MCP OAuth for Entra servers forces native broker window that blocks paste; no browser fallback (1.0.109) #5452

Describe the bug

Describe the bug

Since 1.0.109, /mcp auth azure-devops for https://mcp.dev.azure.com/<org> opens the native Microsoft account broker window (OneAuth). That window blocks copy and paste completely. Nothing can be pasted into the password field, and password managers such as 1Password can't fill it either.

Why it matters

Our corporate passwords are long, randomly generated strings (around 45 characters) stored in a password manager. With the broker window, every sign-in means reading the password and typing it by hand, character by character. That is:

• slow and error-prone;
• a security anti-pattern, because it pushes users toward shorter or memorable passwords and defeats the purpose of a password manager.

Affected version

Copilot CLI: 1.0.109

Steps to reproduce the behavior

1. Configure a remote HTTP MCP server: https://mcp.dev.azure.com/<org>.
2. Run /mcp auth azure-devops.
3. Try to paste a password into the Microsoft sign-in window: paste is blocked.

Expected behavior

For Entra MCP servers, provide either:

1. a browser-based OAuth flow that uses the system default browser, or
2. at least a printed, copyable sign-in URL,

as a fallback or as an opt-in setting (for example, honoring COPILOT_ENTRA_DISABLE_ONEAUTH).

Additional context

• Copilot CLI: 1.0.109
• OS: macOS (darwin-arm64)
• MCP server: remote HTTP, mcp.dev.azure.com (Azure DevOps)