1a0588d233
## Summary Fixes #13008 Azure AD has a [known bug](https://learn.microsoft.com/en-us/answers/questions/5570899/our-adminconsent-url-always-fails-with-aadsts65005) where the first consent attempt for a multi-tenant app fails with `AADSTS650051` because the service principal is mid-provisioning in the target tenant. Microsoft's own engineers have acknowledged the issue with no fix ETA. This PR adds a transparent retry to the `MicrosoftOAuthGuard`: 1. When the OAuth redirect returns `AADSTS650051`, the guard parses the `state` parameter to recover the original query params (workspaceId, invite hash, locale, etc.) 2. Redirects the user back to `/auth/microsoft` with a `msRetry=1` counter 3. The full OAuth flow restarts — by this point the service principal has finished provisioning, so consent succeeds 4. Capped at 1 retry (`MAX_MICROSOFT_AUTH_RETRIES`) to prevent infinite loops. If it still fails, falls through to the normal error page From the user's perspective, they just see a brief extra redirect instead of a cryptic error page. ### Context - `AADSTS650051` is a race condition in Azure AD's service principal provisioning during multi-tenant app consent - It's distinct from missing consent (`AADSTS65001`) or admin consent required (`AADSTS90094`) - The error is transient — retrying the same flow immediately succeeds - Microsoft Q&A threads confirm this affects many multi-tenant apps, not just Twenty ### References - [Microsoft Q&A: adminconsent always fails with AADSTS650051 on first attempt](https://learn.microsoft.com/en-us/answers/questions/5570899/our-adminconsent-url-always-fails-with-aadsts65005) - [Microsoft Q&A: AADSTS650051 for multiple applications](https://learn.microsoft.com/en-us/answers/questions/5571098/when-customers-attempt-to-sign-in-and-grant-consen) ## Test plan - [ ] Deploy to a staging environment with Microsoft OAuth enabled - [ ] Have a user from a new Azure AD tenant attempt Microsoft sign-in for the first time - [ ] If AADSTS650051 occurs, verify the user is transparently retried and signs in successfully - [ ] Verify `msRetry` counter prevents infinite redirect loops (check server logs for the warn message) - [ ] Verify normal Microsoft sign-in flow (no error) is unaffected 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: neo773 <62795688+neo773@users.noreply.github.com> Co-authored-by: neo773 <neo773@protonmail.com>