Conditional Access grant controls

[added: Microsoft Authenticator requires UserAuthenticationMethod.ReadWrite access to register credentials. When this permission is used in a delegated context by Microsoft Authenticator, access required for credential registration isn't blocked by the Require device to be marked as compliant grant control. This exception doesn't apply to application permissions. Requests using the UserAuthenticationMethod.ReadWrite application permission remain subject to the Require device to be marked as compliant check.]

[removed: Similarly, the Require device to be marked as compliant doesn't block Microsoft Authenticator app access to the UserAuthenticationMethod.Read scope. Authenticator needs access to the UserAuthenticationMethod.Read scope during Authenticator registration to determine which credentials a user can configure. Authenticator needs access to UserAuthenticationMethod.ReadWrite to register credentials, which doesn't bypass the Require device to be marked as compliant check.]