Microsoft redirects the administrator here from the adminconsent endpoint, then from an OpenID authorize hop that returns an authorization code. Signed state binds the response to its pending Company connection. Activation redeems that code for the signed-in tenant and stores that token's tid only when a customer-tenant application token includes Calendars.ReadWrite. The unsigned tenant query is not used to choose the tenant.