[BUG]
Preflight Checklist
- [x] I have searched existing issues and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code
What's Wrong?
The Microsoft 365 first-party connector cannot access mailbox/Graph data
when the tenant enforces MFA via a Conditional Access policy that applies to
Microsoft Graph (directly or via "All cloud apps"). The connector never
performs an interactive MFA step-up, so the user token issued to the MCP
server lacks the mfa claim in its amr array. The subsequent On-Behalf-Of
(OBO) exchange against Microsoft Graph (00000003-0000-0000-c000-000000000000)
is therefore rejected with AADSTS50076.
Crucially, there is no admin-side configuration that fixes this without
weakening security, because the two obvious levers do not apply (details
below). The only thing that "works" is excluding the user entirely from the
MFA policy, which is not acceptable
Environment
| Field | Detail |
|----------------------|------------------------------------------|
| Interface | claude.ai (web) / Claude Desktop app |
| Connector | Microsoft 365 (first-party / pre-built) |
| Claude Plan | Pro |
| OS / Browser | <FILL IN> |
| Tenant | Microsoft Entra ID (single tenant) |
| CA policy | Require MFA, scope: All cloud apps |
| Geo-block policy | None |
What Should Happen?
Claude should be able to connect to the Microsoft tenant without an MFA prompt, without having to disable it for the entire user.
Error Messages/Logs
Steps to Reproduce
- Tenant with a Conditional Access policy requiring MFA that applies to the
user (All cloud apps / Microsoft Graph).
- Connect the Microsoft 365 connector in Claude and grant consent.
- Ask Claude to read/search email.
Claude Model
None
Is this a regression?
No, this never worked
Last Working Version
_No response_
Claude Code Version
1.24012.11.0
Platform
Anthropic API
Operating System
Windows
Terminal/Shell
Other
Additional Information
_No response_