Sorry, can't reproduce it again, I suppose it appears randomly.

Copying into a public comment for search engines, the redacted failure was:

Error Message:  failed to reconcile machine "REDACTED": azure.BearerAuthorizer#WithAuthorization: Failed to refresh the Token for request to https://management.azure.com/subscriptions/REDACTED/resourceGroups/REDACTED/providers/Microsoft.Network/virtualNetworks/REDACTED/subnets/REDACTED?api-version=2018-12-01: StatusCode=400 -- Original Error: adal: Refresh request failed. Status Code = '400'. Response body: {"error":"unauthorized_client","error_description":"AADSTS700016: Application with identifier 'REDACTED' was not found in the directory 'REDACTED'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant.\r\nTrace ID: REDACTED\r\nCorrelation ID: REDACTED\r\nTimestamp: 2020-02-20 04:33:48Z","error_codes":[700016],"timestamp":"2020-02-20 04:33:48Z","trace_id":"REDACTED","correlation_id":"REDACTED","error_uri":"https://login.microsoftonline.com/error?code=700016"}

Bug 1836141 has a similar error, although in that case it was a 401.