[BUG] M365 connector "Authorization failed" when reconnecting from different device — only recoverable from original auth device

[jzlee911]

MCP server URL or name

Microsoft 365 (microsoft365.mcp.claude.com)

How are you connecting to this server?

From browsing the MCP server directory

Where does the issue occur?

Other

When did you last reproduce this?

2026-05-04 10:20 AM SGT

Browser and OS

Claude Mobile App (iOS/Android) — original auth device Claude Desktop App + Chrome — secondary device (failed) Windows 11 Laptop

Describe the issue

The M365 connector session dropped ~3 days after initial authentication. All subsequent reconnection attempts from a secondary device (Laptop — Claude Desktop App and claude.ai web) failed with:

"Authorization with the MCP server failed. You can check your credentials and permissions. If this persists, share this reference with support: ofid_d7a27e4f1d8b824f"

The connector could ONLY be successfully re-authenticated from the original device where it was first connected (Mobile — Claude App).

This suggests the M365 OAuth session or token grant is device-bound to the original authentication host, with no cross-device recovery path.

Reproduction timeline

2026-04-27 17:40 SGT

• Initial M365 connector authentication on Mobile
  (Claude App) via Microsoft SSO — SUCCESS

2026-04-30 19:07 SGT

• Connection dropped (3 days after initial auth)

2026-05-04 10:00 SGT

• Reconnect attempt from Laptop Claude Desktop App — FAILED
  Error: ofid_d7a27e4f1d8b824f
• Reconnect attempt from Laptop claude.ai web — FAILED
  Same error

2026-05-04 10:20 SGT

• Logged out of Claude Web + quit Claude Desktop on Laptop
• Reopened Claude App → attempted reconnect → SSO
  triggered → FAILED

2026-05-04 10:45 SGT

• Abandoned Laptop attempts
• Re-authenticated from Mobile (original auth device) — SUCCESS

Error details

Error message: "Authorization with the MCP server failed. You can check your credentials and permissions."

Reference ID: ofid_d7a27e4f1d8b824f 
Secondary reference ID (seen in Claude Desktop): ofid_8134f444de0cb1da

No additional error codes shown in UI.

Expected behavior

Error message: "Authorization with the MCP server failed. You can check your credentials and permissions."

Reference ID: ofid_d7a27e4f1d8b824f
Secondary reference ID (seen in Claude Desktop): ofid_8134f444de0cb1da

No additional error codes shown in UI.

Additional context

• Claude account is the same across all devices (same login)
• Microsoft Entra ID SSO used for authentication
• Corporate tenant with 90-day CA Sign-in Frequency policy
• This is a distinct issue from the 1-2 day MFA expiry bug (filed separately)
• Related issues:
  [BUG] Cloud MCP connectors bulk-lose authentication simultaneously with no local recovery path claude-code#47485 (bulk auth loss),
  [BUG] M365 Connector not working " Your organization's access policy blocks the MCP server. Contact your IT admin to adjust the policy for this connector. If this persists, share this reference with support: "ofid_30a8a08488aacd2b" #255 (M365 OBO token exchange failure)
• The device-binding behaviour persisted even after full logout and re-login to Claude on the secondary device

[jzlee911]

To add on, the connection has recently been completely dropped, as if I had never connected to this M365.

[2026-05-22 10:02 (UTC+8)] FAIL — outlook_email_search tool was not available in the current session. The M365 connector MCP tool did not load or is not connected. >> Log — "Tool 'outlook_email_search' not found: no matching tool available in the current session context

[localden]

Thanks for the trace IDs. They are past our log retention so I cannot pull per-flow detail. The pattern (works on your first device, fails on a second) is almost always a Conditional Access or device-compliance requirement on the M365 tenant. The sign-in on your second device is being held to a policy the first device satisfies (often "require compliant device", "require hybrid-joined device", or a specific authentication method), and it blocks the token request after you have signed in.

Your tenant admin can confirm this from the Entra sign-in logs: on the failed attempt for the second device, the "Conditional Access" tab will name the exact policy and the missing requirement. The fix is either enrolling the second device per the policy or adjusting the policy to include the device state you are using.

If you can reproduce once more, the fresh trace ID lets us tell you exactly where on our side the request stopped.