[REMOTE] AADSTS9010010 invalid_target on token acquisition in VS Code stable (resource + scope conflict) — still repros June 2026

[fcoalcantarajr]

Issue Type

• Bug in Remote MCP Server

Tool(s)

N/A — the failure happens during the OAuth token acquisition / initialize phase, before any tool is resolved. No tool list is ever returned, so this is not specific to an individual tool.

Description

Summary
Remote MCP Server fails to authenticate in VS Code stable. Token acquisition against the Microsoft Entra ID v2.0 endpoint fails with AADSTS9010010 / invalid_target, followed by 401 when contacting https://mcp.dev.azure.com/<org>. The server never finishes initialize, so no tools load.

This looks identical to #1293 and #1284, and still reproduces in June 2026 after updating VS Code stable to the latest release — so the fix does not appear to have reached the stable channel yet.

Related issues

• [REMOTE] Unable to login - AADSTS9010010: The resource parameter provided in the request doesn't match with the requested scopes #1293 — [REMOTE] Unable to login - AADSTS9010010: resource parameter doesn't match scopes
  [REMOTE] Unable to login - AADSTS9010010: The resource parameter provided in the request doesn't match with the requested scopes #1293
• [REMOTE] Need help with using remote mcp #1284 — [REMOTE] Need help with using remote mcp (same AADSTS9010010 / 401)
  [REMOTE] Need help with using remote mcp #1284
• Same root cause reported against the MCP custom connector + Azure DevOps Remote MCP:
  [BUG] Custom MCP connector OAuth fails with Azure DevOps Remote MCP Server (AADSTS9010010 resource/scope mismatch) anthropics/claude-code#55993
• Same resource + scope conflict against Entra v2.0 in another gateway:
  [BUG][AUTH]: OAuth2 with Microsoft Entra v2 fails with resource+scope conflict (AADSTS9010010) IBM/mcp-context-forge#2881
• Related MCP spec discussion (make resource parameter optional / RFC 8707):
  Request: make resource parameter OPTIONAL (RFC 8707-aligned) modelcontextprotocol/modelcontextprotocol#1614

Environment

• Client: Visual Studio Code stable (latest release as of 2026-06-11)
• OS: macOS
• Azure DevOps org: backed by Microsoft Entra ID (not an MSA/standalone org)
• Auth account: Entra ID account (recently had its password reset)
• .vscode/mcp.json: standard remote config
  ("url": "https://mcp.dev.azure.com/<org>", "type": "http")

Suspected root cause
The OAuth client appears to send both a legacy resource parameter and a v2-style scope parameter to the Entra ID v2.0 token endpoint, which rejects that combination with AADSTS9010010. The same root cause has been reported against other Microsoft remote MCP servers (Fabric Core, Power BI) and the local OAuth proxy pattern.

Steps to reproduce

1. Configure the remote server in .vscode/mcp.json for an Entra-backed org.
2. Start ado-remote-mcp from the MCP view in VS Code stable on macOS.
3. Authenticate with the Entra ID account when prompted.
4. Server discovers resource metadata, then fails token acquisition.

What I already tried (issue persists after all of these)

• Cleared MSAL cache: rm -Rf "$HOME/.IdentityService"
• Signed out / signed back in with the new Entra password
• Updated VS Code stable to the latest release and restarted the MCP server

Note
Other users report the same error works in VS Code Insiders, and the local @azure-devops/mcp server authenticates fine — which points to the OAuth flow of the remote server in VS Code stable, not the org/account configuration.

Error messages / logs (tenant ID and org slug can be redacted as needed)

[info] Discovered resource metadata at https://mcp.dev.azure.com/.well-known/oauth-protected-resource/<org>
[info] Using auth server metadata url: https://login.microsoftonline.com/<tenant-id>/v2.0
[warning] Error fetching authorization server metadata: Failed to fetch ... /.well-known/oauth-authorization-server/<tenant-id>/v2.0: 404
[warning] Error fetching authorization server metadata: Failed to fetch ... /.well-known/openid-configuration/<tenant-id>/v2.0: 404
[info] Discovered authorization server metadata at https://login.microsoftonline.com/<tenant-id>/v2.0/.well-known/openid-configuration
[info] Waiting for server to respond to `initialize` request...
[warning] Error getting token from server metadata: ServerError: invalid_target: Error(s): 9010010 -
  Description: AADSTS9010010: The resource parameter provided in the request doesn't match with the requested scopes.
  Trace ID: 82557e3d-ee34-49b1-8465-0fb0627a0200
  Correlation ID: bde393d6-680c-4c9d-8cbd-92c80dab839d
  Timestamp: 2026-06-11 21:42:00Z
[info] Connection state: Error 401 status sending message to https://mcp.dev.azure.com/<org>:

[baldwicc]

I had this in #1293 - then it started working, and now I'm getting the same error in VS Code Insiders.

Perhaps this is an issue with the vscode.microsoft-authentication bundled extension?

https://github.com/microsoft/vscode/issues?q=is%3Aissue%20state%3Aopen%20label%3Aauthentication-microsoft

[danhellem]

Francisco (@fcoalcantarajr) CorpusIQ (@Ben-Home) Chris Baldwin (@baldwicc)
We have tens of thousands of active users on remote MCP. I would be very surprised if we had a core issue in the endpoint. But to be safe, I have asked out engineering leads to take a look at this issue

[danhellem]

Its our understanding this is a bug in VS Code. We are still looking into it