--- title: "AI Activate - Connecting Microsoft Foundry" slug: "ai-activate-connecting-microsoft-foundry" description: "Learn how to connect Microsoft Foundry to the AI Activate MCP server using OAuth, including manual registration and Azure CLI updates." tags: ["AI Activate", "Configuration"] updated: 2026-10-01T16:04:13Z published: 2026-10-01T16:04:13Z canonical: "docs.nasuni.com/ai-activate-connecting-microsoft-foundry" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.nasuni.com/llms.txt > Use this file to discover all available pages before exploring further. # AI Activate - Connecting Microsoft Foundry ## Overview Microsoft Foundry connects to the AI Activate MCP server over OAuth. Connecting Foundry takes a few more steps than a client such as Claude or ChatGPT, for two reasons: - Foundry does not support automatic Dynamic Client Registration (DCR), so you register the client with AI Activate manually to obtain a Client ID. - After you create a connection, Foundry does not let you update the connection's OAuth credentials in the portal. Use the Azure Resource Manager (ARM) REST API to apply the registered Client ID. This guide covers the full Foundry connection process. For the client-agnostic background on how AI Activate uses OAuth and how manual registration works, see [Connecting an MCP client that does not support DCR](/v1/docs/ai-activate-connecting-nodcr). For the two steps that are the same for every client, this guide refers to [Connecting an MCP client that does not support DCR](/v1/docs/ai-activate-connecting-nodcr). ## Why Foundry needs extra steps ### Reason #1 Registering a client with AI Activate requires the connection's redirect URI. Foundry does not reveal the redirect URI until you save the connection, and saving the connection requires a Client ID. That creates a loop: - You cannot register with AI Activate to get a Client ID until you have the redirect URI. - You cannot get the redirect URI until you save the connection. - You cannot save the connection without a Client ID. You break this loop by saving the connection with a *placeholder* Client ID and Client Secret first. Saving the connection reveals the redirect URI and enables registration with AI Activate to obtain the real Client ID. ### Reason #2 At that point, you reach the second limitation. When you try to update the credentials on the existing connection, the Foundry portal shows: > "OAuth doesn't support updating the configuration. You can create a new connection or update to another auth option." However, recreating the connection is not a fix. Recreating the connection only restarts the loop and can change the redirect URI. If the redirect URI changes, the completed registration becomes invalid. Instead, update the credentials on the existing connection by using the ARM REST API. The ARM update retains the redirect URI associated with the registration. The portal restriction is a UI-level guard only; the underlying API supports the update. ## Prerequisites - A Microsoft Foundry project. - The AI Activate MCP server endpoint. - Azure CLI installed and authenticated (`az login`). - PowerShell. - Sufficient permissions on the Foundry resource (Owner, Contributor, Foundry Account Owner, or equivalent). If Azure CLI does not recognize the `az cognitiveservices ... project` commands used below, update Azure CLI. If Azure CLI still does not recognize the commands, add the extension: `az extension add -n cognitiveservices` (see [Troubleshooting](/v1/docs/ai-activate-connecting-microsoft-foundry#troubleshooting1)). ## Step 1: Discover the OAuth endpoints You need the AI Activate OAuth endpoint values to configure the Foundry connection. Follow Step 1 of [Connecting an MCP client that does not support DCR](/v1/docs/ai-activate-connecting-nodcr) to retrieve the endpoint values from the server metadata. Use the following values: - MCP server endpoint (the base URL) - Authorization URL - Token URL - Registration endpoint (used in [Step 5](/v1/docs/ai-activate-connecting-microsoft-foundry#step-5-register-with-ai-activate)) Because the values can change between environments, read the endpoint values from the live metadata response rather than hard-coding the values. ## Step 2: Create the connection in Foundry with placeholder credentials Create the MCP tool connection in Foundry to generate a redirect URI. Enter the endpoint values from [Step 1](/v1/docs/ai-activate-connecting-microsoft-foundry#step-1-discover-the-oauth-endpoints1), and