macOS Enterprise SSO broker sends msauth.com.msauth.unsignedapp://auth → M365 connector fails with AADSTS900971

### What happened?

On macOS, the Microsoft 365 local connector cannot authenticate through the Microsoft Enterprise SSO (Company Portal) broker. MSAL's cross-platform runtime broker (client_sku = MSAL.xplat.macOS, "Claude Helper
(Plugin)") sends the redirect URI msauth.com.msauth.unsignedapp://auth instead of the documented msauth.com.anthropic.claudefordesktop.helper://auth. Because that URI isn't on the Entra app registration, sign-in
fails with AADSTS900971 "No reply address provided", surfaced locally as platform_broker_error / -51411 / ApiContractViolation.

Environment

- Claude Desktop 1.15962.1, macOS (Apple Silicon)
- Intune Company Portal 5.2604.2 broker; device Jamf-managed, Entra-registered & compliant
- macOS Enterprise SSO plug-in (com.microsoft.CompanyPortalMac.ssoextension, Redirect type); AppPrefixAllowList includes com.anthropic.
- Entra app: single-tenant, public client flows enabled, admin consent granted for delegated Graph scopes
- Claude.app + Claude Helper (Plugin).app correctly Developer-ID signed (Anthropic PBC, Team Q6L2SF6YDW)

Evidence — Company Portal SSOExtension.log

Start redirect_uri validation with isRunTimeLikeApp: 1 teamID != nil: 1
sourceApp: com.anthropic.claudefordesktop.helper
redirectURI: msauth.com.msauth.unsignedapp://auth
"This is a signed runtimelike case, and the redirectURI matches unsigned source app. Continue request as runtime scenario."
"client_sku" = "MSAL.xplat.macOS"; "client_app_name" = "Claude Helper (Plugin)";
"redirect_uri" = "msauth.com.msauth.unsignedapp://auth";
- Entra sign-in log: errorCode 900971 — No reply address provided (MSAL.objc / OSX)
- mcp-server-office365-builtin.log: platform_broker_error / causeErrorCode -51411 / ApiContractViolation

Root cause

Documented MSAL behavior: on macOS the xplat runtime broker uses the hardcoded fallback redirect msauth.com.msauth.unsignedapp://auth when the caller is treated as a runtime/unsigned source (MSAL-Python PR #673
(https://github.com/AzureAD/microsoft-authentication-library-for-python/pull/673), PR #907 (https://github.com/AzureAD/microsoft-authentication-library-for-python/pull/907); related open report #803
(https://github.com/AzureAD/microsoft-authentication-library-for-python/issues/803)). The connector's docs only instruct registering msauth.com.anthropic.claudefordesktop.helper://auth — which the broker never
sends in this path — so the documented setup cannot succeed via the macOS broker.

Workaround

Registering msauth.com.msauth.unsignedapp://auth on the Entra app registration. Sign-in then succeeds (local_auth_token_acquired via: broker).

Why this needs a fix

msauth.com.msauth.unsignedapp://auth is the shared fallback redirect for all MSAL-runtime apps, not pinned to a bundle ID — requiring customers to register it weakens the per-app redirect guarantee on the exact
identity they're hardening. Requests:
1. Have the macOS broker path use the signed msauth.com.anthropic.claudefordesktop.helper://auth redirect so the shared unsignedapp URI isn't required, or
2. If the xplat unsignedapp redirect is unavoidable, document it for macOS broker setups with the security note.

### What did you expect to happen?

With the M365 connector configured per the documented setup — including the macOS broker redirect URI msauth.com.anthropic.claudefordesktop.helper://auth registered on the Entra app — brokered sign-in via the
Microsoft Enterprise SSO plug-in should succeed and acquire a Graph token.

Instead, the broker sends msauth.com.msauth.unsignedapp://auth (a redirect the documented setup never tells you to register), so Entra returns AADSTS900971 "No reply address provided" and the connector fails
with platform_broker_error / -51411 / ApiContractViolation. The documented configuration cannot succeed on the macOS broker path.

### Steps to reproduce

Repro

1. Configure M365 local connector on a Jamf/Intune-managed macOS device with Company Portal + Enterprise SSO plug-in.
2. Register only the documented redirect URIs (incl. msauth.com.anthropic.claudefordesktop.helper://auth).
3. Trigger any Outlook/SharePoint tool → fails with AADSTS900971 / -51411.
4. Add msauth.com.msauth.unsignedapp://auth → succeeds.

### Area

OAuth / Authentication

### MCP Server (if applicable)

_No response_

### Error messages or logs

```shell
Company Portal SSOExtension.log:
Start redirect_uri validation with isRunTimeLikeApp: 1 teamID != nil: 1
sourceApp: com.anthropic.claudefordesktop.helper
redirectURI: msauth.com.msauth.unsignedapp://auth
"This is a signed runtimelike case, and the redirectURI matches unsigned source app. Continue request as runtime scenario."
client_sku = MSAL.xplat.macOS; client_app_name = Claude Helper (Plugin); client_app_version = 1.15962.1
redirect_uri = msauth.com.msauth.unsignedapp://auth

mcp-server-office365-builtin.log:
tool_outlook_email_search_failed — authErrorCode: platform_broker_error, causeErrorCode: -51411, causeStatus: ApiContractViolation, graphHost: graph.microsoft.com

Entra sign-in log:
errorCode 900971 — "No reply address provided" (App Auth Library: MSAL.objc 2.10.0, Platform: OSX)

After adding msauth.com.msauth.unsignedapp://auth to the app registration:
local_auth_token_acquired via: broker (success)
```

### Additional context

The MSAL macOS xplat-broker fallback to msauth.com.msauth.unsignedapp://auth is documented Microsoft behavior:
- https://github.com/AzureAD/microsoft-authentication-library-for-python/pull/673
- https://github.com/AzureAD/microsoft-authentication-library-for-python/pull/907
- Related open report: https://github.com/AzureAD/microsoft-authentication-library-for-python/issues/803

App and helper are properly Developer-ID signed (Anthropic PBC, Team Q6L2SF6YDW); the "unsigned" label is the MSAL runtime-broker convention, not a real signing defect. Security note:
msauth.com.msauth.unsignedapp://auth is the shared fallback for all MSAL-runtime apps, so requiring customers to register it dilutes the per-app redirect guarantee — hence the request to use the signed
.helper://auth redirect on the broker path.