MicrosoftAppTokenRequest(MicrosoftAppTokenRequest)
App-only (client-credentials) token exchange — no user, no email.The caller is identified by the appid/azp claim inside the token and mapped
to a registered service account via the service_client allowlist.
{
"azure_ad_token": "string"
}