title: Self Hosted Azure DevOps Pipeline Agent fails with error Token Audience is not valid
body: <p>I have created a new token with Agent Pool <em>read and manage</em> permissions.
  I have created a new agent pool <em>lnx_agent</em> wherein I have administrator role to manage it.
  When I download tar file of agent linux x64 from this link <a href="https://vstsagentpackage-azureedge-net.o365.example-domain.defendernet.com/agent/2.171.1/vsts-agent-linux-x64-2.171.1.tar.gz" rel="nofollow noreferrer">https://vstsagentpackage-azureedge-net.o365.example-domain.defendernet.com/agent/2.171.1/vsts-agent-linux-x64-2.171.1.tar.gz</a>, copy it to bastion host, unpack it and execute <em>./config.sh</em> with URL, PAT token, agent pool as <em>lnx_agent</em> and default agent name as <em>bastion_agent</em>; I have below error message.</p>
  <pre><code>[2020-06-28 20:24:35Z ERR  VisualStudioServices] POST request to https://vssps-dev-azure-com.o365.example-domain.defendernet.com/Example-Client/_apis/oauth2/token failed. HTTP Status: BadRequest, AFD Ref: Ref A: C7A934103EDF47B2B3E6F148516B35B5 Ref B: DB3EDGE1015 Ref C: 2020-06-28T20:24:35Z
  [2020-06-28 20:24:35Z INFO VisualStudioServices] AAD Correlation ID for this token request: Unknown
  [2020-06-28 20:24:35Z INFO VisualStudioServices] Finished operation Location.GetConnectionData
  [2020-06-28 20:24:35Z INFO VisualStudioServices] Finished operation Location.GetConnectionData
  [2020-06-28 20:24:35Z INFO VisualStudioServices] Finished operation Location.GetConnectionData
  [2020-06-28 20:24:35Z ERR  Agent] Microsoft.VisualStudio.Services.OAuth.VssOAuthTokenRequestException: The token audience is not valid https://vssps-dev-azure-com.o365.example-domain.defendernet.com/Example-Client/_apis/oauth2/token. Comparing to https://vssps-dev-azure-com.o365.example-domain.defendernet.com/Example-Client/_apis/oauth2/token; https://app-vssps-visualstudio-com.o365.example-domain.defendernet.com/Example-Client/_apis/oauth2/token.
  </code></pre>
  <p>Example-Client is my project and example-domain is my company name.
  What does this mean <em>AAD Correlation ID for this token request: Unknown</em>?</p>
  <p>Since my AKS cluster is private, all three options to connect to it from Azure release pipeline like  kubeconfig, service account and subscription fail. So, if I could configure self hosted agent in bastion host whose virtual network is peered with virtual network of private AKS cluster then I can successfully automate CD pipeline by running agent in this bastion host.</p>
  <pre><code> az devops login --organization https://dev-azure-com.o365.example-domain.defendernet.com/Example-Client
  Token:
  Failed to store PAT using keyring; falling back to file storage.
  You can clear the stored credential by running az devops logout.
  Refer https://aka.ms/azure-devops-cli-auth to know more on sign in with PAT.
  </code></pre>