claude-code - 💡(How to fix) Fix MCP HTTP OAuth fails on Microsoft `agent365` MCP catalog (12 first-party M365 servers) — `/callback` redirect path not in `aebc6443-…` allowlist; DCR unsupported [2 comments, 3 participants]

Summary

Claude Code's MCP HTTP OAuth uses redirect URIs of the form http://localhost:<port>/callback. Microsoft's first-party MCP servers hosted at https://agent365.svc.cloud.microsoft/agents/tenants/{tenant}/servers/mcp_*Tools mandate the pre-registered Microsoft public client aebc6443-996d-45c2-90f0-388ff96faa56, whose Azure AD redirect-URI allowlist does not include the /callback path. Result: AADSTS50011 on every Microsoft 365 first-party MCP server (12 servers).

The endpoint also rejects Dynamic Client Registration, so there is no client-side escape hatch. The fix must come from Claude Code aligning its loopback redirect URI with the convention used by every other Microsoft-OAuth-friendly client.

This complements the existing reports for the Anthropic-hosted M365 variant (#47975, #52730, #45993). Filing separately because the affected tenant is Microsoft's managed app (aebc6443-…), not Anthropic's (08ad6f98-…), proving the bug is general to Claude Code's MCP HTTP OAuth implementation rather than tenant-specific.

Affected MCP servers (12)

All under the same agent365.svc.cloud.microsoft host (Foundry uses a sibling Microsoft-hosted endpoint with the same client app):

Error

AADSTS50011: The redirect URI 'http://localhost:55174/callback' specified
in the request does not match the redirect URIs configured for the
application 'aebc6443-996d-45c2-90f0-388ff96faa56'.

Side-by-side proof — same machine, same client app, different tools

Both store client_id = aebc6443-996d-45c2-90f0-388ff96faa56. The only differing variable is the redirect URI shape:

• Claude Code path: /callback
• Copilot CLI path: / (root)

Azure AD's loopback rule allows any port on localhost / 127.0.0.1, but the path must match a registered URI literally. The aebc6443-… app registration has root-path loopback URIs registered (http://localhost/, http://127.0.0.1/) but not …/callback. Same architectural root cause as #42765 (RFC 8252 §7.3 prefers 127.0.0.1 + root path).

Reproduction

1. Add a Microsoft-hosted MCP server to ~/.claude.json:

   "microsoft-teams": {
     "type": "http",
     "url": "https://agent365.svc.cloud.microsoft/agents/tenants/{your-tenant-id}/servers/mcp_TeamsTools",
     "oauth": { "clientId": "aebc6443-996d-45c2-90f0-388ff96faa56" }
   }

2. Restart Claude Code.
3. Run /mcp → select microsoft-teams → Authenticate.
4. Browser opens Microsoft login → sign-in + consent succeed → final redirect fails with AADSTS50011.

DCR test (Option: remove oauth.clientId to force Dynamic Client Registration)

Removed the oauth block from ~/.claude.json and restarted Claude Code. Result on next /mcp → Authenticate:

OAuth auth failed: Incompatible auth server: does not support dynamic client registration

The agent365 endpoint locks clients to the pre-registered aebc6443-… clientId. There is no client-side workaround.

Suggested fix

Change Claude Code's MCP HTTP OAuth loopback redirect URI from http://localhost:<port>/callback to either:

• http://127.0.0.1:<port>/ (preferred per RFC 8252 §7.3 — see #42765), or
• http://localhost:<port>/ (root path)

This matches the convention used by Azure CLI, gh CLI, VS Code, GitHub Copilot CLI, and MSAL public clients in general. A single change unblocks all 12 Microsoft 365 first-party MCP servers AND the Anthropic-hosted M365 variant (#47975, #52730).

Workaround for affected users today

Use GitHub Copilot CLI for Microsoft 365 MCP work — it has the same servers configured and authenticates successfully against the same aebc6443-… app because it uses the standard root-path loopback redirect URI.

Related issues

• #47975 — Microsoft 365 MCP connector: redirect URI mismatch (Anthropic-hosted, clientId 08ad6f98-…)
• #52730 — Hosted Microsoft 365 MCP server OAuth fails: duplicate prompt param + unregistered redirect URIs
• #42765 — OAuth redirect_uri uses localhost instead of 127.0.0.1, violating RFC 8252 §7.3 (architectural framing)
• #45993 — Closed as duplicate, same error code

Environment

• OS: macOS 14 (Darwin 25.4.0), Apple Silicon
• Claude Code: latest CLI
• Tenant: Microsoft Corp Entra
• Date: 2026-04-25

Happy to test a candidate fix on macOS against these endpoints.