diff --git a/server.js b/server.js
index 58813d6..753561f 100644
--- a/server.js
+++ b/server.js
@@ -258,7 +258,11 @@ async function finishMicrosoftLogin(url, response) {
       })
     });
     const tokens = await tokenResponse.json();
-    if (!tokenResponse.ok || !tokens.id_token) throw new Error("Microsoft could not verify this sign-in.");
+    if (!tokenResponse.ok || !tokens.id_token) {
+      // Microsoft's AADSTS code says why (bad secret, SPA platform, redirect mismatch); keep it in the logs only.
+      console.error("Microsoft token exchange failed:", tokenResponse.status, tokens.error || "", String(tokens.error_description || "").split(/\r?\n/)[0]);
+      throw new Error("Microsoft could not verify this sign-in.");
+    }
     const claims = await validateMicrosoftIdToken(tokens.id_token, pending.nonce);
     const email = String(claims.email || claims.preferred_username || "").trim().toLowerCase();
     if (!email || !ALLOWED_EMAILS.has(email)) {