Repository navigation
Windows: Entra broker token cache stays 0 bytes after MCP sign-in, so every new process re-prompts #5236
Description
Describe the bug
After I sign in through the Microsoft Entra account broker for an HTTP MCP server, the token cache file stays empty. Every new process shows the account picker again. A /restart in the same process does not prompt.
~\.copilot\entra-broker-accounts\<id>.bin is written (1,974 bytes) when I pick the account. ~\.copilot\entra-broker-cache\<id>.bin stays at 0 bytes. I did not read the file contents.
Affected version
1.0.103
Steps to reproduce the behavior
- Add an HTTP MCP server that uses Entra sign-in to
~\.copilot\mcp-config.json:{"mcpServers": {"EngHub": {"type": "http", "url": "https://mcp.eng.ms", "tools": ["*"]}}} - Start a session. The CLI shows
Authenticating: EngHuband the Windows "Pick an account" dialog. - Pick the signed-in account. Authentication succeeds.
- Check the file sizes in
~\.copilot\entra-broker-cache\and~\.copilot\entra-broker-accounts\. The cache file is 0 bytes. - Exit and start a new session. The account picker shows again.
- Run
/restartin a running session. No prompt shows.
Expected behavior
The token is saved in entra-broker-cache. A new process signs in silently without the account picker.
Additional context
- OS: Windows, x64
- Shell: PowerShell
- Launched with
agency copilot(Agency 2026.10.20.6) - I deleted the empty cache file and signed in again. It was recreated at 0 bytes.
- Related but different: Remote MCP OAuth: silent refresh fails with AADSTS70011 (refresh reuses granted scope mixing
.default+ resource-specific scopes), forcing repeated interactive sign-in #4464 (repeated interactive sign-in from refresh scope errors), Windows: MCP Entra sign-in fails with "this server's advertised scopes could not be safely validated for the account broker" #5068 and Windows: CLI crashes (0xc0000005 in msalruntime.dll) on first Entra account-broker sign-in for MCP server - interactive WAM called with no parent window #5088 (Windows account broker failures).
Activity
jlac0716 commentedon Oct 25, 2026
Additional observations from a Windows x64 startup on 10/25, using PowerShell, Copilot CLI 1.0.103 and Agency 2026.10.22.3:
A Microsoft sign-in is already in progress. Complete or cancel it before trying again.The last observation matches the concurrent-sign-in message in #5250: broker sign-ins rejected instead of queued, but on Windows rather than macOS. It does not reproduce that report's separate rejected-cached-token scenario.
These observations suggest checking token persistence and concurrent sign-in handling separately; they do not prove a common root cause. Scope-binding configuration on this machine is non-default, so this is not a clean-default-settings reproduction. No cache deletion, auth-setting changes or runtime patches were made for this report.