Custom connector to Fabric dataPlane MCP endpoints never redirects to login (no popup) — same app registration succeeds against non-dataPlane Fabric MCP path

### What happened?

A Custom Connector pointing to Microsoft Fabric's SQL Analytics Endpoint MCP server (`/v1/mcp/dataPlane/...`) fails to authenticate — no Microsoft/Entra login popup ever appears when clicking Connect, and the connector shows a generic error toast within a few seconds:

> Authorization with [connector name] failed. You can check your credentials and permissions.

**Environment:** claude.ai web (Enterprise plan), Organization-level custom connector, first-party Microsoft Fabric MCP server, Azure Entra ID (same tenant as the organization), single-tenant app registration with Client ID + Client Secret configured under Advanced settings, redirect URI `https://claude.ai/api/mcp/auth_callback` registered under Web platform type.

Critically, **the exact same app registration, tenant, and credential pattern succeeds** when pointed at a different Fabric MCP path (Fabric Data Agent), and fails identically across two different `dataPlane` endpoint shapes. This was verified with a controlled 3-way comparison:

| Endpoint | URL pattern | Result |
|---|---|---|
| Fabric Data Agent MCP | `https://api.fabric.microsoft.com/v1/mcp/workspaces/{ws}/dataagents/{id}` | ✅ Authenticates successfully, tools load |
| Item-scoped SQL Analytics Endpoint MCP | `https://api.fabric.microsoft.com/v1/mcp/dataPlane/workspaces/{ws}/items/{id}/sqlEndpoint` | ❌ Fails, no login popup |
| Global SQL Analytics Endpoint MCP | `https://api.fabric.microsoft.com/v1/mcp/dataPlane/sqlEndpoint` | ❌ Fails identically, no login popup |

Since no popup appears for either `dataPlane` variant, the failure occurs before any redirect to Microsoft's authorization endpoint — it never reaches the point of showing a login screen.

### What did you expect to happen?

Given the identical credentials succeed against the non-`dataPlane` Fabric MCP path, connecting to a `dataPlane`-prefixed Fabric MCP endpoint should also redirect to Microsoft's login screen and complete the OAuth flow using the same app registration.

### Steps to reproduce

1. Create an Entra app registration with:
- Redirect URI `https://claude.ai/api/mcp/auth_callback` under **Web** platform type (verified exact match, no trailing slash)
- Delegated API permissions: `Item.Read.All`, `Warehouse.Read.All`, `Warehouse.Execute.All` (Power BI Service), all with admin consent granted
- A fresh Client Secret (value copied immediately after creation)
2. In Claude, **Organization settings → Connectors**, add a custom connector pointing to `https://api.fabric.microsoft.com/v1/mcp/dataPlane/workspaces/{workspace-id}/items/{item-id}/sqlEndpoint`, with the Client ID and Client Secret entered under Advanced settings.
3. Click **Connect**.
4. No Microsoft/Entra login popup appears. Within seconds, an error toast appears: "Authorization with [connector name] failed. You can check your credentials and permissions."
5. Repeat steps 2–4 with the global endpoint variant (`https://api.fabric.microsoft.com/v1/mcp/dataPlane/sqlEndpoint`) — same result.
6. Repeat steps 2–4 with the Fabric Data Agent endpoint (`https://api.fabric.microsoft.com/v1/mcp/workspaces/{workspace-id}/dataagents/{agent-id}`), same app registration, same Client ID/Secret — this one succeeds, redirects to Microsoft login, and connects successfully.

