access_denied on the callback URL: consent, email domains, and connection denials
Updated solution skillNew
When the callback URL shows ?error=access_denied, the login was refused after authentication. The description parameter names the cause; tenant logs confirm it. Not for different error messages.