title: Client assertion audience claim does not match Realm issuer
body: <p>I can successfully retrieve a token for my app via an HTTP POST request in PostMan from login.windows.net with the resource param set to &quot;a0e1e353-1a3e-42cf-a8ea-3a9746eec58c&quot;. This sets the &quot;aud&quot; field in the JWT token to the same value. The marketplaceapi endpoint I'm authenticating with rejects any tokens that have a different aud value.</p>
  <p>When I use ConfidentialClientApplicationBuilder in C# to retrieve a token with my cert, I'm using .WithClientAssertion() to set the aud to the same value following the example <a href="https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/wiki/Client-Assertions" rel="nofollow noreferrer">here</a>. But whenever I try setting the aud value and call .AcquireTokenForClient(), I get this error</p>
  <blockquote>
  <p>Microsoft.Identity.Client.MsalServiceException: 'A configuration issue
  is preventing authentication - check the error message from the server
  for details.You can modify the configuration in the application
  registration portal. See <a href="https://aka.ms/msal-net-invalid-client" rel="nofollow noreferrer">https://aka.ms/msal-net-invalid-client</a> for
  details.<br />
  Original exception: AADSTS700023: Client assertion audience
  claim does not match Realm issuer. Review the documentation at
  <a href="https://docs.microsoft.com/azure/active-directory/develop/active-directory-certificate-credentials" rel="nofollow noreferrer">https://docs.microsoft.com/azure/active-directory/develop/active-directory-certificate-credentials</a>
  . Trace ID: 4cb57c15-6a25-4baa-b88c-2e92caf71100 Correlation ID:
  17f9f513-3bec-4ecc-9b2f-7e01a9897e93 Timestamp: 2020-09-16 05:19:31Z'</p>
  </blockquote>
  <p>I tried setting the scope to that value, but then I get an invalid scope error. What do I need to do to get the correct aud value in my JWT token?</p>