# Token Vault: no tokenset stored at login, exchange fails with federated_connection_refresh_token_not_found EU public cloud tenant (prod-eu-2), Free plan. We're building the documented Auth for GenAI scenario: an MCP server protected by Auth0 calls a M

Get Help
1

Token Vault: no tokenset stored at login, exchange fails with federated_connection_refresh_token_not_found

EU public cloud tenant (prod-eu-2), Free plan.

We’re building the documented Auth for GenAI scenario: an MCP server protected by Auth0 calls a Microsoft Entra-protected custom API (api://<app-id>/access_as_user, not Graph) on the user’s behalf via Token Vault access-token exchange.

Login through Microsoft works, and we verified the upstream authorize request includes offline_access plus the custom scope. Microsoft returns access and refresh tokens: after each login they appear in the user’s identities array. But the docs say a vault-enabled connection should store them in a tokenset instead, and that never happens. connected_accounts.active is true on the connection (set before login), yet the exchange always fails with federated_connection_refresh_token_not_found.

We tried three strategies:

  • waad: setting options.scope breaks login itself (AADSTS28003, empty scope sent at code redemption)

  • oidc: login OK, upstream tokens discarded entirely

  • custom oauth2: login OK, tokens stored on the identity, never in the vault

Also, the “Microsoft Entra” social connection from the Microsoft integration guide doesn’t exist in our catalog, and the Management API rejects its strategy name.

Questions:

  1. Is login-time tokenset storage supported for oidc/oauth2 strategy connections, or only for first-party connectors?

  2. Is the “Microsoft Entra” connector gated by plan, region, or rollout? How do we get it?

  3. Is there a supported way today to get an Entra token for a custom API through Token Vault?

Happy to share tenant name, log entries, and trace IDs privately. The setup is scripted and reproducible in minutes.