Repository navigation
[BUG] M365 MCP OAuth fails with AADSTS9000411 - parameter 'prompt' is duplicated #31089
Description
Preflight Checklist
- I have searched existing issues and this hasn't been reported yet
- This is a single bug report (please file separate reports for different bugs)
- I am using the latest version of Claude Code
What's Wrong?
When authenticating the Microsoft 365 MCP connector via /mcp in Claude Code,
the OAuth redirect to Microsoft Entra ID fails with:
AADSTS9000411: The request is not properly formatted.
The parameter 'prompt' is duplicated.
This suggests the OAuth authorization URL being constructed by Claude Code
sends the prompt parameter twice.
What Should Happen?
The authentication via browser should trigger an account selection dialog for authentication.
Error Messages/Logs
- Request Id: 5fbd47a4-6cc2-4ce2-8255-1632a4264700
- Correlation Id: 67e883f1-c921-4728-aeec-c70b6df03547
- Timestamp: 2026-03-05T13:44:50ZSteps to Reproduce
- Have Microsoft 365 MCP server configured in settings.json
- Run
claudeand enter/mcp - Select Microsoft 365 and authenticate
- Browser opens to Microsoft sign-in and immediately shows the error
Claude Model
None
Is this a regression?
No, this never worked
Last Working Version
No response
Claude Code Version
2.1.58 (native)
Platform
Other
Operating System
Windows
Terminal/Shell
VS Code integrated terminal
Additional Information
Reacted by Stefano Traverso, Luke Broekhuizen, Dinesh Katam, Sebastian Bingel, Serge Sopotov and Jared Egbert
Activity
github-actions commentedon Mar 5, 2026
Found 3 possible duplicate issues:
This issue will be automatically closed as a duplicate in 3 days.
🤖 Generated with Claude Code
RealfinityKipper commentedon Mar 8, 2026
having this same issue, additionally once I remove the duplicate prompt parameter manually and retry it gives a callback error
AADSTS50011: The redirect URI 'http://localhost:52024/callback' specified in the request does not match the redirect URIs configured for the application '08ad6f98-a4f8-4635-bb8d-f1a3044760f0'. Make sure the redirect URI sent in the request matches one added to your application in the Azure portal. Navigate to https://aka.ms/redirectUriMismatchError to learn more about how to fix this.
dimisant commentedon Mar 16, 2026
Still hitting this issue on v2.1.76
mikaelfun commentedon Mar 17, 2026
still having issue
mh-dh commentedon Mar 20, 2026
Same Issue here per Microsoft 365 Connector in Claude.ai
mcplunk-code commentedon Mar 27, 2026
Hitting this same issue on Mac, Claude Code v2.1.84, Autodesk Microsoft tenant.
apstanto commentedon Mar 28, 2026
Same issue on 2.1.86. Any workaround available?
dnzhng17 commentedon Mar 30, 2026
Continues to be an issue on 2.1.87.
Nolander75 commentedon Apr 6, 2026
The Microsoft 365 MCP server (
mcp__m365__*tools) fails to authenticate via OAuth. The Azure AD login page returns:Steps to Reproduce
/mcpand attempt to authenticate the Microsoft365 MCPExpected Behavior
OAuth flow completes successfully and M365 tools become available.
Actual Behavior
Azure AD rejects the auth request because the
promptparameter is sent twice in the OAuth URL, which is a malformed request per OAuth 2.0 spec.Environment
claude --version)Root Cause (suspected)
The MCP server's OAuth flow is appending
prompt=...twice to the authorization URL. Azure AD enforces strict parameter deduplication and rejects therequest.
Workaround
Using Azure CLI + Microsoft Graph API directly works fine:
az account get-access-token --resource "https://graph.microsoft.com"rpeaston commentedon Apr 9, 2026
I have this same issue on version 2.1.97.
apstanto commentedon Apr 9, 2026
Confirmed — bypassing the MCP proxy and calling Microsoft Graph API directly works. Registered my own Azure AD app with device code flow and have had full email and Teams access restored for 2 days.
shayandes-stack commentedon Apr 16, 2026
Im trying to connect Microsoft 365 to Claude AI and getting the same error. Any workarounds?
ssopotov-cai commentedon Apr 23, 2026
Reproduced on Windows 11 with Claude Code 2.1.58 (native), VS Code integrated terminal. Same AADSTS9000411 with the exact URL shape (
prompt=select_account...prompt=consent).(Originally filed separately as #52444 before finding this issue.)
dimisant commentedon Apr 27, 2026
Still not working for me even though th bug is closed.
mh-dh commentedon Apr 27, 2026
Are you sure that your Entra Tenant has no Conditional Access Policies blocking this ?
dimisant commentedon Apr 27, 2026
Thanks for the reply. I'm not sure, I'm just a non-technical guy playing with claude code. I just assumed that if something else was blocking it then I would get a different error from last time. That would make sense, right? I will nevertheless try to troubleshoot it with CC
mh-dh commentedon Apr 27, 2026
Its Common for enterprises with Microsoft / Entra Tenant to have Conditional Access policies whci enforce MFA or block access from certain countries or only allow company Owned Devices etc. and the Anthropic Servers may be blocked by those Policies. This would cause this issue. Thing is: we get the Error from this thread here and not the "correct" error that a policy blocked it.
github-actions commentedon May 7, 2026
This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.