Skip to main content
Use this guide when you already have an MCP server and need to register it in Microsoft Entra (formerly Azure AD) so TrueFoundry (or other clients) can obtain tokens. To write an OAuth MCP server and wire up JWT verification, see Create an OAuth MCP Server with Azure Entra. After Entra is configured, register the server in TrueFoundry.
1

Create an App Registration for the MCP Server (Resource/API)

This app registration represents your MCP server as a protected resource. It will define what permissions (scopes) are available for your API.
  1. Navigate to Azure Portal > Microsoft Entra ID > App registrations
  2. Click New registration
  3. Configure:
    • Name: CalculatorMCPServer
    • Supported account types: Choose based on your needs (typically “Accounts in this organizational directory only”)
    • Redirect URI: Leave empty for now (this is the API, not the client)
  1. Click Register
  2. Note down the following from the Overview page:
    • Application (client) ID - This will be used as part of your audience
    • Directory (tenant) ID - Your Azure AD tenant ID
2

Expose an API and Define Scopes

Now we’ll configure the app registration to expose an API with custom scopes that clients can request.
  1. In your CalculatorMCPServer app registration, go to Expose an API
  2. Click Add next to Application ID URI
    • Azure will suggest api://{client-id} - accept this or customize it
    • This URI becomes your audience value
  1. Click Add a scope to create custom scopes:
    • Scope name: calculator.add
    • Who can consent: Admins and users
    • Admin consent display name: Add numbers
    • Admin consent description: Allows the application to add numbers
    • User consent display name: Add numbers
    • User consent description: Allows the application to add numbers on your behalf
    • State: Enabled
  1. Click Add scope
  2. Repeat to add another scope:
    • Scope name: calculator.subtract
    • Configure similar display names and descriptions
Your full scope names will be in the format: api://{client-id}/calculator.add and api://{client-id}/calculator.subtract
3

Create a Client App Registration

This app registration represents the client application (user-facing or machine-to-machine) that will access your MCP server.
  1. Navigate to App registrations > New registration
  2. Configure:
    • Name: CalculatorMCPClient
    • Supported account types: Same as your API app
    • Redirect URI:
      • Platform: Web
      • URI: https://<your-tfy-control-plane-url>/api/svc/v1/llm-gateway/mcp-servers/oauth2/callback
  3. Click Register
  4. Note the Application (client) ID - this is your OAuth Client ID
  5. Go to Certificates & secrets
  6. Click New client secret
    • Description: MCP Client Secret
    • Expires: Choose based on your security requirements
  1. Click Add
  2. Important: Copy the Value immediately - this is your Client Secret (it won’t be shown again)
Store the client secret securely. It cannot be retrieved after you leave this page.
  1. Go to Authentication
  2. Under Implicit grant and hybrid flows, ensure:
    • Access tokens is checked (for user auth)
    • ID tokens is checked (for user auth)
  3. Under Advanced settings > Allow public client flows: Set to No
4

Grant API Permissions to the Client App

The client app needs permission to access the MCP server API. We’ll grant the scopes we defined earlier.
  1. In your CalculatorMCPClient app registration, go to API permissions
  2. Click Add a permission
  3. Go to My APIs tab
  4. Select CalculatorMCPServer
  1. Select Delegated permissions (for user authentication)
  2. Check:
    • calculator.add
    • calculator.subtract
Screenshot placeholder: Select permissions dialog
  1. Click Add permissions
  2. For machine-to-machine authentication, click Add a permission again
  3. Select CalculatorMCPServer from My APIs
  4. Select Application permissions
  5. Check the same scopes:
    • calculator.add
    • calculator.subtract
  6. Click Add permissions
  7. Confirm by clicking Yes
“Grant admin consent” is required for the application permissions to work. Delegated permissions can work with or without admin consent depending on your tenant settings.
5

Collect Necessary Information

Gather all the configuration values needed for your MCP server and client applications.From your Azure tenant and app registrations, collect:
Important: The OAUTH_AUDIENCE should be just the Application (client) ID of your CalculatorMCPServer (the API), NOT the full api:// URI. Azure tokens contain only the client ID in the aud claim.Example: Use 15a6b7c9-1b09-4e1a-9f38-53db81e18b05 instead of api://15a6b7c9-1b09-4e1a-9f38-53db81e18b05
From these values, construct:OAUTH_ISSUER: https://login.microsoftonline.com/{TENANT_ID}/v2.0OAUTH_WELL_KNOWN_URL: https://login.microsoftonline.com/{TENANT_ID}/v2.0/.well-known/openid-configurationOAUTH_JWKS_URI: Access the well-known URL and find the jwks_uri value (typically: https://login.microsoftonline.com/{TENANT_ID}/discovery/v2.0/keys)TOKEN_ENDPOINT: https://login.microsoftonline.com/{TENANT_ID}/oauth2/v2.0/tokenCUSTOM_SCOPES (for Gateway configuration):
  • api://{API_CLIENT_ID}/calculator.add
  • api://{API_CLIENT_ID}/calculator.subtract
  • offline_access
These custom scopes won’t appear in Azure’s well-known endpoint. You’ll need to manually enter them when configuring the MCP server in the TrueFoundry AI Gateway.

​
FAQ

Machine to Machine Authentication is a type of authentication that allows a machine to authenticate to the MCP server without user interaction. For M2M authentication, you can use the OAuth2 Client Credentials grant type to obtain access tokens directly.
  • Delegated permissions: Used when a user is present. The app acts on behalf of the signed-in user. These require user consent (or admin consent).
  • Application permissions: Used for machine-to-machine scenarios without a signed-in user. These always require admin consent.
For the AI Gateway (user authentication), use delegated permissions. For direct API access (M2M), use application permissions.
When using client credentials flow, Azure Entra ID requires the .default scope format (api://{client-id}/.default). This requests all application permissions that have been pre-consented for your application. You cannot request individual scopes in client credentials flow.
Azure’s /.well-known/openid-configuration endpoint only returns generic OpenID Connect scopes:
  • openid
  • profile
  • email
  • offline_access
Custom API scopes (like api://{client-id}/calculator.add) are:
  1. Defined per app registration in the “Expose an API” section
  2. Granted per client in the “API permissions” section
  3. Not discoverable via the well-known endpoint
This means you must manually configure custom scopes in the TrueFoundry AI Gateway when adding the MCP server. The AI Gateway cannot auto-discover them like it can with Okta’s custom authorization servers.
Key differences:Both work with TrueFoundry AI Gateway, but Azure requires manually entering custom scopes in the AI Gateway configuration.