Microsoft MCP Server for Enterprise ("M365 MCP Client for Claude") — Authorization fails despite clean Entra sign-in logs on both browser and backend legs

### MCP server URL or name

https://mcp.svc.cloud.microsoft/enterprise

### How are you connecting to this server?

From browsing the MCP server directory

### Where does the issue occur?

When auth finishes and redirects back to Claude.ai

### When did you last reproduce this?

2026-07-15 4:50 PM CST

### Browser and OS

Edge 150.0.4078.65 (Official build) (64-bit), Windows 11 25H2 26200.8875

### Describe the issue

Connecting a custom connector to Microsoft's official "Microsoft MCP Server for Enterprise" (https://mcp.svc.cloud.microsoft/enterprise) using Microsoft's predefined M365 MCP Client for Claude app (08ad6f98-a4f8-4635-bb8d-f1a3044760f0), provisioned via Grant-EntraBetaMCPServerPermission -ApplicationName Claude per Microsoft's own documented setup. After completing Microsoft sign-in (MFA satisfied, consent granted, all 40 MCP.* scopes present), Claude returns:
Authorization with M365 MCP Client for Claude failed. You can check your credentials and permissions. If this persists, share this reference with support: "ofid_c01bd10a1abfc1f7"
Entra sign-in logs (both legs) show clean Success:

Interactive/browser leg: Status Success, Client app: Mobile Apps and Desktop clients, Client credential type: None, Token Binding Satisfied: True
Backend token-exchange leg (User agent: python-httpx/0.28.1 — Anthropic's backend): Status Success, all 40 MCP.* scopes present in Oauth Scope Info, correct app/resource pairing, Token Binding Attempted: True

Reproduction is consistent across: a custom-registered Entra app (confidential client, then reconfigured as public client per Microsoft's documented redirect-URI-platform guidance) → same failure; then Microsoft's own predefined M365 MCP Client for Claude app → same failure. Ruled out: wrong client type, missing scopes, missing service principal provisioning, propagation lag (waited and retried), stale connector state (deleted/recreated connector multiple times), browser/Desktop app both tested.

### Error details

```shell
Repeated errors like:
Authorization with M365 MCP Client for Claude failed. You can check your credentials and permissions. If this persists, share this reference with support: “ofid_ca997b00867aa185”. Other ofids include ofid_38bca4b4aedecbde, ofid_56f8e45780339ea8, ofid_c8b171b4674195ae, ofid_76ac9497b3312b1f, ofid_c01bd10a1abfc1f7

But I did once receive:
Your account was authorized, but no MCP server was found at the provided URL, or your account doesn’t have access to it. Check the server URL or your access, then try again. If this persists, share this reference with support: “ofid_81edbfa6f900db67”
```

### Expected behavior

To complete authorization

### Additional context

_No response_