[BUG] Microsoft 365 MCP authentication fails — AADSTS9000411: duplicate 'prompt' parameter in OAuth request

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

## Description

Attempting to authenticate the Microsoft 365 remote MCP server
(mcp__microsoft365__authenticate)
fails immediately with an Azure AD error indicating the OAuth authorization
URL has the prompt
query parameter duplicated.

## Error

AADSTS9000411: The request is not properly formatted. The parameter 'prompt'
is duplicated.

Request Id: 3e814799-a557-4a40-862c-6dd5bd5e0900
Correlation Id: 87fccf75-1a72-4261-b55b-24183bcc13fb
Timestamp: 2026-04-22T16:19:45Z

## Environment

• Claude Code CLI (darwin / zsh)
• MCP server: microsoft365 (remote/hosted, claude.ai)
• Auth has never completed — no entry in ~/.claude/mcp-needs-auth-cache.json

## Steps to Reproduce

1. Open Claude Code in a session
2. Trigger Microsoft 365 MCP authentication (e.g., invoke

mcp__microsoft365__authenticate)

1. Follow the auth URL provided
2. Azure AD immediately returns AADSTS9000411

## Expected Behavior

OAuth flow completes successfully and Microsoft 365 tools become available.

## Root Cause (suspected)

The OAuth authorization URL constructed by the M365 MCP server includes the
prompt parameter
twice (e.g., from both the base request and extraQueryParameters). Azure AD
rejects any
request with duplicate parameters per OAuth spec.

The Microsoft correlation/request IDs above can be used to trace the exact
malformed request
on the Azure AD side.

What Should Happen?

Expected Behavior

OAuth flow completes successfully and Microsoft 365 tools become available.

## Root Cause (suspected)

The OAuth authorization URL constructed by the M365 MCP server includes the
prompt parameter
twice (e.g., from both the base request and extraQueryParameters). Azure AD
rejects any
request with duplicate parameters per OAuth spec.

The Microsoft correlation/request IDs above can be used to trace the exact
malformed request
on the Azure AD side.

Error Messages/Logs

Steps to Reproduce

Steps to Reproduce

1. Open Claude Code in a session
2. Trigger Microsoft 365 MCP authentication (e.g., invoke

mcp__microsoft365__authenticate)

1. Follow the auth URL provided
2. Azure AD immediately returns AADSTS9000411

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.104 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_