Device is not in required device state: compliant

[Rostes]

Device is not in required device state: compliant

[NestoriSyynimaa]

First, the function can return only on access token, which in this case is for graph.windows.net. But you can use -SaveToCache switch to get tokens also for Outlook and Teams to be saved to the cache.

Second, seems that your organisation has conditional access policies in place blocking devices that are non-compliant. And the "device" here is referring to the deviceid claim of the access token. If it does not exists, the device is always non-compliant. And you can't get the deviceid claim using device code authentication method.

You can use Read-AADIntAccessToken to see the claims.