One read of Claude Documentationclaude-docs-20261109T170706Z
2 pages moved out of 281 read.
Pages moved
2
significant first
Pages read
281
in this capture
Captured
17:07 UTC
Corpus hash
eb9e1dba31b5
corpus-hash
What this read moved
1-2 of 2third-party/claude-desktop/connectors-m365 Changed · +4 / -1 lines
from line 142
142142| `login.microsoftonline.com` | Microsoft Entra sign-in |
143143| `microsoft365.mcp.claude.com` | The connector service (substitute your deployment's hostname) |
144144
145If your firewall or secure web gateway filters traffic by application, also allow Model Context Protocol (MCP) traffic to the connector service's host. Such equipment can classify the connection as MCP traffic and block it even when the host is allowed.
146
145147### Control write actions on the remote connector
146148
147149Claude can take a write action for a user through the remote connector once the matching write scope is approved for that user on the Anthropic connector app. The Entra admin center lists that app under **Enterprise applications** as **M365 MCP Server for Claude**.
from line 230
228230
229231### Troubleshoot sign-in errors
230232
231The errors below are the ones most commonly seen during setup. Each maps to a specific step that was missed or misconfigured.
233These errors can appear during setup.
232234
233235| Error | Cause | Fix |
234236| - | - | - |
237| `Connection to server failed. You can try again.` with no Microsoft sign-in page, and the user's [`main.log`](https://claude.com/docs/third-party/claude-desktop/data-storage#where-data-lives) shows an HTML block page from your network, starting at the `[error]` line that contains the entry's `name` (`m365` unless you changed it) and the word `failed` | A firewall or secure web gateway blocked the request to the connector service before sign-in started | Send the block page to your network team and ask them to [allow MCP traffic to the connector service's host](#allow-the-required-network-hosts) |
235238| `AADSTS50011` redirect mismatch | Redirect URI is not exactly `http://127.0.0.1/callback`, or was registered under *Web* instead of *Mobile and desktop applications* | Re-check step 2.1 |
236239| `AADSTS50194` multi-tenant required | Tenant ID is missing from the configuration | Add Tenant ID in step 4 |
237240| `AADSTS65001` admin consent required | Step 1 was not completed, or step 2.4 was skipped | Complete admin consent |
third-party/claude-desktop/mcp-sign-in Changed · +1 / -0 lines
from line 89
8989
9090| What the user sees or `main.log` records | Cause | Fix |
9191| - | - | - |
92| "Connection to server failed. You can try again." with no sign-in window, and `main.log` shows an HTML block page from your network, starting at the `[error]` line that contains the server's name and the word `failed` | A firewall or secure web gateway blocked the request to the MCP server before sign-in started. Such equipment can classify the connection as Model Context Protocol (MCP) traffic and block it even when the server's host is allowed | Send the block page to your network team and ask them to allow MCP traffic to the server's host. Then have the user click **Connect** again |
9293| "Couldn't connect to \{server} because it doesn't support automatic client registration" (Claude Desktop 2.110.0 or later), or `main.log` records that the authorization server does not support dynamic client registration | **OAuth** is **Auto-register** but the identity provider requires a client that you register | Register a public client with redirect URI `http://127.0.0.1:53280/callback`, set **OAuth** to **Bring your own client**, and fill in **Client ID** |
9394| The browser step succeeds, then the connection fails and `main.log` records the token endpoint's error, for example `client_secret is missing` | The entry has a **Client ID** but the identity provider also requires the secret | Add the secret and **Authorization server** as described under [Where the client secret goes](#where-the-client-secret-goes) |
9495| `main.log` names a rejected referrer host during sign-in | The identity provider completes sign-in from a host other than the one in its authorization URL | Add that hostname to **Additional redirect referrer hosts** |