictedAudience representation as an empty provider configuration only when the application is still single tenant (AzureADMyOrg)
• continue rejecting the same unrestricted shape for multitenant applications
• pass the application sign-in audience through provider selection, preflight, and post-deployment stale-plan validation
• add regression coverage for existing single-tenant apps and approval-gated app creation

Why

A newly created single-tenant app can be returned by Microsoft Graph beta with kind=unrestricted rather than a null signInAudienceRestrictions. Guided setup currently creates the Azure resources, then rejects that safe single-tenant representation before applying the approved provider allowlist. The run reports:

The application has an unsupported provider-tenant restriction.

The resources and app remain intentionally in place for recovery. This fix lets a rerun with the same application and prefix continue while preserving the multitenant safety boundary.

Validation

• all 10 offline setup test scripts passed
• git diff --check passed
• confirmed the affected app is AzureADMyOrg with Graph unrestrictedAudience; no identifiers or allowed-tenant values were printed