macOS: Entra-broker MCP servers fail at startup: concurrent sign-ins rejected ("sign-in is already in progress") and rejected cached token not recovered #5250

Describe the bug

On macOS, two Entra-protected remote MCP servers (Azure DevOps remote MCP at https://mcp.dev.azure.com/<org> and the WorkIQ plugin at https://workiq.svc.cloud.microsoft/mcp) fail to connect at session startup. The failures happen in the native Entra account-broker path that 1.0.95 introduced.

The logs show two separate problems.

1. Concurrent broker sign-ins are rejected instead of queued

When both servers need a token at startup, both call the account broker at the same time. The CLI's broker wrapper allows only one interactive request per process and throws for the second request. The second request is not queued:

[ERROR] Signing in with your Microsoft Entra account (account broker)...
[ERROR] Signing in with your Microsoft Entra account (account broker)...
[WARNING] Entra token acquisition failed {"server_url":"https://mcp.dev.azure.com/<org>","error":"Entra broker error: Error: A Microsoft sign-in is already in progress. Complete or cancel it before trying again."}
[ERROR] OAuth authentication failed for ado-remote-mcp: MCPOAuthError: Microsoft Entra sign-in for https://mcp.dev.azure.com/<org> failed: Entra broker error: Error: A Microsoft sign-in is already in progress. ...

Which server fails depends on timing. The /mcp reconnect hits the same collision. The guard is in the broker plugin's acquireTokenInteractive, which throws when this.interactiveRequest is already set.

2. Startup cannot recover from a token that the server rejects

At startup the cached WorkIQ token returns HTTP 401. The CLI then asks the broker for a new token, and the broker returns the same token. The connection fails:

[WARNING] the Entra account broker returned the rejected access token {"server_url":"https://workiq.svc.cloud.microsoft/mcp"}
[ERROR] OAuth authentication failed for workiq: MCPOAuthError: Microsoft Entra sign-in for https://workiq.svc.cloud.microsoft/mcp failed: Entra broker error: the broker returned the rejected access token

This repeats on every new session. A token that the broker issued about 30 minutes earlier, and that WorkIQ accepted then, was rejected in the later session. The 1.0.101 changelog says explicit sign-in recovers from rejected cached tokens. The automatic startup and refresh path does not recover. While the WorkIQ request holds the broker, it also blocks the ADO request (problem 1).

The tenant enforces a Conditional Access sign-in frequency policy. Other Entra clients on the same machine report AADSTS70043. I suspect this is why tokens that are still within their lifetime get rejected.

Expected behavior

• The CLI queues or serializes concurrent broker sign-ins across MCP servers instead of failing them.
• When a server rejects the token the broker returns, the startup and refresh path bypasses the broker's cached token (for example with a forced refresh or a claims request) or falls back to interactive sign-in. It should not fail the connection.

Affected version

GitHub Copilot CLI 1.0.103

Environment

• macOS 27.0.1 (Apple silicon)
• Microsoft Enterprise SSO extension (Company Portal) installed
• Remote HTTP MCP servers: Azure DevOps remote MCP (mcp-config.json, no oauthClientId) and the WorkIQ plugin (workiq@work-iq)

Steps to reproduce

1. Configure the Azure DevOps remote MCP server and install the WorkIQ plugin.
2. Sign in to both once, then wait until the cached tokens are rejected (in this tenant, roughly 30 minutes or more).
3. Start a new copilot session.
4. Neither server loads tools. The logs show the errors above.