… level

When a ConfidentialClientApplication is configured with a specific tenant
at the app level, calling .WithTenantId('9188040d-...') (the MSA/consumer
tenant GUID) at the request level was silently ignored.

Root cause: IsCommonOrganizationsOrConsumersTenant() equates both the
'consumers' string alias and the MSA GUID as tenantless, causing the
request-level override to be discarded.

Fix: Add IsConsumersGuid() helper to AadAuthority that returns true only
for the MSA GUID (not the 'consumers' alias). Use it in the request
authority resolution condition in CreateAuthorityForRequestAsync so the
GUID is honored as a real tenant ID at request level.

The 'consumers' string alias continues to be ignored at request level
per the existing known limitation (#2929).

Fixes #5951

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…iltering

GetTenantedAuthority (AadAuthority): the MSA tenant GUID is a real tenant ID
and should not be replaced by a caller-supplied tenant when forceSpecifiedTenant=false.
Previously IsCommonOrganizationsOrConsumersTenant() returned true for the GUID,
causing it to be replaced like 'common' or 'consumers'. Added && !IsConsumersGuid()
guard to preserve the GUID unless replacement is explicitly forced.

FilterTokensByHomeAccountTenantOrAssertion (OBO cache): the same root cause meant
OBO cache lookups with the MSA GUID as authority set filterByTenantId=false, logging
a spurious 'Please use tenanted authority' warning and skipping tenant filtering.
Fixed by treating the MSA GUID as a tenanted authority in the filter expression.

Test: GetTenantedAuthority_MsaGuid_IsNotReplaced in AadAuthorityTests covers both
forceSpecifiedTenant=false (preserved) and =true (replaced) cases.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- ConfidentialClientApplicationTests: change ClientCreds_WithTenantId_MsaGuid test
  to configure app with MSA GUID authority and override with a different tenant at
  request level, validating that the override fires (not the app-level MSA GUID)
- AuthorityTests: refactor WithTenantId_ConsumerGuid_IsHonoredAtRequestLevel from
  inline cases to [DataRow] with descriptive DisplayNames for easier reading in
  the test runner

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…equest-level tenant relaxation

- Delete the misleading IsCommonOrganizationsOrConsumersTenant helper (both instance
  and static overloads) — it conflated truly tenantless aliases (common/organizations)
  with real tenant identifiers (consumers/MSA GUID).
- Remove 'consumers' from s_tenantlessTenantNames to match the semantic model:
  only 'common' and 'organizations' are tenantless.
- Replace all 6 call sites with IsCommonOrOrganizationsTenant:
  AadAuthority.GetTenantedAuthority, AuthorityInfo.CreateAuthorityForRequestAsync,
  CiamAuthority.GetTenantedAuthority, DstsAuthority.GetTenantedAuthority,
  MtlsPopParametersInitializer, TokenCache.FilterTokensByHomeAccountTenantOrAssertion.
- Full relaxation: any request-level tenant that is not 'common' or 'organizations'
  (including 'consumers' string and the MSA GUID) is now honored at request level.
- Update AuthorityTests DataRows: consumers at request level now wins instead of
  being ignored (AppSpecificTenant_RequestConsumersAlias_ConsumersWins,
  AppCommon_RequestConsumersAlias_ConsumersWins).
- Delete IsCommonOrganizationsOrConsumersTenant_MsaGuid_ReturnsFalse test (method
  no longer exists).
- Delete MtlsPop_WithMsaTenantGuidAuthority_DoesNotThrowMissingTenantedAuthority
  test per Bogdan's review — covered by the bearer token regression test.

Fixes #5951

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

GetAuthorizationRequestUrl_WithConsumerInCreate_ReturnsConsumers was
asserting StartsWith(Constants.Common) but the test name says
'ReturnsConsumers'. The PR fix correctly routes consumers authority,
so update the assertion to match the intended behavior.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…d_bugfix