[BUG] M365 first-party connector requires MFA re-authentication every 1-2 days on claude.ai + Cowork (Claude Desktop)

[jzlee911]

MCP server URL or name

Microsoft 365 (microsoft365.mcp.claude.com)

How are you connecting to this server?

From browsing the MCP server directory

Where does the issue occur?

During a conversation (after initial auth)

When did you last reproduce this?

2026-05-04 10:45 AM SGT

Browser and OS

Chrome 148.0.7778.168 on Windows 11 / Claude Desktop 1.7196.0 (2dbd78)

Describe the issue

The Microsoft 365 first-party connector (microsoft365.mcp.claude.com) loses authentication every 1-2 days on claude.ai web and Claude Desktop (Cowork), requiring a full manual MFA re-authentication to restore. This is distinct from custom connector token refresh bugs (e.g. #228, #46328) — the M365 connector uses Anthropic's first-party hosted path, not mcp-proxy.anthropic.com.

The prompt shown to the user is: "Multi-factor authentication has expired. You can reconnect to verify your identity."

This happens regardless of activity level — the connector drops even when M365 tools have been used within the preceding 24 hours.

Error details

"Multi-factor authentication has expired. You can reconnect to verify your identity."

No error ID or pop-up code was shown. The message appears directly on the M365 connector card in claude.ai Settings → Connectors.

Expected behavior

1. The M365 first-party connector should silently refresh the OAuth token before it expires, without requiring user intervention
2. If a full re-authentication is truly required (e.g. refresh token revoked), the prompt should clearly state why — not show a generic MFA expiry message when the tenant policy is 90 days
3. Token refresh should be consistent between first-party connectors (M365, Gmail etc.) and not dependent on user-initiated activity within a narrow window

Additional context

• Microsoft Entra ID tenant Conditional Access Sign-in Frequency policy is set to 90 days — Microsoft-side token expiry is ruled out as root cause
• Entra ID Sign-in logs show no failed token refresh attempts from Anthropic's backend between last successful use and the drop
• Issue occurs on both claude.ai web (Chrome) AND Claude Desktop Cowork simultaneously
• Related issues: [BUG] Cloud MCP connectors bulk-lose authentication simultaneously with no local recovery path claude-code#47485 (M365 listed in bulk auth loss evidence), [BUG] OAuth token refresh never attempted for custom connectors via mcp-proxy.anthropic.com #228 (token refresh never attempted — different path but related root cause)
• Workaround currently in use: manual reconnect every 1-2 days

[localden]

Thanks for the detailed report and for already checking the Conditional Access sign-in-frequency setting. A 90-day tenant policy with re-auth required every 1-2 days does not match the usual cause, so we would like to dig in further.

A few follow-up questions:

1. Can you share the full "Conditional Access" tab from one of the failed sign-in entries in the Entra sign-in logs (around the time you were prompted to reconnect)? Even if the headline policy is 90 days, another policy (for example one scoped to specific apps, device state, or risk level) may be applying a shorter interval to this app.
2. Do you have a Token Lifetime policy configured for the tenant or for this application specifically?
3. Is the device you are using Entra-joined / hybrid-joined / registered, or unmanaged? Some sign-in-frequency policies apply only to unmanaged devices.
4. The next time you are prompted to reconnect, could you grab a fresh request ID from the connector error dialog?

We see the "Multi-factor authentication has expired" message corresponds to a specific response Microsoft returns to us, so something is telling Microsoft to require fresh MFA on the refresh. The sign-in log entry should name exactly what.

[jzlee911]

Hi @localden, thanks for your replied, kindly refer below for your questions

1. Please refer to the screenshot, due to company policy, i can only show you the policy that is allowed
2. There is no Token Lifetime policy configured, only Session - Sign-in Frequency - 90 days
3. It is a registered device
4. Noted, however, I just reconnect recently, I will try to provide the request ID if I am being prompted to reconnect

[jzlee911]

Hi @localden, my connection dropped yesterday however, upon checking the main.log, this does not appear in it. Where can we retrieve this ID and is M365 connector auth activity logged anywhere client-side, or is it entirely server-side?

Separately, if we have trusted device settings in place, is there any other way that we can extend the duration via conditional access?

[jzlee911]

Hi @localden, do let us know if you require more detail information. If yes, is it possible that we will continue the communication via email due to sensitive information?