AI Activate - Connecting Microsoft Foundry

  • Updated on Oct 16, 2026
  • Published on Jul 8, 2026
  • 9 minute(s) read
  • ED
  • CD
  • PG
 Prev Next

Overview

A Microsoft Foundry agent connects to the AI Activate MCP server via OAuth identity passthrough, so each user signs in with their own Nasuni account. Connecting Foundry takes a few more steps than a client such as Claude or ChatGPT, for two reasons:

  • Foundry does not support automatic Dynamic Client Registration (DCR), so you register the client with AI Activate manually to obtain a Client ID.

  • After you create a connection, the Foundry portal does not let you update the connection's OAuth credentials. You use the Azure Resource Manager (ARM) REST API to apply the registered Client ID.

Microsoft's article is the authoritative source for Foundry's MCP authentication options and portal steps: Set up authentication for Model Context Protocol (MCP) tools. This guide covers the AI Activate details and the steps that Microsoft's article does not. For background on how manual registration works, see AI Activate - Connecting an MCP client that does not support DCR.

Why Foundry needs extra steps

The redirect URI loop

Registering a client with AI Activate requires the connection's redirect URI. Foundry does not reveal the redirect URI until you save the connection, and saving the connection requires a Client ID. That creates a loop:

  • You cannot register with AI Activate to get a Client ID until you have the redirect URI.

  • You cannot get the redirect URI until you save the connection.

  • You cannot save the connection without a Client ID.

You break this loop by saving the connection with a placeholder Client ID and Client Secret first. Saving the connection reveals the redirect URI, which you then use to register with AI Activate and obtain the real Client ID.

The portal can't update OAuth credentials

At that point, you reach the second limitation. When you try to update the credentials on the existing connection, the Foundry portal shows:

"OAuth doesn't support updating the configuration. You can create a new connection or update to another auth option."

Recreating the connection is not a fix. Recreating the connection restarts the loop and can change the redirect URI. A registration with AI Activate can't be changed after you create it, so if the redirect URI changes, the registration no longer matches. Instead, update the credentials on the existing connection by using the ARM REST API. The ARM update keeps the redirect URI that the registration is bound to. The portal restriction is a guard in the user interface only; the underlying API supports the update.

Prerequisites

  • A Microsoft Foundry project.

  • At least one AI Activate volume that is activated and has MCP access turned on. See Enable MCP Access and Connect your AI tool.

  • Your account's MCP endpoint, copied from the Portal under AI Activate → MCP Server. See Get your MCP endpoint.

  • Your organization's company name, which you enter when you sign in through Nasuni Portal single sign-on.

  • Assign the people who plan to use AI Activate to the Nasuni connection in your identity provider (Okta or Microsoft Entra ID).

  • Each person who plans to use the agent must have at least the Foundry Agent Consumer role on the project, and their Microsoft Entra tenant must match the project's tenant. See Microsoft's article.

  • Azure CLI installed and authenticated (az login).

  • PowerShell.

  • Sufficient permissions on the Foundry resource (Owner, Contributor, Foundry Account Owner, or equivalent).

If Azure CLI does not recognize the az cognitiveservices ... project commands used below, update Azure CLI. If Azure CLI still does not recognize the commands, add the extension: az extension add -n cognitiveservices (see Troubleshooting at the end of this article).

Step 1: Discover the OAuth endpoints

You need the AI Activate OAuth endpoint values to configure the Foundry connection. Follow Step 1 of AI Activate - Connecting an MCP client that does not support DCR to retrieve the values from the server metadata.

Use the following values:

  • MCP server endpoint

  • Authorization URL

  • Token URL

  • Registration endpoint (used in Step 5)

Read the values from your own metadata response rather than copying example values.

Step 2: Create the connection in Foundry with placeholder credentials

In the Foundry portal, add AI Activate as an MCP tool and choose OAuth identity passthrough with your own OAuth app (custom OAuth), as described in Microsoft's article. Saving the connection generates the redirect URI that you need for registration.

Enter the following information:

  • MCP server endpoint: Your account's MCP endpoint from the Portal.

  • Auth URL (Authorization URL): The authorization endpoint from Step 1.

  • Token URL: The token endpoint from Step 1.

  • Refresh URL: The same token endpoint from Step 1.

  • Client ID: Any placeholder value. You replace it in Step 6.

  • Client Secret: Any placeholder value.

  • Scopes: offline_access. This scope lets Foundry refresh each person's sign-in automatically, so people are not asked to sign in again when their session expires.

Save the connection.

Important: Choose OAuth identity passthrough. Foundry's other authentication methods give every user of the agent the same identity. AI Activate returns results based on the permissions of the person who signs in, so each person must sign in with their own account.

Step 3: Set variables and get an ARM token

The remaining steps call the ARM REST API. First, gather the identifiers for your connection, then set the identifiers as variables and obtain an access token.

Find your resource, project, and connection names

The Foundry portal displays the project name at the top. You also need the underlying Foundry resource name and associated resource group, which can differ from the project name.

List your Foundry accounts and resource groups:

az cognitiveservices account list -o table

Note the Name (account name) and ResourceGroup columns for your Foundry account.

