Interactive Browser Delegated Access - Unable to authenticate

[fguicc]

Describe the bug

I recently changed laptop and now I have a Surface 7 and Windows11 on ARM.
Therefore I have PowerShell 7.5.3 (arm64) and Microsoft Graph PowerShell Module 2.31.0

If I try to connect with Interactive Browser Delegated Access scenario,
the connect-mggraph command opens a browser (edge) window, where I select the user account
but then it fails with the error:
"Connect-MgGraph: InteractiveBrowserCredential authentication failed: An HttpListenerException occurred while listening on http://localhost:64324/ for the system browser to complete the login. Possible cause and mitigation: the app is unable to listen on the specified URL; run 'netsh http add iplisten 127.0.0.1' from the Admin command prompt."

If I try using client Id + secret , it works
If I try using the access token I got from Graph Explorer, it works.

I tried on my previous laptop Windows 11 on Intel, PowerShell 7.5.3 (x64) and Microsoft Graph PowerShell Module 2.31.0 and it works

Expected behavior

After selecting the users I should get the message on the browser "Authentication complete. You can return to the application. Feel free to close this browser tab"

How to reproduce

1. Open PowerShell 7 (arm64) window
2. Connect-MgGraph
3. Browser windows open to select the account to be used to connect

SDK Version

2.31.0

Latest version known to work for scenario above?

