[Bug] Improve logging and error message when the web api receives claim challenge

[bgavrilMS]

Library version used

4.58.0

.NET version

all

Scenario

ConfidentialClient - web api (AcquireTokenOnBehalfOf)

Is this a new or an existing app?

None

Issue description and reproduction steps

Better logs and error message is needed to guide app developers to implement OBO correctly when it comes to claims challenges, MFA etc. Note that exception messages are not logged by default, so please treat this case.

See https://portal.microsofticm.com/imp/v3/incidents/incident/457725369/summary for confused app developers

I propose changes as follows:

1. If error code is invalid_grant and Claims are present and this is an OBO flow If response contains Claims, log and throw non-pii exception with clear message to https://learn.microsoft.com/en-us/entra/msal/dotnet/acquiring-tokens/web-apps-apis/on-behalf-of-flow#handling-multi-factor-auth-mfa-conditional-access-and-incremental-consent
2. If it's not an OBO flow but Claims are present, add a helper message and a link to https://learn.microsoft.com/en-us/entra/msal/dotnet/advanced/exceptions/msal-error-handling#conditional-access-and-claims-challenges

Alternative: create an MsalClaimsChallengeException that derives from MsalUiRequiredException to make it more clear that Claims are present.

CC @localden @neha-bhargava

Relevant code snippets

No response

Expected behavior

No response

Identity provider

Microsoft Entra ID (Work and School accounts and Personal Microsoft accounts)

Regression

No response

Solution and workarounds

No response