Cannot Login to M365 CLI

Question

Hi, can anybody help me to login to M365 CLI?

https://learn.microsoft.com/en-us/microsoftteams/platform/toolkit/microsoft-365-agents-toolkit-cli

I have always got this error:

Error: An unexpected error has occurred while performing the teamsfxCli task. {"stack":"ServerError: invalid_request: AADSTS70007: The application requested an unsupported mode 'query' when requesting a token. Trace ID:[Moderator note: Personally Identifiable Information removed] Correlation ID: [Moderator note: Personally Identifiable Information removed]

invalid_request: AADSTS70007: The application requested an unsupported mode 'query' when requesting a token

I am not sure what query that the CLI means, I am only run the "atk auth login azure".

Answer 1

Hi @Wei

Based on my research, it is the OAuth/OIDC response_mode=query parameter generated internally by the Microsoft 365 Agents Toolkit CLI during interactive sign-in. Microsoft Entra ID is rejecting that authentication request before login completes. The CLI's underlying auth library (MSAL for Node.js) is requesting response_mode=query when it asks Azure AD/Entra ID for a token interactively. The specific Microsoft-managed app registration behind atk auth login azure only supports a different response mode (form_post) for this flow, so Entra rejects the request outright with AADSTS70007, often within a few seconds, sometimes before the browser window even fully opens if you already have an active Microsoft sign-in session in your browser.

A few things to try, in order:

1.Update the CLI to the latest version first since the pattern elsewhere has been "older CLI versions use an unsupported mode"

   npm install -g @microsoft/m365agentstoolkit-cli@latest
   atk -v

Confirm the version actually changed, then retry atk auth login azure.

2.Try in a fresh/incognito browser window, or fully sign out of any existing Microsoft account session in your default browser first. In the related cases, the failure happened almost instantly specifically because an active SSO session let Entra short-circuit the flow before any real sign-in prompt, a clean session at least gives you a chance to see an actual prompt rather than an immediate silent rejection.

3.Specify your tenant explicitly

Try signing in against your organization’s tenant rather than the generic endpoint:

atk auth login azure --tenant <TENANT-ID> --debug --verbose

You can obtain the tenant ID from your Azure administrator, or from Azure CLI if that tool is already available:

az login
az account show --query tenantId --output tsv

Here, --query tenantId is only an Azure CLI output filter. It is unrelated to the response_mode=query shown in your error.

It is more likely a CLI/MSAL interactive-authentication compatibility issue. If updating the CLI and specifying the tenant do not resolve it, collect the following and file an issue in the toolkit’s GitHub repository:

https://github.com/OfficeDev/microsoft-365-agents-toolkit/issues?q=is%3Aissue+state%3Aopen

Please keep me updated.