[Entra ID] Generate AzureAd domain from the selected tenant instead of the username

[danroth27]

Summary

The Entra ID scaffolder generates AzureAd:Domain by appending .onmicrosoft.com to the user's complete sign-in name.

This produces an invalid tenant domain in every normal username-based invocation.

Related: #2890

Steps to reproduce

dotnet new blazor -n EntraTenantDomain `
    --framework net11.0 `
    --interactivity Server

dotnet scaffold aspnet entra-id `
    --project .\EntraTenantDomain\EntraTenantDomain.csproj `
    --username user@contoso.onmicrosoft.com `
    --tenantId contoso.onmicrosoft.com `
    --use-existing-application false

Inspect the generated AzureAd section in appsettings.json.

Actual behavior

The scaffolder generates:

{
  "AzureAd": {
    "Domain": "user@contoso.onmicrosoft.com.onmicrosoft.com",
    "TenantId": "contoso.onmicrosoft.com"
  }
}

The domain is produced by:

azureAdObject["Domain"] =
    $"{Username}.onmicrosoft.com";

A username or user principal name isn't a tenant domain. The generated value is invalid and doesn't match the tenant selected by --tenantId.

The scaffold operation still reports success, leaving users with identity configuration that is misleading and may fail in Microsoft Identity Web features that consume the domain.

Expected behavior

Domain should be resolved from the selected tenant, not from the username.

If --tenantId is already a verified tenant domain, it can be used directly:

if (TenantId.EndsWith(
        ".onmicrosoft.com",
        StringComparison.OrdinalIgnoreCase))
{
    azureAdObject["Domain"] = TenantId;
}

If --tenantId is a tenant GUID, the scaffolder should either:

• Query the selected tenant's verified domains and use the primary/default domain.
• Accept an explicit --domain option.
• Omit Domain when it isn't required rather than inventing a value.

For the reproduction above, the generated configuration should be:

{
  "AzureAd": {
    "Domain": "contoso.onmicrosoft.com",
    "TenantId": "contoso.onmicrosoft.com"
  }
}

The username should only select the developer credential used for provisioning. It shouldn't be used to construct application configuration.

Relevant files

• AspNet/ScaffoldSteps/UpdateAppSettingsStep.cs
• AspNet/ScaffoldSteps/ValidateEntraIdStep.cs
• AspNet/Extensions/BlazorEntraScaffolderBuilderExtensions.cs