I've created a Service Fabric cluster via the portal, using the Basic configuration type for Security, so it automatically generated certificates in a key vault of my choice.
I've then created Azure AD applications per instructions at https://docs.microsoft.com/en-gb/azure/service-fabric/service-fabric-cluster-creation-via-arm#set-up-azure-active-directory-for-client-authentication and assigned myself the Admin role in the enterprise
Next I've configured AAD security for the cluster, using the values from the PowerShell script used in the previous step.
I can now deploy from within Visual Studio, so at least part of it is working. However when navigating to the Service Fabric Explorer, I get the following error when signing in:
AADSTS65005: Invalid resource. The client has requested access to a resource which is not listed in the requested permissions in the client's application registration. Client app ID: [redacted]. Resource value from request: . Resource app ID: 00000002-0000-0000-c000-000000000000. List of valid resources from app registration: .
What step have I missed that causes this error?