access_denied: AADSTS65005: The application 'Microsoft Power Query for Excel' asked for scope 'user_

I have found that if you publish the report to the Power BI web app, and refresh the data in the web app you get a different result in Azure AD:

Each line in this log relates to a different activity:

Microsoft Power BI - logging into the Desktop application (not refreshing data, just logging in to the application)

Microsoft Power Query for Excel - this authentication attempt is triggered (and fails) every time you try to refresh data in the report by connecting to the O365 mailbox

Power BI Data Refresh - this authentication attempt occurs when you refresh the dataset in the Power BI web app. This shows as successful in Azure AD, and successful in the Power BI web app but the data isn't actually updated!

So this seems to be specific to the 'Microsoft Power Query for Excel' app. I'm surprised there aren't more people experiencing this issue.

I have pasted the error from Azure AD associated with the authentication failure, but here it is for completeness:

The application required resource access list does not contain applications discoverable by the resource or The client application has requested access to resource, which was not specified in its required resource access list or Graph service returned bad request or resource not found. If the application supports SAML, you may have configured the application with the wrong Identifier (Entity). Try out the resolution listed for SAML using the link below: https://docs.microsoft.com/azure/active-directory/application-sign-in-problem-federated-sso-gallery?/?WT.mc_id=DMC_AAD_Manage_Apps_Troubleshooting_Nav#no-resource-in-requiredresourceaccess-list.

Azure AD error code 65005.