GraphServiceClient does not use ClientSecretCredential

[drodil]

Describe the bug

I am trying to use ClientSecretCredential with GraphServiceClient as follows:

TokenCredential tokenCredential = new ClientSecretCredentialBuilder().clientSecret(props.clientSecret()).clientId(props.clientId())
                .tenantId(props.tenantId()).build();
GraphServiceClient graphClient = new GraphServiceClient(tokenCredential);
Group group = graphClient.groups().byGroupId(id).get();
logger.info("{}", group.getId());

This works if there's no environment variables AZURE_CLIENT_ID / AZURE_TENANT_ID set but if they are, the client will try to use those for authentication.

Expected behavior

Graph client should only use the provided token credential(s), not override it with environment variables.

How to reproduce

1. Create client as described above
2. Run the code with proper client id / secret / tenant id
3. Group is found
4. Add environment variable AZURE_CLIENT_ID or AZURE_TENANT_ID with dummy value
5. Run the code again

SDK Version

6.27.0

Latest version known to work for scenario above?

No response

Known Workarounds

No response

Debug output

Click to expand log

``` "message":{"value":"[Correlation ID: UUID] Execution of class com.microsoft.aad.msal4j.AcquireTokenByClientCredentialSupplier failed: AADSTS90002: Tenant '1234' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. Check with your subscription administrator, this may happen if there are no active subscriptions for the tenant. ```

Configuration

• OS: macOS Sequoia 15.3.1
• JVM: 21

Other information

No response