Security defaults block device code sign-in, and the error does not say so
Sign-in succeeded, then reported no access to the resource. There were no conditional access policies in the tenant at all.
Several administrative tools authenticate using device code flow: the tool prints a short code, you enter it at a sign-in page in a browser, and the tool receives a token. It is convenient, and it works from machines with no browser.
On a tenant with the default security baseline enabled it can also be blocked outright. The message is unhelpful, saying the sign-in was successful but that you do not have permission to access the resource.
That reads like a permissions problem with the application, so the instinct is to check consent and API permissions. Both were fine. The tenant had no conditional access policies at all, which ruled out the other obvious suspect.
What is actually happening
Device code flow has no device identity in the loop by design, which is exactly what makes it useful and exactly why baseline security settings restrict it. It is a known phishing vector, so blocking it is deliberate.
The fix
Use interactive authentication instead. Most tools offer both, usually as a switch on the connect command. That opens a real browser sign-in from the machine itself, which satisfies the baseline. In our case the same tool, the same account and the same registered application worked immediately once switched.
The tenant sign-in log gives the actual reason, where the client only sees a generic denial. Look up the failed attempt by its correlation ID, which is shown on the error page.
Do not disable the baseline to fix a tool
It is tempting, because turning the baseline off makes the error go away. It also removes multi-factor enforcement and legacy authentication blocking from the whole organisation, to work around one sign-in method that has an easy alternative.
If you genuinely need the baseline off, it should be because you are replacing it with conditional access policies you have actually built, not because a command line tool was inconvenient.
Need help with any of this?
These notes are free and always will be. If you would rather someone just set it up, or you are stuck on something similar, get in touch at hello@opsira.io.