App with granted permissions fails to write new named locations but update/delete fine

Hi,

I have a subscription for a service that creates an enterprise app for which my GA granted the permissions:

Policy.ReadWrite.ConditionalAccess

CrossTenantInformation.ReadBasic.All

Policy.Read.All

It was working fine until recently, when I had a list of feeds, and I could turn them on or off.

Yesterday I tried to enable a new feed to add a new named location, and I'm getting

[2025-11-21 18:13:44] [writeNamedLocation()] :: FAILED::OtherError::403 Forbidden [2025-11-21 18:13:44] [writeNamedLocation()] :: FAILED::OtherError::{"error":{"code":"AccessDenied","message":"Operation requires conditional access and client does not support it. Client must be configured to support conditional access claims challenges to proceed.","innerError":{"date":"2025-11-21T18:13:44","request-id":"9xxxxxxx-4xxx-4xxx-8xxx-2xxxxxxxxxxx","client-request-id":"9xxxxxxx-4xxx-4xxx-8xxx-2xxxxxxxxxxx"}}}

Provided the error message is correct, I can't figure out where the configuration is that asks the app for MFA.

The odd part is that if the named location already exists, it gets updated.

The changes I've recently made to my tenant were enabling PIM for a contractor and protected actions

Any insight is appreciated.

Thank you.