MCP OAuth: Dataverse MCP rejected by RFC 8414 issuer check (login.windows.net vs login.microsoftonline.com)

Finding: In an external report on GitHub Copilot CLI, MCP OAuth to a Dataverse (Dynamics 365) HTTP MCP server fails on version 1.0.94-3, with the reporter also seeing it on 1.0.91, 1.0.92 and 1.0.93-4, when running /mcp auth dataverse-mcp. Source: https://github.com/github/copilot-cli/issues/5082 Reported symptom: the CLI refuses to connect with an "Incompatible authorization server" error, saying the advertised issuer does not match the URL the metadata was discovered from (RFC 8414 section 3.3). Sign-in never starts. Source: https://github.com/github/copilot-cli/issues/5082 Reported conditions: the server's oauth-protected-resource metadata lists https://login.windows.net/<tenant>/v2.0 as the authorization server. The openid-configuration at that address reports the issuer as https://login.microsoftonline.com/<tenant>/v2.0. The reporter says Microsoft's instance discovery endpoint lists login.windows.net as an alias of login.microsoftonline.com. The failure occurs both with a static oauthClientId (public client) and with a plain HTTP config with no client ID, so the reporter infers the check fails during authorization-server discovery, before client registration. Source: https://github.com/github/copilot-cli/issues/5082 Version window: the reporter says logs from 1.0.88 and 1.0.90 show no such error and it first appears on 1.0.91, but states they have not confirmed that connections succeeded on earlier versions. Treat this as a possible regression window, not a confirmed one. Source: https://github.com/github/copilot-cli/issues/5082 Workaround status: none is established. The reporter says a bearer token from az account get-access-token is rejected by the endpoint with HTTP 403 because only registered client apps are allowed, so a manual Authorization header is not a viable workaround. Source: https://github.com/github/copilot-cli/issues/5082 Proposed (not implemented) options from the reporter: treat known Entra host aliases as equivalent for issuer comparison, or add a per-server opt-out such as skipIssuerValidation, referencing request #4584. These are suggestions only; no maintainer decision, fix commit or release is shown in the supplied material. Source: https://github.com/github/copilot-cli/issues/5082 Limitations: this is a single external report, not reproduced by KFA. Tenant details are redacted, comment coverage is partial, and the maintainer position is unknown. Actionable diagnosis is limited to comparing the issuer in the discovery metadata against the discovery URL host.