use any placeholder string for the Client ID and Client Secret for now. You replace the placeholder Client ID in [Step 5](/v1/docs/ai-activate-connecting-microsoft-foundry#step-5-register-with-ai-activate). Enter the following: - **MCP server endpoint:** the base URL from [Step 1](/v1/docs/ai-activate-connecting-microsoft-foundry#step-1-discover-the-oauth-endpoints1) - **Authorization URL:** from [Step 1](/v1/docs/ai-activate-connecting-microsoft-foundry#step-1-discover-the-oauth-endpoints1) - **Token URL:** from [Step 1](/v1/docs/ai-activate-connecting-microsoft-foundry#step-1-discover-the-oauth-endpoints1) - **Client ID:** any placeholder value - **Client Secret:** any placeholder value - **Scopes:** leave blank Save the connection. ## Step 3: Set variables and get an ARM token The remaining steps call the ARM REST API. First, gather the identifiers for your connection, then set the identifiers as variables and obtain an access token. ### Find your resource, project, and connection names The Foundry portal displays the project name at the top. You also need the underlying Foundry resource name and associated resource group, which can differ from the project name. List your Foundry accounts and resource groups: ```powershell az cognitiveservices account list -o table ``` Note the **Name** (account name) and **ResourceGroup** columns for your Foundry account. List the projects on that account to confirm the project name: ```powershell az cognitiveservices account project list --resource-group --name -o table ``` List the connections on the project to find your MCP tool connection name: ```powershell az cognitiveservices account project connection list --resource-group --name --project-name -o table ``` ### Set variables and obtain the token Obtain an ARM access token: ```powershell $ARM_TOKEN = az account get-access-token --resource "https://management.azure.com/" --query accessToken --output tsv ``` Set the connection identifiers, replacing the placeholders with your values: ```powershell $SUBSCRIPTION_ID = "" $RESOURCE_GROUP  = "" $ACCOUNT_NAME    = "" $PROJECT_NAME    = "" $CONNECTION_NAME = "" $CONNECTION_URL = "https://management.azure.com/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.CognitiveServices/accounts/$ACCOUNT_NAME/projects/$PROJECT_NAME/connections/$CONNECTION_NAME" ``` ## Step 4: Retrieve the connection and its redirect URI Retrieve the full connection, including the redirect URI that Foundry assigned: ```powershell curl.exe --silent --show-error --fail `  --request GET `  --header "Authorization: Bearer $ARM_TOKEN" `  "${CONNECTION_URL}?api-version=2026-05-01" ``` In the response, under `properties`: - Find `redirectUrl` and copy the value. You register this exact value with AI Activate in [Step 5](/v1/docs/ai-activate-connecting-microsoft-foundry#step-5-register-with-ai-activate). In this environment the redirect URL has the form `https://global.consent.azure-apim.net/redirect/<unique-id>`. - Confirm that `authType` is `OAuth2` and that `category` is `RemoteTool` to verify that you retrieved the correct connection.. - Note the `target` and the OAuth URLs (`authorizationUrl`, `tokenUrl`, `refreshUrl`). Preserve these values in the update payload in [Step 6](/v1/docs/ai-activate-connecting-microsoft-foundry#step-6-build-the-update-payload). The `credentials` field appears as `null` because Azure redacts stored credentials on read. Azure redaction of stored credentials is expected. ## Step 5: Register with AI Activate Register the client with AI Activate using the `redirectUrl` from [Step 4](/v1/docs/ai-activate-connecting-microsoft-foundry#step-4-retrieve-the-connection-and-its-redirect-uri). Follow Step 3 of [Connecting an MCP client that does not support DCR](/v1/docs/ai-activate-connecting-nodcr). Copy the `client_id` from the response. The response also returns a client_secret. Because AI Activate registers the client as a public client that uses PKCE, the Foundry connection does not require the client_secret. Leave the Client Secret empty in the update payload. You do not need `registration_token` for this procedure. ## Step 6: Build the update payload Create a file named `body.json`. Use the `client_id` from [Step 5](/v1/docs/ai-activate-connecting-microsoft-foundry#step-5-register-with-ai-activate) for `clientId`, and leave `clientSecret` as an empty string. Fill `target`, `authorizationUrl`, `tokenUrl`, and `refreshUrl` with the