We built the broker against a mock Entra first. The mock made the flow look simple: tokens came back, claims matched, the

tests passed. Moving to a real tenant changed that. This part lists what the real service did differently, with the symptom

we saw, the cause we found and the fix we shipped. Each one now has code or a comment behind it, so the next person does not

have to rediscover it.

Newly created objects are not visible at once

Symptom. A GET straight after creating a blueprint returned 404. A pre-authorisation written right after its scope failed

with 400 Permission Id that cannot be found . A consent query right after creating a service principal also returned 404.

Cause. Entra replicates new objects. A write can succeed while a read from another region still sees nothing.

Fix. The provisioning script waits for each new object to appear, and it retries "not there yet" errors with a short,

growing delay.…