Microsoft just has no idea how to do auth well. Many of their online web properties follow these tortured redirect chains for authentication. I just cannot even count the number of times I've ended up in some horked state while trying to view something on O365 like email quarantine. I'm not surprised to hear that their apps are generating auth storms.