M365 Graph MCP consent wall is self-serviceable on your own tenant

Graph-API MCP servers (e.g. ms-365-mcp-server) fail device-code login with only-an-admin-can-grant on tenants that block user consent. Easy to write off as blocked, but if the mailbox is on a tenant the user themselves owns (their own company domain), they ARE the admin: the device-code consent screen shows a consent-on-behalf-of-your-organization checkbox, or they can grant consent in the Entra admin center. Slim scopes first (--preset mail --allowed-scopes) so you are not requesting admin-only Directory/Group scopes that force the wall regardless.