Document the possible failure in Device Flow

msal/application.py

@@ -330,6 +330,9 @@ def initiate_device_flow(self, scopes=None, **kwargs):
         :param list[str] scopes:
             Scopes requested to access a protected API (a resource).
         :return: A dict representing a newly created Device Flow object.
+
+            - A successful response would contain "user_code" key, among others
+            - an error response would contain some other readable key/value pairs.
         """
         return self.client.initiate_device_flow(
             scope=decorate_scope(scopes or [], self.client_id),

tests/test_application.py

@@ -109,6 +109,7 @@ def test_device_flow(self):
         self.app = PublicClientApplication(
             CONFIG["client_id"], authority=CONFIG["authority"])
         flow = self.app.initiate_device_flow(scopes=CONFIG.get("scope"))
+        assert "user_code" in flow, str(flow)  # Provision or policy might block DF
         logging.warn(flow["message"])
 
         duration = 30