[BUG] Microsoft 365 Auth

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Title: ms365 plugin OAuth fails with AADSTS50011 redirect URI mismatch

Summary: The plugin:small-business:ms365 MCP server cannot complete OAuth because the dynamic localhost callback port is not registered in the Azure app's allowed redirect URIs.

Steps to reproduce:

In Claude Code, trigger ms365 authentication (mcp__plugin_small-business_ms365__authenticate)
Open the returned login.microsoftonline.com URL in browser
Sign in with Microsoft 365 account
Expected: Browser redirects to http://localhost:<port>/callback?code=... and auth completes.

Actual: Microsoft returns AADSTS50011:

The redirect URI 'http://localhost:58150/callback' specified in the request does not match the redirect URIs configured for the application '08ad6f98-a4f8-4635-bb8d-f1a3044760f0'.

Repro details:

Client ID: 08ad6f98-a4f8-4635-bb8d-f1a3044760f0
Failed ports observed: 58150, 57532 (server picks a different port each attempt)
Request ID: b9f0abe0-4b24-460d-9997-effd2ee01300
Correlation ID: 44cb9e61-9d65-4051-863b-d3146fcb1c30
Timestamp: 2026-05-15T01:19:02Z
Platform: macOS (Darwin 24.6.0), Claude Code CLI
Suggested fix: Either register a deterministic redirect URI in the Azure app, or whitelist the full localhost port range the MCP server can pick from.

Impact: Blocks all ms365 plugin functionality (inbox scans, calendar, etc.) for any user whose random port happens to land outside the registered set.

What Should Happen?

Authorizing microsoft connection

Error Messages/Logs

Title: ms365 plugin OAuth fails with AADSTS50011 redirect URI mismatch

Summary: The plugin:small-business:ms365 MCP server cannot complete OAuth because the dynamic localhost callback port is not registered in the Azure app's allowed redirect URIs.

Steps to reproduce:

In Claude Code, trigger ms365 authentication (mcp__plugin_small-business_ms365__authenticate)
Open the returned login.microsoftonline.com URL in browser
Sign in with Microsoft 365 account
Expected: Browser redirects to http://localhost:<port>/callback?code=... and auth completes.

Actual: Microsoft returns AADSTS50011:

The redirect URI 'http://localhost:58150/callback' specified in the request does not match the redirect URIs configured for the application '08ad6f98-a4f8-4635-bb8d-f1a3044760f0'.

Repro details:

Client ID: 08ad6f98-a4f8-4635-bb8d-f1a3044760f0
Failed ports observed: 58150, 57532 (server picks a different port each attempt)
Request ID: b9f0abe0-4b24-460d-9997-effd2ee01300
Correlation ID: 44cb9e61-9d65-4051-863b-d3146fcb1c30
Timestamp: 2026-05-15T01:19:02Z
Platform: macOS (Darwin 24.6.0), Claude Code CLI
Suggested fix: Either register a deterministic redirect URI in the Azure app, or whitelist the full localhost port range the MCP server can pick from.

Impact: Blocks all ms365 plugin functionality (inbox scans, calendar, etc.) for any user whose random port happens to land outside the registered set.

Steps to Reproduce

Title: ms365 plugin OAuth fails with AADSTS50011 redirect URI mismatch

Summary: The plugin:small-business:ms365 MCP server cannot complete OAuth because the dynamic localhost callback port is not registered in the Azure app's allowed redirect URIs.

Steps to reproduce:

In Claude Code, trigger ms365 authentication (mcp__plugin_small-business_ms365__authenticate)
Open the returned login.microsoftonline.com URL in browser
Sign in with Microsoft 365 account
Expected: Browser redirects to http://localhost:<port>/callback?code=... and auth completes.

Actual: Microsoft returns AADSTS50011:

The redirect URI 'http://localhost:58150/callback' specified in the request does not match the redirect URIs configured for the application '08ad6f98-a4f8-4635-bb8d-f1a3044760f0'.

Repro details:

Client ID: 08ad6f98-a4f8-4635-bb8d-f1a3044760f0
Failed ports observed: 58150, 57532 (server picks a different port each attempt)
Request ID: b9f0abe0-4b24-460d-9997-effd2ee01300
Correlation ID: 44cb9e61-9d65-4051-863b-d3146fcb1c30
Timestamp: 2026-05-15T01:19:02Z
Platform: macOS (Darwin 24.6.0), Claude Code CLI
Suggested fix: Either register a deterministic redirect URI in the Azure app, or whitelist the full localhost port range the MCP server can pick from.

Impact: Blocks all ms365 plugin functionality (inbox scans, calendar, etc.) for any user whose random port happens to land outside the registered set.

Claude Model

Opus

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

opus 4.7

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_