[BUG] Microsoft 365 MCP connector OAuth fails with AADSTS50011 redirect_uri mismatch on macOS

Summary

The managed microsoft365 MCP connector (https://microsoft365.mcp.claude.com/mcp) fails OAuth authentication from Claude Code CLI on macOS. Microsoft Entra ID rejects the redirect with AADSTS50011 because the http://localhost:<port>/callback URI sent by Claude Code is not registered on Anthropic's Entra app 08ad6f98-a4f8-4635-bb8d-f1a3044760f0.

This is the same root cause as #25246 (closed as not planned) and overlaps with #29934, #42765, #29507.

Environment

• Claude Code: 2.1.133
• macOS: Darwin 25.3.0
• Shell: zsh
• Auth method: claude.ai account (connector synced from Desktop)

Reproduction

1. Microsoft 365 connector enabled in Claude Desktop (works there, presumably via custom URI scheme).
2. claude mcp list shows microsoft365: https://microsoft365.mcp.claude.com/mcp (HTTP) - ! Needs authentication (synced from claude.ai).
3. Run /mcp in Claude Code → select microsoft365 → browser opens to Microsoft sign-in.
4. After completing Microsoft sign-in, Entra returns AADSTS50011.

Error details

Two attempts, two different ephemeral ports — confirms Claude Code uses a random port each time:

Attempt 1

• Redirect URI sent: http://localhost:55340/callback
• Request Id: b0e16e9b-7994-4a37-b234-df1922706e00
• Correlation Id: f64e20ee-85df-4d9e-abb7-03d476d1bcbd
• Timestamp: 2026-05-08T14:03:42Z

Attempt 2

• Redirect URI sent: http://localhost:61521/callback
• Request Id: c328ad14-e682-4d26-bb15-2a27be200100
• Correlation Id: eb411fcf-4ffa-45a4-847a-32d7b3235768
• Timestamp: 2026-05-08T14:15:34Z

Workaround attempted: re-added the server with claude mcp add --transport http --callback-port 8080 --scope user microsoft365 https://microsoft365.mcp.claude.com/mcp to pin the port. Awaiting test, but this only works if Anthropic registered a specific localhost port on the Entra app — and we have no way to know which.

Root cause (suspected)

The Anthropic Entra app 08ad6f98-a4f8-4635-bb8d-f1a3044760f0 likely needs one of:

1. A "Mobile and desktop applications" platform registration with http://localhost (Entra allows any port on this platform type per the public client redirect URI rules), or
2. Switching the redirect URI Claude Code sends from localhost → 127.0.0.1 per RFC 8252 §7.3 (per #42765), since Entra's localhost exception applies to both, or
3. A documented fixed port that users can pass with --callback-port.

Asks

• Please register http://localhost (Mobile and desktop platform) on the Entra app, or
• Document the specific --callback-port value that the connector expects, or
• Reopen #25246 — this is not resolved for end users.

Related issues

• #25246 — original MS365 OAuth bug (closed as not planned)
• #29934 — MCP OAuth fails with HTTPS redirect URI requirements
• #42765 — localhost vs 127.0.0.1 RFC 8252 violation
• #29507 — missing docs for manual callback URL paste fallback (doesn't apply here since Entra rejects before redirect)