Azure AI Foundry published agent ActivityProtocol OAuth redirect fails after successful Entra sign-in

I think the 400 code already redeemed means the redirect is using an auth code that is no longer valid, so restarting the sign‑in from a new browser profile is the safest way to issue a clean one. If it still fails, sharing the correlation IDs with Microsoft support is the correct next step.

The agent-side OAuth flow is failing after Entra sign-in, so Teams/M365 Copilot never gets a completed ActivityProtocol login and the agent stays stuck at “Waiting for Foundry login to complete.” From the context, this class of issue is typically caused by one of:

1. Missing/incorrect permissions or roles for the caller or the agent identity.
2. Conditional Access blocking or interfering with token acquisition.
3. Misconfigured OAuth / redirect URL or audience.

Based on the provided details and the available guidance, use the following checks and fixes:

1. Confirm caller has the right Foundry role
   The caller that is completing the OAuth flow must have at least Azure AI User on the Foundry project:
   • If the caller is the end user in Teams/M365 Copilot, ensure that user has Azure AI User on the Foundry project resource.
   • This is required for the agent to accept the token and complete the login.
     If this role is missing, the agent can return authentication or consent issues and tool calls will fail.
2. Check Conditional Access impact
   Conditional Access can cause agents to appear unresponsive or stuck:
   • If Conditional Access policies block token acquisition for the tenant or the specific app, the agent will not start a conversation or respond, even though the Entra sign-in event shows as successful.
   • Work with the Entra admin to review Conditional Access policies targeting the “Azure AI Studio App” and the user. Ensure they allow token acquisition for this app and scenario.
   • After adjusting policies, retry the OAuth flow from a fresh browser session.
3. Validate OAuth / redirect configuration
   The error Authentication code has already been redeemed indicates the redirect handler is receiving an authorization code that is either reused or not accepted for the expected audience:
   • Ensure the redirect URI in the Azure AI Studio App registration exactly matches the documented redirect endpoint (https://api.agent-oauth.azureml.ms/agent-oauth/v1.0/redirect) and that there are no extra or missing variants.
   • Confirm that the ActivityProtocol endpoint and the OAuth configuration are using the correct audience/resource for the token (for Foundry agents, tokens must be requested for https://ai.azure.com when calling the agent endpoint). A mismatched audience can cause 401/400 behavior in downstream calls.
4. Verify agent identity and downstream permissions
   For published agents, if the agent identity is missing permissions, tool calls and authentication flows can fail after sign-in:
   • Ensure the agent’s managed identity (or published agent identity) has the required RBAC roles on any Azure resources it accesses.
   • Role assignment changes can take up to ~10 minutes to propagate; after changes, wait and retry.
5. Re-run the flow from a clean session
   Because the error says the code has already been redeemed:
   • Close all browser windows, clear cookies for Microsoft/Entra domains, or use a fresh InPrivate/Incognito session.
   • Start a new conversation with the agent in Teams or M365 Copilot, trigger the sign-in again, and complete it once without reusing the same redirect URL.
6. If tool calls still fail after consent
   If consent appears to complete but the agent still cannot respond or tools fail:
   • Confirm the user has the required permissions in the underlying services the agent calls.
   • Confirm again that the user has at least Azure AI User on the Foundry project.

If, after these steps, the OAuth redirect still returns Authentication code has already been redeemed for new sign-in attempts, capture the latest correlation IDs and raise a support ticket, as this pattern can also indicate a backend issue (similar to other transient Foundry/Teams integration problems that required a hotfix).

References:

• Foundry agents in Microsoft Agent 365
• Publish agents to Microsoft 365 Copilot and Microsoft Teams
• Configure and share your agent
• Agent2Agent (A2A) authentication
• Troubleshoot Conditional Access policy issues
• Azure Language tools and agents
• Connect agents to OpenAPI tools (csharp)