[BUG] M365 first-party connector requires MFA re-authentication every 1-2 days on claude.ai + Cowork (Claude Desktop)

### MCP server URL or name

Microsoft 365 (microsoft365.mcp.claude.com)

### How are you connecting to this server?

From browsing the MCP server directory

### Where does the issue occur?

During a conversation (after initial auth)

### When did you last reproduce this?

2026-05-04 10:45 AM SGT

### Browser and OS

Chrome 148.0.7778.168 on Windows 11 / Claude Desktop 1.7196.0 (2dbd78)

### Describe the issue

The Microsoft 365 first-party connector (microsoft365.mcp.claude.com) loses authentication every 1-2 days on claude.ai web and Claude Desktop (Cowork), requiring a full manual MFA re-authentication to restore. This is distinct from custom connector token refresh bugs (e.g. #228, #46328) — the M365 connector uses Anthropic's first-party hosted path, not mcp-proxy.anthropic.com.

The prompt shown to the user is: "Multi-factor authentication has expired. You can reconnect to verify your identity."

This happens regardless of activity level — the connector drops even when M365 tools have been used within the preceding 24 hours.

### Error details

```shell
"Multi-factor authentication has expired. You can reconnect to verify your identity."

No error ID or pop-up code was shown. The message appears directly on the M365 connector card in claude.ai Settings → Connectors.
```

### Expected behavior

1. The M365 first-party connector should silently refresh the OAuth token before it expires, without requiring user intervention
2. If a full re-authentication is truly required (e.g. refresh token revoked), the prompt should clearly state why — not show a generic MFA expiry message when the tenant policy is 90 days
3. Token refresh should be consistent between first-party connectors (M365, Gmail etc.) and not dependent on user-initiated activity within a narrow window

### Additional context

- Microsoft Entra ID tenant Conditional Access Sign-in Frequency policy is set to 90 days — Microsoft-side token expiry is ruled out as root cause
- Entra ID Sign-in logs show no failed token refresh attempts from Anthropic's backend between last successful use and the drop
- Issue occurs on both claude.ai web (Chrome) AND Claude Desktop Cowork simultaneously
- Related issues: anthropics/claude-code#47485 (M365 listed in bulk auth loss evidence), anthropics/claude-ai-mcp#228 (token refresh never attempted — different path but related root cause)
- Workaround currently in use: manual reconnect every 1-2 days