We had the same issue recently. There isn't any documentation that states that on-behalf of is disabled the only thing to indicate this is the error message. The other issue is that the AAD token requires using it to request a temporary token for access. This doesn't work with apps like Power BI and an alternative solution isn't recommended.