[Bug]: Two interactive sign-ins after password reset (AADSTS50173 / account not available through VS Code sign-in)

Description

After an Entra ID password reset, the MSSQL extension consistently requires two complete browser-based authentication flows before a connection succeeds.

The first authentication succeeds and creates a new session, but MSSQL continues attempting to use a revoked grant and reports that the account is unavailable.

The second authentication succeeds and the connection works.

This occurs every day after password reset and is fully reproducible.

More details on the issue:

---

Connection Profile

The saved connection profile contains:

{
    "authenticationType": "AzureMFA",
    "connectTimeout": 30,
    "applicationName": "vscode-mssql",
    "applicationIntent": "ReadWrite",
    "server": "<SERVER>",
    "azureTenantId": "<TENANT_ID>",
    "database": "<DATABASE>",
    "commandTimeout": 30,
    "encrypt": "Optional",
    "groupId": "ROOT",
    "profileName": "<PROFILE_NAME>",
    "trustServerCertificate": true,
    "accountId": "<ACCOUNT_ID>",
    "azureAccountToken": "",
    "profileSource": 0
}

Recreating the connection profile does not resolve the issue.

---

VS Code Console Output

Immediately after the first authentication:

The selected profile authenticates using Entra ID
'<ACCOUNT_ID>',
but that account is not available through VS Code sign-in.

Edit the connection or sign into VS Code with that account to connect.

Example anonymized account identifier:

AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE.TTTTTTTT-UUUU-VVVV-WWWW-XXXXXXXXXXXX

---

Microsoft Authentication Logs

No active VS Code sessions

Before authentication:

[getSessions] [all] starting
[getSessions] [all] returned 0 session(s)

Repeated multiple times.

---

Account is still discoverable

Even though there are no active VS Code sessions:

Log MSAL Account:
preferred_username":"admin-user@example.com"

Example extract:

Log MSAL Account:
preferred_username":"admin-user@example.com"
home_account_id":"AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE.TTTTTTTT-UUUU-VVVV-WWWW-XXXXXXXXXXXX"

---

First authentication succeeds

[createSession]
[https://management.core.windows.net/.default]
starting

Trying default msal flow...

[createSession]
[https://management.core.windows.net/.default]
returned session

This suggests the browser-based authentication flow completed successfully.

---

Immediately after successful session creation

[getSessions]
[499b84ac-1321-427f-aa17-267ca6975798/.default offline_access]
starting

DiscardAccessAndIdTokensIfUnusable:855
No access token found in the cache

GetPlatformPropertiesFromStorage:2082
No account found in cache.

---

Revoked refresh token is still used

InteractionRequiredAuthError

invalid_grant
AADSTS50173

Example:

Created an error:

V2Error: invalid_grant

AADSTS50173:
The provided grant has expired due to it being revoked,
a fresh auth token is needed.

The user might have changed or reset their password.

The grant was issued on:
<OLD_TIMESTAMP>

TokensValidFrom:
<NEW_TIMESTAMP>

Followed by:

failed to acquire token silently, skipping account

errorCode: interaction_required

---

Contradictory state

The logs appear to show:

createSession returned session

followed immediately by:

No account found in cache

and:

failed to acquire token silently

and:

AADSTS50173

This appears contradictory because a session has just been created successfully.

---

Additional Observations

Recreating the connection profile does not help

The issue still occurs after deleting and recreating the MSSQL connection profile.

Steps to Reproduce

1. Configure MSSQL connection using Entra MFA authentication
2. Successfully connect
3. Reset password for Entra account
4. Launch VS Code
5. Open MSSQL connection
6. Complete browser authentication

Result:

• First login fails
• Second login succeeds

Affected Area

• Connection dialog (SQL Server | Azure browse/Fabric browse)
• Query editor
• Query results panel
• Object Explorer
• GitHub Copilot integration
• Preview/Edit data
• Table Designer
• Schema Designer
• Schema Compare
• Local SQL Server Container provisioning
• SQL database in Fabric provisioning
• DACPAC/BACPAC export/import
• SQL Database projects
• Query Plan Visualizer
• Other (please describe below)

If you selected "Other", please describe the affected area

No response

Environment Information

• VS Code: Latest (August 2026)
• MSSQL Extension: 1.44.1
• Authentication: Microsoft Entra ID (Azure MFA / Universal with MFA support)
• Azure SQL Database
• Windows user account different from elevated Entra account (with access to the SQL databases)
• elevated Entra account password is reset daily

Confirmation

• I have searched existing issues and couldn't find a match
• I want to work on this issue