Custom connector for Entra ID-backed MCP server: OAuth sign-in succeeds, but Claude never exchanges the authorization code at /token

### MCP server URL

https://api.hotfix.quantumworkplace.com/via-internal-mcp

### Where does the issue occur?

When pressing the Connect button

### Transport used

streamable-http

### Client registration type

Static

### SSE only: Does your server return the expected status code for POST requests?

Not applicable (my server does not use SSE)

### When did you last reproduce this?

2026-08-02 7:15 PM CDT

### Browser and OS

Chrome Version 150.0.7871.186 Windows 11

### Describe the issue

Custom connector for a self-hosted MCP server behind Microsoft Entra ID: OAuth
sign-in completes successfully (confirmed in Entra ID's own sign-in logs), but
Claude never exchanges the authorization code at Entra's /token endpoint, so
no authenticated MCP request is ever made.

Related to #741 and #506/#632, but with two differences worth noting:
- Authorization server here is Microsoft Entra ID (Azure AD), not Cloudflare
Access OIDC (#741) or whatever #506/#632 used
- Unlike #741 (which reports failure on both Claude.ai web AND Claude Code),
the identical server/credentials worked immediately via Claude Code's
loopback-redirect OAuth flow — only claude.ai's hosted web/Chat/Cowork
connector path fails. This may point to two related-but-distinct bugs
rather than one, or a difference specific to certain authorization servers.

### Issue details

```shell
Environment:
- Server: ASP.NET Core / ModelContextProtocol.AspNetCore 2.0.0, Streamable HTTP transport
- Authorization server: Microsoft Entra ID (Azure AD), single-tenant
- OAuth client: manually registered static Client ID, public client with PKCE, no secret (Entra ID doesn't support DCR)
- Redirect URI registered: https://claude.ai/api/mcp/auth_callback

Reproduction:
1. Add custom connector with pre-configured OAuth Client ID pointing at an Entra ID app registration
2. Click Connect — redirected to Entra ID, sign in, complete MFA
3. Redirected back to claude.ai/api/oauth/organizations/.../oauth_tokens?...
4. Result: "Authorization with the MCP server failed. You can check your credentials and permissions." (ofid_7964ced9f036b482)

Evidence this is Claude-side, not a server/Entra misconfiguration:
- Entra ID's own sign-in log for the matching correlation ID shows Status: Success for the interactive sign-in
- Chrome DevTools network capture during the entire flow shows zero requests to login.microsoftonline.com/{tenant}/oauth2/v2.0/token — Claude's backend never attempts the code exchange at all
- The identical MCP server, Entra app registration, and OAuth Client ID work correctly when configured against Claude Code's remote-MCP OAuth support instead (claude mcp add --client-id ... --callback-port ...), which uses a loopback redirect rather than claude.ai's hosted callback
```

### Expected behavior

After completing sign-in with Microsoft Entra ID (including MFA), the connector should successfully authenticate and Claude should be able to call the MCP server's tools — the same outcome the identical server/credentials already produce successfully through Claude Code's remote-MCP OAuth flow.

### Logs from your server

```shell
Server-side, the only log line that appears for every attempt is the initial unauthenticated challenge — no subsequent authenticated request is ever received, consistent with Claude never completing the token exchange:

info: ModelContextProtocol.AspNetCore.Authentication.McpAuthenticationHandler[12]
AuthenticationScheme: McpAuth was challenged.

(repeated identically for each attempt, timestamps matching each failed connection try — no second log entry with a Bearer token ever follows)
```

### Additional context

OAuth provider: Microsoft Entra ID (Azure AD), single-tenant.

See #741 for a related report with a different OAuth provider (Cloudflare Access) — noted the key difference (Claude Code worked for me, unlike that report) in a comment there.

No repository file, test, or implementation entry point is named. Start by reviewing the hosted connector OAuth callback and token-exchange flow, then compare it with the working Claude Code loopback flow and the related issues. Done means Claude requests Entra ID's /token endpoint, stores the tokens, and makes an authenticated MCP request.

Vom Indexierungsmodell aus dem Issue-Text verfasst.