Issue Station
Sign In
Tools hereToolbox

claude-code - 💡(How to fix) Fix microsoft-365 MCP server generates invalid OAuth URL (duplicate prompt param + invalid PKCE code_challenge)

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

The microsoft-365 MCP server generates a malformed OAuth authorization URL, causing Microsoft login to reject it with two errors:

  1. Duplicate prompt parameter — the URL contains both prompt=select_account (early in the query string) and &prompt=consent appended at the end. Microsoft rejects this as improperly formatted.

  2. Invalid PKCE code_challenge size — after removing the duplicate prompt param and retrying, Microsoft returns: AADSTS501491: Invalid size of Code_Challenge parameter.

Error Message

Microsoft returns an error. Example of the malformed URL structure generated:

Root Cause

The microsoft-365 MCP server generates a malformed OAuth authorization URL, causing Microsoft login to reject it with two errors:

  1. Duplicate prompt parameter — the URL contains both prompt=select_account (early in the query string) and &prompt=consent appended at the end. Microsoft rejects this as improperly formatted.

  2. Invalid PKCE code_challenge size — after removing the duplicate prompt param and retrying, Microsoft returns: AADSTS501491: Invalid size of Code_Challenge parameter.

RAW_BUFFERClick to expand / collapse

Description

The microsoft-365 MCP server generates a malformed OAuth authorization URL, causing Microsoft login to reject it with two errors:

  1. Duplicate prompt parameter — the URL contains both prompt=select_account (early in the query string) and &prompt=consent appended at the end. Microsoft rejects this as improperly formatted.

  2. Invalid PKCE code_challenge size — after removing the duplicate prompt param and retrying, Microsoft returns: AADSTS501491: Invalid size of Code_Challenge parameter.

Steps to Reproduce

  1. Install the microsoft-365 MCP server in Claude Code
  2. Call mcp__microsoft-365__authenticate
  3. Open the returned URL in a browser

Expected Behavior

Browser opens Microsoft login and completes OAuth flow successfully.

Actual Behavior

Microsoft returns an error. Example of the malformed URL structure generated:

Note prompt appears twice.

Environment

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#environment variable#network issue#logging issue#authentication issue#prompt issue

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

claude-code - 💡(How to fix) Fix microsoft-365 MCP server generates invalid OAuth URL (duplicate prompt param + invalid PKCE code_challenge)