Issue Station
Sign In
Tools hereToolbox

claude-code - 💡(How to fix) Fix Hosted Microsoft 365 MCP server OAuth fails: duplicate prompt param + unregistered redirect URIs [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
anthropics/claude-code#52730•Fetched 2026-04-24 10:41:11
View on GitHub
Comments
0
Participants
1
Timeline
4
Reactions
0
Author
aridspider12-devaridspider12-dev
Participants
aridspider12-devaridspider12-dev
Timeline (top)
labeled ×4

The hosted Microsoft 365 MCP server at https://microsoft365.mcp.claude.com/mcp has two bugs that prevent completing OAuth on Entra tenants.

Root Cause

The hosted Microsoft 365 MCP server at https://microsoft365.mcp.claude.com/mcp has two bugs that prevent completing OAuth on Entra tenants.

Code Example

"authorization_endpoint": "https://login.microsoftonline.com/common/oauth2/v2.0/authorize?prompt=select_account"

---

AADSTS9000411: The request is not properly formatted. The parameter 'prompt' is duplicated.

---

AADSTS50011: The redirect URI 'http://localhost:55995/callback' specified in the request does not match the redirect URIs configured for the application '08ad6f98-a4f8-4635-bb8d-f1a3044760f0'.
RAW_BUFFERClick to expand / collapse

Summary

The hosted Microsoft 365 MCP server at https://microsoft365.mcp.claude.com/mcp has two bugs that prevent completing OAuth on Entra tenants.

Bug 1 — Duplicate prompt parameter in authorization URL

The OAuth discovery doc at /.well-known/oauth-authorization-server bakes a query param into the authorization endpoint:

"authorization_endpoint": "https://login.microsoftonline.com/common/oauth2/v2.0/authorize?prompt=select_account"

The server's authenticate tool then appends &prompt=consent, resulting in a URL with two prompt parameters. Entra rejects:

AADSTS9000411: The request is not properly formatted. The parameter 'prompt' is duplicated.

Claude Code's built-in /mcp OAuth flow hits the same duplication.

Bug 2 — Dynamic redirect URI not whitelisted on Anthropic's Entra app

After manually deduping prompt, sign-in + consent succeed. Final redirect fails:

AADSTS50011: The redirect URI 'http://localhost:55995/callback' specified in the request does not match the redirect URIs configured for the application '08ad6f98-a4f8-4635-bb8d-f1a3044760f0'.

The authenticate tool issues URLs using the shared client_id 08ad6f98-a4f8-4635-bb8d-f1a3044760f0 with dynamic localhost callback ports (observed: 51623, 55995, 60048 — different every call). These aren't whitelisted on Anthropic's Entra app, and consuming tenants have no way to add URIs to an upstream app. The server exposes /oauth2/register (Dynamic Client Registration) but authenticate doesn't use it.

Repro

  1. claude mcp add --transport http --scope user microsoft365 https://microsoft365.mcp.claude.com/mcp
  2. /mcp → select microsoft365 → Bug 1 fires on the authorize GET
  3. Manually dedupe prompt in the URL → sign-in + consent succeed → Bug 2 fires on redirect

Side effect — tenant pollution

Tenant-wide admin consent is recorded at step 3 before the redirect fails. The connector's Enterprise App ends up persisted with broad delegated scopes (Mail, Calendar, Teams, Files, Sites, online-meeting recordings/transcripts, etc.) in the consuming tenant even though auth never completes. Admins should audit and revoke.

Environment

  • Claude Code 2.1.119 on Linux
  • Entra multi-tenant (v2.0)

extent analysis

TL;DR

Remove the duplicate prompt parameter from the authorization URL and whitelist the dynamic redirect URI in the Entra app or use Dynamic Client Registration.

Guidance

  • Verify the OAuth discovery document at /.well-known/oauth-authorization-server to ensure the authorization_endpoint does not include a query parameter that will be duplicated.
  • Update the authenticate tool to avoid appending the prompt parameter if it already exists in the authorization endpoint URL.
  • Consider using the Dynamic Client Registration endpoint (/oauth2/register) to register the client with a dynamic redirect URI, rather than relying on a shared client ID with static redirect URIs.
  • Audit and revoke any unnecessary admin consent grants in the consuming tenant to prevent tenant pollution.

Example

No code snippet is provided as the issue is more related to configuration and workflow rather than a specific code error.

Notes

The provided solution assumes that the Entra app and the Claude Code mcp server are properly configured and that the issue is solely related to the duplicate prompt parameter and the dynamic redirect URI.

Recommendation

Apply a workaround by manually deduping the prompt parameter and using Dynamic Client Registration to whitelist the dynamic redirect URI, as upgrading to a fixed version is not mentioned in the issue.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#API routing#API middleware#SSR setup#ISR setup#authentication setup

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

claude-code - 💡(How to fix) Fix Hosted Microsoft 365 MCP server OAuth fails: duplicate prompt param + unregistered redirect URIs [1 participants]