values you noted from the [Step 4](/v1/docs/ai-activate-connecting-microsoft-foundry#step-4-retrieve-the-connection-and-its-redirect-uri) response. ```json {  "properties": {    "category": "RemoteTool",    "authType": "OAuth2",    "target": "",    "credentials": {      "clientId": "",      "clientSecret": ""    },    "authorizationUrl": "",    "tokenUrl": "",    "refreshUrl": "",    "scopes": []  } } ``` > [!WARNING] > ***Important:*** *The ARM endpoint uses create-or-update (PUT) semantics and replaces the entire connection with the submitted payload. Although you change only the Client ID, include all properties. To prevent ARM from erasing required connection properties, preserve* `target`*,* `category`*,* `authType`*, and the OAuth URLs from the* [*Step 4*](/v1/docs/ai-activate-connecting-microsoft-foundry#step-4-retrieve-the-connection-and-its-redirect-uri) *response.* ## Step 7: Apply the update Send the update to ARM. From the directory that contains `body.json`, run the following command: ```powershell curl.exe --silent --show-error --fail `  --request PUT `  --header "Authorization: Bearer $ARM_TOKEN" `  --header "Content-Type: application/json" `  --data-binary "@body.json" `  "${CONNECTION_URL}?api-version=2026-05-01" ``` A successful call returns the updated connection and no error. ## Step 8: Verify Re-run the GET request to confirm that the connection still returns successfully and that the connection properties remain intact: ```powershell curl.exe --silent --show-error --fail `  --request GET `  --header "Authorization: Bearer $ARM_TOKEN" `  "${CONNECTION_URL}?api-version=2026-05-01" ``` Because Azure continues to redact the `credentials` field as `null` , test the connection in [Step 9](/v1/docs/ai-activate-connecting-microsoft-foundry#step-9-test-the-connection) to complete the definitive functional check. ## Step 9: Test the connection Return to the Foundry portal and test the MCP tool. Complete the OAuth sign-in when prompted. ## Troubleshooting `curl` **behaves unexpectedly in PowerShell.** In Windows PowerShell, `curl` is an alias for `Invoke-WebRequest`, which does not accept curl's flags. Use `curl.exe` (as shown above) to call the real curl. **PowerShell line continuation.** In PowerShell (including Azure Cloud Shell), use a backtick (```) for line continuation rather than a backslash (`\`), or put the whole command on one line. **A GET or PUT returns 401 Unauthorized.** The ARM token might have expired. Re-run the token command in [Step 3](/v1/docs/ai-activate-connecting-microsoft-foundry#step-3-set-variables-and-get-an-arm-token1) to refresh `$ARM_TOKEN`, then retry. **A request fails with an api-version error.** Confirm the `api-version` value. This guide uses API version `2026-05-01`. If your environment requires a different version, adjust it in the GET and PUT URLs. **"Resource group could not be found."** The resource group name might differ from what you expect. Run `az group list -o table` to list all resource groups in your subscription, or run `az cognitiveservices account list -o table` to find the resource group for your Foundry resource. `az cognitiveservices ... project` **commands not recognized.** The `project` subcommands require a current Azure CLI. If Azure CLI does not recognize the commands, update Azure CLI. If Azure CLI still does not recognize the commands, add the extension: ```plaintext az extension add -n cognitiveservices ``` **A command fails because the resource provider is not registered.** If a command fails with a provider registration error, register the Microsoft.CognitiveServices provider on your subscription, then retry: ```plaintext az provider register --namespace Microsoft.CognitiveServices ``` Registration can take a few minutes to complete. **Sign-in fails after updating credentials (redirect URI mismatch).** Confirm that the redirect URI you registered in [Step 5](/v1/docs/ai-activate-connecting-microsoft-foundry#step-5-register-with-ai-activate) matches the `redirectUrl` that the connection currently shows, byte for byte. If the redirect URI has changed, register again ([Step 5](/v1/docs/ai-activate-connecting-microsoft-foundry#step-5-register-with-ai-activate)) to obtain a Client ID bound to the new URI, then update the connection again ([Step 6](/v1/docs/ai-activate-connecting-microsoft-foundry#step-6-build-the-update-payload) and [Step 7](/v1/docs/ai-activate-connecting-microsoft-foundry#step-7-apply-the-update)).