This is a bug in AAD, which is a very different thing than AD. There is some interoperability between them (ok more than some) but needing AD for legacy auth doesn’t necessarily mean you need AAD for Oauth.