I'm having the same issue. Tested with the example provided in the instructions: https://github.com/Azure-Samples/azure-spring-boot-samples/tree/main/aad/spring-cloud-azure-starter-active-directory/web-client-access-resource-server/aad-resource-server

This endpoint, http://localhost:8082/webapiB/clientCredential, is only protected after adding the code specified in option 2.