[BUG] M365 connector OBO token refresh triggers CA SignInFrequency MFA re-evaluation that cannot be satisfied non-interactively

### MCP server URL or name

Microsoft 365 (microsoft365.mcp.claude.com)

### How are you connecting to this server?

From browsing the MCP server directory

### Where does the issue occur?

During a conversation (after initial auth)

### When did you last reproduce this?

03/06/2026 10:15am

### Browser and OS

_No response_

### Describe the issue

The M365 first-party connector silently drops for users in enterprise
tenants with Conditional Access SignInFrequency policies enforced.

When Anthropic's backend refreshes the OBO (On-Behalf-Of) token against
Microsoft Graph, Entra re-evaluates CA policies and raises an MFA
challenge. Because OBO tokens are exclusively held and managed by
Anthropic's backend, there is no mechanism for the user to satisfy the
challenge — it is raised against infrastructure where no user is present.
The refresh fails silently and the user only discovers the connector has
dropped when they next attempt to use it.

This is distinct from #308 (user-facing re-auth frequency) — this issue
focuses on the architectural cause and why it cannot be resolved
tenant-side:

1. Microsoft Graph cannot be added as an excluded resource in Entra CA
policies — it is explicitly unsupported
2. Excluding the MCP Client/Server apps via Custom Security Attribute
filter does not help — CA evaluates against Microsoft Graph as the
target resource, not the MCP app as the client, so the exclusion is
never matched
3. Disabling MFA for all users to accommodate token refresh behaviour
is not acceptable in an enterprise security posture

### Error details

```shell
Message shown to user on connector card in Settings → Connectors:
"Multi-factor authentication has expired. You can reconnect to
verify your identity."

Entra ID Sign-in logs (non-interactive sign-ins, filtered to
M365 MCP Server for Claude):

Status: Interrupted
Result detail: MFA required in Azure AD
Application: M365 MCP Server for Claude (07c030f6-5743-41b7-ba00-0a6e85f37c17)
Resource: Microsoft Graph
Sign-in type: Non-interactive

Scale observed over a 7-day measurement window:
- 264 interruptions across 31 distinct users
- Failures in rolling waves — new users affected each day
- Peak: 108 interruptions in a single day
- All failures identical: MFA required in Azure AD on Microsoft Graph
```

### Expected behavior

1. The OBO token refresh should not trigger CA SignInFrequency
re-evaluation that requires interactive MFA — the user already
satisfied MFA during the initial interactive authentication to
the MCP Client app

2. If a re-evaluation is unavoidable, Anthropic's backend should
request CAE-capable tokens in the OBO exchange. Microsoft Graph
natively supports CAE, which suppresses SignInFrequency
re-evaluation for non-revocation events while maintaining real-time
revocation for genuine security events (account disabled, password
change, Identity Protection risk elevation). This requires no
tenant-side changes and is entirely a backend fix.

3. At minimum, if token refresh fails, the user should be proactively
notified immediately rather than discovering the connector has
silently dropped on their next use

### Additional context

Anthropic's own M365 connector security documentation confirms the
OBO architecture that makes this unresolvable tenant-side:

"The user authenticates to obtain an access token for the MCP server,
then the MCP server exchanges it for Graph API access using the OBO
flow with confidential client credentials. In this flow, not even the
user or their Claude client has access to the OBO tokens. Only the MCP
server can access and use tokens with access to the user's data via
the Microsoft Graph API."
— https://support.claude.com/en/articles/12684923

Current workaround is manual re-authentication — users must disconnect
the connector, close all browser windows, sign into portal.office.com
in a fresh incognito window to establish a fresh MFA-satisfied session,
then reconnect the connector in the same window. This must be repeated
every 1-2 days and is operationally unsustainable at enterprise scale.

CAE reference:
https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-continuous-access-evaluation