No response

Known Workarounds

No response

Debug output

Click to expand log

```

DEBUG: InteractiveBrowserCredential.Authenticate invoked. Scopes: [ User.Read ] ParentRequestId:
DEBUG: Executing interactive authentication workflow inline.
DEBUG: False MSAL 4.67.2.0 MSAL.CoreCLR .NET 9.0.8 Microsoft Windows 10.0.26100 [2025-10-15 15:12:53Z - ddfdc9d7-0502-4022-b4d7-ecd80b0b4680] MSAL MSAL.CoreCLR with assembly version '4.67.2.0'. CorrelationId(ddfdc9d7-0502-4022-b4d7-ecd80b0b4680)
DEBUG: False MSAL 4.67.2.0 MSAL.CoreCLR .NET 9.0.8 Microsoft Windows 10.0.26100 [2025-10-15 15:12:53Z - ddfdc9d7-0502-4022-b4d7-ecd80b0b4680] === InteractiveParameters Data ===
LoginHint provided: False
User provided: False
UseEmbeddedWebView: NotSpecified
ExtraScopesToConsent:
Prompt: select_account
HasCustomWebUi: False
DEBUG: False MSAL 4.67.2.0 MSAL.CoreCLR .NET 9.0.8 Microsoft Windows 10.0.26100 [2025-10-15 15:12:53Z - ddfdc9d7-0502-4022-b4d7-ecd80b0b4680]
=== Request Data ===
Authority Provided? - True
Scopes - User.Read
Extra Query Params Keys (space separated) -
ApiId - AcquireTokenInteractive
IsConfidentialClient - False
SendX5C - False
LoginHint ? False
IsBrokerConfigured - False
HomeAccountId - False
CorrelationId - ddfdc9d7-0502-4022-b4d7-ecd80b0b4680
UserAssertion set: False
LongRunningOboCacheKey set: False
Region configured:

DEBUG: False MSAL 4.67.2.0 MSAL.CoreCLR .NET 9.0.8 Microsoft Windows 10.0.26100 [2025-10-15 15:12:53Z - ddfdc9d7-0502-4022-b4d7-ecd80b0b4680] === Token Acquisition (InteractiveRequest) started:
Scopes: User.Read
Authority Host: login.microsoftonline.com
DEBUG: False MSAL 4.67.2.0 MSAL.CoreCLR .NET 9.0.8 Microsoft Windows 10.0.26100 [2025-10-15 15:12:53Z - ddfdc9d7-0502-4022-b4d7-ecd80b0b4680] [Instance Discovery] Instance discovery is enabled and will be performed
DEBUG: False MSAL 4.67.2.0 MSAL.CoreCLR .NET 9.0.8 Microsoft Windows 10.0.26100 [2025-10-15 15:12:53Z - ddfdc9d7-0502-4022-b4d7-ecd80b0b4680] [Region discovery] Not using a regional authority.
DEBUG: False MSAL 4.67.2.0 MSAL.CoreCLR .NET 9.0.8 Microsoft Windows 10.0.26100 [2025-10-15 15:12:53Z - ddfdc9d7-0502-4022-b4d7-ecd80b0b4680] Using system browser.
DEBUG: False MSAL 4.67.2.0 MSAL.CoreCLR .NET 9.0.8 Microsoft Windows 10.0.26100 [2025-10-15 15:12:53Z - ddfdc9d7-0502-4022-b4d7-ecd80b0b4680] Listening for authorization code on http://localhost:64324/
DEBUG: False MSAL 4.67.2.0 MSAL.CoreCLR .NET 9.0.8 Microsoft Windows 10.0.26100 [2025-10-15 15:12:58Z - ddfdc9d7-0502-4022-b4d7-ecd80b0b4680] HttpListenerException - cancellation requested? False
DEBUG: False MSAL 4.67.2.0 MSAL.CoreCLR .NET 9.0.8 Microsoft Windows 10.0.26100 [2025-10-15 15:12:58Z - ddfdc9d7-0502-4022-b4d7-ecd80b0b4680] Exception type: Microsoft.Identity.Client.MsalClientException
, ErrorCode: http_listener_error
---> Inner Exception Details
Exception type: System.Net.HttpListenerException
To see full exception details, enable PII Logging. See https://aka.ms/msal-net-logging
at System.Net.HttpListener.EndGetContext(IAsyncResult asyncResult)
at System.Threading.Tasks.TaskFactory1.FromAsyncCoreLogic(IAsyncResult iar, Func2 endFunction, Action1 endAction, Task1 promise, Boolean requiresSynchronization)
--- End of stack trace from previous location ---
at Microsoft.Identity.Client.Platforms.Shared.DefaultOSBrowser.HttpListenerInterceptor.ListenToSingleRequestAndRespondAsync(Int32 port, String path, Func`2 responseProducer, CancellationToken cancellationToken)

=== End of inner exception stack trace ===
To see full exception details, enable PII Logging. See https://aka.ms/msal-net-logging
at Microsoft.Identity.Client.Platforms.Shared.DefaultOSBrowser.HttpListenerInterceptor.ListenToSingleRequestAndRespondAsync(Int32 port, String path, Func2 responseProducer, CancellationToken cancellationToken) at Microsoft.Identity.Client.Platforms.Shared.Desktop.OsBrowser.DefaultOsBrowserWebUi.InterceptAuthorizationUriAsync(Uri authorizationUri, Uri redirectUri, Boolean isBrokerConfigured, CancellationToken cancellationToken) at Microsoft.Identity.Client.Platforms.Shared.Desktop.OsBrowser.DefaultOsBrowserWebUi.AcquireAuthorizationAsync(Uri authorizationUri, Uri redirectUri, RequestContext requestContext, CancellationToken cancellationToken) at Microsoft.Identity.Client.Internal.AuthCodeRequestComponent.FetchAuthCodeAndPkceInternalAsync(IWebUI webUi, CancellationToken cancellationToken) at Microsoft.Identity.Client.Internal.AuthCodeRequestComponent.FetchAuthCodeAndPkceVerifierAsync(CancellationToken cancellationToken) at Microsoft.Identity.Client.Internal.Requests.InteractiveRequest.GetTokenResponseAsync(CancellationToken cancellationToken) at Microsoft.Identity.Client.Internal.Requests.InteractiveRequest.ExecuteAsync(CancellationToken cancellationToken) at Microsoft.Identity.Client.Internal.Requests.RequestBase.<>c__DisplayClass11_1.<<RunAsync>b__1>d.MoveNext() --- End of stack trace from previous location --- at Microsoft.Identity.Client.Utils.StopwatchService.MeasureCodeBlockAsync(Func1 codeBlock)
at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)

DEBUG: InteractiveBrowserCredential.Authenticate was unable to retrieve an access token. Scopes: [ User.Read ] ParentRequestId: Exception: Azure.Identity.AuthenticationFailedException (0x80131500): InteractiveBrowserCredential authentication failed: An HttpListenerException occurred while listening on http://localhost:64324/ for the system browser to complete the login. Possible cause and mitigation: the app is unable to listen on the specified URL; run 'netsh http add iplisten 127.0.0.1' from the Admin command prompt.
---> Microsoft.Identity.Client.MsalClientException (0x80131500): An HttpListenerException occurred while listening on http://localhost:64324/ for the system browser to complete the login. Possible cause and mitigation: the app is unable to listen on the specified URL; run 'netsh http add iplisten 127.0.0.1' from the Admin command prompt.
---> System.Net.HttpListenerException (0x80004005): The request is not supported.
Connect-MgGraph: InteractiveBrowserCredential authentication failed: An HttpListenerException occurred while listening on http://localhost:64324/ for the system browser to complete the login. Possible cause and mitigation: the app is unable to listen on the specified URL; run 'netsh http add iplisten 127.0.0.1' from the Admin command prompt.

</details>


### Configuration

PSVersion                      7.5.3
PSEdition                      Core
GitCommitId                    7.5.3
OS                             Microsoft Windows 10.0.26100
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Edition	Windows 11 Pro
Version	24H2
Installed on	‎22.‎05.‎2025
OS build	26100.6899
64-bit operating system, ARM-based processor

### Other information

_No response_

[fguicc]

I also tried to downgrade the module to version 2.25.0 but it fails in the same way

[klorgas]

same here, popping on random hosts everywhere

[gavinbarron]

I apologize to those of you impacted by this. It's my strong suspicion that this is related to an issue in KB5066835

https://learn.microsoft.com/en-us/answers/questions/5585563/localhost-not-working-anymore-after-2025-10-cumula

[gavinbarron]

Yes, this was caused by an issue in KB5066835

Here's the Windows announcement and mitigation: https://learn.microsoft.com/en-us/windows/release-health/status-windows-11-25h2#3592msgdesc