E2E test AcquireTokenWithMtlsPop_WithBindingCertificate_ReturnsMtlsPopToken fails: AAD westus3 test slice returns Bearer instead of mtls_pop

[neha-bhargava]

Test: AcquireTokenWithMtlsPop_WithBindingCertificate_ReturnsMtlsPopToken in tests/E2E Tests/TokenAcquirerTests/TokenAcquirer.cs

Symptom

Microsoft.Identity.Client.MsalClientException: You asked for token type mtls_pop, but receive Bearer. This occurs if the Identity Provider (AAD, B2C, ADFS etc.) does not support the requested token type. at Microsoft.Identity.Client.OAuth2.TokenClient.SendTokenRequestAsync(...)

Investigation

Reproduced and root-caused while debugging the same failure in MSAL.NET (AzureAD/microsoft-authentication-library-for-dotnet#6084 / PR #6084):

• The test targets the AAD westus3 test slice (option.AzureRegion = ""westus3"" against tenant bea21ebe-..., app 163ffef9-...).
• MSAL is correctly routing to westus3.mtlsauth.microsoft.com, sending token_type=mtls_pop in the body, and presenting the SNI cert.
• The matching MSAL.NET test against the global mtlsauth.microsoft.com endpoint continues to pass.
• AAD is downgrading the response on the regional test slice only.

Mitigation

Skip the test via [Fact(Skip = ""..."")] until the AAD test slice honors token_type=mtls_pop again. The skip will be removed and the test re-enabled when this issue is closed.

Reference

• Mark regional SNI mTLS PoP test inconclusive on AAD test-slice Bearer downgrade microsoft-authentication-library-for-dotnet#6084 — same fix in MSAL.NET integration tests.

[gladjohn]

Neha Bhargava (@neha-bhargava) this can be reverted now