mssql: login error: Login failed for user '<token-identified principal>'

[JoshDouglasOU]

azure_login {
tenant_id = var.base_info.tenant_id
client_id = data.azurerm_key_vault_secret.sqladdusersclientid.value
client_secret = data.azurerm_key_vault_secret.sqladduserstoken.value
}

i'm grabbing the client id and secret from kv. this the id of the service principal that has AD read rights this service principal is in the group that is MS Entra Admin on the server

my error is
mssql: login error: Login failed for user ''