### Area

OAuth / Authentication

### MCP Server (if applicable)

https://api.fabric.microsoft.com/v1/mcp/dataPlane/workspaces//items//sqlEndpoint

### Error messages or logs

```shell
Claude UI (repeated across multiple clean disconnect/reconnect cycles):
Authorization with Fabric - Claude Finops LH - SQL Endpoint MCP failed.
You can check your credentials and permissions.

ofid references collected across attempts (item-scoped and global dataPlane variants):
- ofid_abfc5717bce3c96b (paired with Entra Trace ID f80d0914-f0ab-46c3-9c55-8c4fe90d3800)
- ofid_20a7ddb3260cb52c
- ofid_e1527ac353c0b020
- ofid_7edf7212371e246b
- ofid_1b53b11e4aeddfec (global endpoint variant)

No corresponding sign-in attempt was found in Entra sign-in logs for most of these attempts, consistent with the request never reaching Entra's authorization endpoint.
```

### Additional context

1. **Redirect URI misconfiguration** — initially registered under the wrong platform type; corrected to Web platform with exact-match URI. Failure persisted afterward.
2. **API permissions / admin consent** — `Item.Read.All`, `Warehouse.Read.All`, `Warehouse.Execute.All` all confirmed granted for the organization.
3. **Stale/cached credentials** — connector fully removed (not edited) and re-added from scratch multiple times with a freshly generated Client Secret. Failure persisted identically.
4. **Item ID correctness** — confirmed the item ID resolves to the SQL analytics endpoint (fetching the endpoint URL directly returns a clean `401 Unauthorized`, not `404`, confirming the resource is valid and recognized by Fabric).
5. **Application ID URI registration** — attempted to register the `dataPlane` MCP URL as an Application ID URI under "Expose an API," per a support suggestion. This was rejected outright by Entra: *"Values of IdentifierUris property must use a verified domain of the organization or its subdomain: https://api.fabric.microsoft.com/v1/mcp/dataPlane/sqlEndpoint"* — expected, since this is a Microsoft-owned domain, not the organization's. This rules out that fix path entirely for any organization connecting to a first-party Microsoft `dataPlane` MCP resource.
6. **WAF/firewall interference** — not applicable; `api.fabric.microsoft.com` is Microsoft-hosted infrastructure, not something behind the organization's network perimeter.

## How this differs from other open Entra-related reports in this repo

- **#632** and **#754** both describe Claude's backend never calling `/token` after a *successful* interactive Entra login (popup appears, user signs in, then it fails). In this case, **no popup appears at all** — the failure is earlier in the flow.
- **#851** describes a *later*-stage failure: the initial code exchange succeeds and the connector briefly shows connected, before an automated follow-up request fails a few seconds later with AADSTS 9010010. Also later-stage than this report.
- **#786** (closed) is the closest match by symptom — Claude never redirects to the authorization endpoint at all, attributed to Entra's discovery response omitting `code_challenge_methods_supported`. Since that issue is marked closed but this report shows the identical no-popup symptom against a **first-party Microsoft resource** (`api.fabric.microsoft.com/v1/mcp/dataPlane/...`), this may indicate either an incomplete fix that doesn't cover first-party Microsoft `dataPlane` resource paths, or a distinct regression with the same visible symptom.
The common thread across this report and #632 specifically is that both involve **first-party Microsoft Entra-secured MCP servers** (Power BI/Fabric in both cases), suggesting Claude's connector backend may handle first-party Microsoft resources differently — and inconsistently — depending on the specific URL path shape (`dataagents` vs `dataPlane`).

## Related Issues
- #632 — Custom connector cannot authenticate to first-party Microsoft Entra MCP servers (Business Central, Power BI/Fabric, M365) — OAuth succeeds but Claude never exchanges the code at /token
- #754 — Custom connector for Entra ID-backed MCP server: OAuth sign-in succeeds, but Claude never exchanges the authorization code at /token
- #786 — Custom connector never redirects to authorization_endpoint when the AS (Microsoft Entra ID) omits code_challenge_methods_supported (closed)
- #851 — Custom connector OAuth fails a few seconds after successful login — Entra rejects automated follow-up request with mismatched resource/scope (AADSTS 9010010)
Happy to provide the Fabric workspace/item IDs, additional Entra sign-in log exports, or test access to a scoped-down lakehouse if that helps reproduce this on Anthropic's side.