In ATP 3.1 and prior, when a user logged in to the ATP web interface with their AD credentials, they are unable to generate an OAuth token.
There was an error in the code for the ATP web interface.
The workaround for ATP versions 3.1 and prior is to log in with a local Admin account to generate OAuth tokens.
This issue has been resolved with ATP 3.2 and later.