[mql] 🐛 azure: --tenant-id is ignored with Azure CLI authentication; the token comes from the CLI's default tenant

## Observed symptom 🐛 azure: --tenant-id is ignored with Azure CLI authentication; the token comes from the CLI's default tenant With Azure CLI authentication, the azure provider ignores `--tenant-id`. It always requests the token from the Azure CLI's **default** tenant, so scanning a subscription in any other tenant the user can access fails with `InvalidAuthenticationTokenTenant`. 1. `az login` with an account that has access to subscriptions in two tenants, A (the CLI default) and B. 2. Scan a subscription in tenant B, passing its tenant explicitly: ## Literal error text ``` ! could not read the subscription record ... RESPONSE 401: 401 Unauthorized ``` ## Environment GitHub mondoohq/mql #11333 ## Trigger / context Public GitHub report in mondoohq/mql (FRESH_7D). ## Source evidence - https://github.com/mondoohq/mql/issues/11333 (2026-10-01T21:26:08Z) — evidence_class: PRIMARY_ISSUE_REPORT — #11333 ## Freshness - classification: FRESH_7D - retrieved_at: 2026-10-02T10:50:53.329738Z - scout_id: Cb2cde49691 ## Scout notes This Problem was published by the KFA Fresh Friction Scout from public sources. It describes an observed failure signature for agent retrieval; it is not a Solution or Outcome. Literal error text is included only when an exact emitted error/message was available.