List the projects on that account to confirm the project name:

az cognitiveservices account project list --resource-group <resource-group> --name <resource-name> -o table

List the connections on the project to find your MCP tool connection name:

az cognitiveservices account project connection list --resource-group <resource-group> --name <resource-name> --project-name <project-name> -o table

Set variables and obtain the token

Obtain an ARM access token:

$ARM_TOKEN = az account get-access-token --resource "https://management.azure.com/" --query accessToken --output tsv

Set the connection identifiers, replacing the placeholders with your values:

$SUBSCRIPTION_ID = "<Azure subscription ID>"
$RESOURCE_GROUP  = "<resource group name>"
$ACCOUNT_NAME    = "<Foundry resource name>"
$PROJECT_NAME    = "<Foundry project name>"
$CONNECTION_NAME = "<MCP connection name>"
$CONNECTION_URL = "https://management.azure.com/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.CognitiveServices/accounts/$ACCOUNT_NAME/projects/$PROJECT_NAME/connections/$CONNECTION_NAME"

Step 4: Retrieve the connection and its redirect URI

Retrieve the full connection, including the redirect URI that Foundry assigned:

curl.exe --silent --show-error --fail `
  --request GET `
  --header "Authorization: Bearer $ARM_TOKEN" `
  "${CONNECTION_URL}?api-version=2026-05-01"

In the response, under properties:

  • Find redirectUrl and copy the value. You register this exact value with AI Activate in Step 5. The redirect URL has a form similar to https://global.consent.azure-apim.net/redirect/<unique-id>.

  • Confirm that authType is OAuth2 and that category is RemoteTool to verify that you retrieved the correct connection.

  • Note the target, the OAuth URLs (authorizationUrl, tokenUrl, refreshUrl), and scopes. Preserve these values in the update payload in Step 6.

The credentials field appears as null because Azure redacts stored credentials on read.

Step 5: Register with AI Activate

Register the client with AI Activate using the redirectUrl from Step 4. Follow Step 3 of AI Activate - Connecting an MCP client that does not support DCR.

Copy the client_id from the response. The response also returns a client_secret. Because AI Activate registers the client as a public client that uses PKCE, the Foundry connection does not require the client_secret, so you leave the Client Secret empty in the update payload. You do not need the registration_token for this procedure.

Step 6: Build the update payload

Create a file named body.json. Use the client_id from Step 5 for clientId, and leave clientSecret as an empty string. Fill target, authorizationUrl, tokenUrl, and refreshUrl with the values you noted from the Step 4 response, and keep offline_access in scopes.

{
  "properties": {
    "category": "RemoteTool",
    "authType": "OAuth2",
    "target": "<mcp-server-endpoint>",
    "credentials": {
      "clientId": "<client-id-from-step-5>",
      "clientSecret": ""
    },
    "authorizationUrl": "<authorization-url>",
    "tokenUrl": "<token-url>",
    "refreshUrl": "<refresh-url>",
    "scopes": ["offline_access"]
  }
}

Important: The ARM endpoint uses create-or-update (PUT) semantics and replaces the entire connection with the submitted payload. Although you change only the Client ID, include all properties. To prevent ARM from erasing required connection properties, preserve target, category, authType, the OAuth URLs, and scopes from the Step 4 response.

Step 7: Apply the update

Send the update to ARM. From the directory that contains body.json, run the following command:

curl.exe --silent --show-error --fail `
  --request PUT `
  --header "Authorization: Bearer $ARM_TOKEN" `
  --header "Content-Type: application/json" `
  --data-binary "@body.json" `
  "${CONNECTION_URL}?api-version=2026-05-01"

A successful call returns the updated connection and no error.

Step 8: Verify

Re-run the GET request to confirm that the connection still returns successfully and that the connection properties remain intact:

curl.exe --silent --show-error --fail `
  --request GET `
  --header "Authorization: Bearer $ARM_TOKEN" `
  "${CONNECTION_URL}?api-version=2026-05-01"

Because Azure continues to redact the credentials field as null, test the connection in Step 9 for the definitive functional check.

Step 9: Test the connection

  1. Return to the Foundry portal and test the MCP tool. When prompted, sign in through Nasuni Portal single sign-on with your organization's company name and your own account.

  2. Turn off approval for the AI Activate tools. By default, Foundry asks for approval before every MCP tool call. AI Activate only reads your files, so approval adds a stop to every query without protecting against any change. In the agent's MCP tool configuration, set require_approval to never.

  3. Test with a second person who has different file permissions. Confirm they are prompted to sign in and that their results reflect their permissions rather than yours.

If you call the agent from your own application, the first response for each new user includes a consent link. Your application must show that link so the user can sign in. See the OAuth identity passthrough section of Microsoft's article.

Things to know

  • Each tool call the agent makes to AI Activate counts as one Activate Query, and a single question can trigger several calls. For more information, see Monitor Your Usage.

  • For sign-in problems or missing results that aren't specific to Foundry, see AI Activate - Troubleshooting.

Troubleshooting

curl behaves unexpectedly in PowerShell. In Windows PowerShell, curl is an alias for Invoke-WebRequest, which does not accept curl's flags. Use curl.exe (as shown above) to call the real curl.

PowerShell line continuation. In PowerShell (including Azure Cloud Shell), end each line with a backtick (the key to the left of 1 on a US keyboard) to continue a command on the next line. Do not use a backslash (\). Alternatively, put the whole command on one line.

A GET or PUT returns 401 Unauthorized. The ARM token might have expired. Re-run the token command in Step 3 to refresh $ARM_TOKEN then retry.

A request fails with an api-version error. Confirm the api-version value. This guide uses API version 2026-05-01. If your environment requires a different version, adjust it in the GET and PUT URLs.

"Resource group could not be found." The resource group name might differ from what you expect. Run az group list -o table to list all resource groups in your subscription, or run az cognitiveservices account list -o table to find the resource group for your Foundry resource.

az cognitiveservices ... project commands not recognized. The project subcommands require a current Azure CLI. If Azure CLI does not recognize the commands, update Azure CLI. If Azure CLI still does not recognize the commands, add the extension:

az extension add -n cognitiveservices

A command fails because the resource provider is not registered. If a command fails with a provider registration error, register the Microsoft.CognitiveServices provider on your subscription, then retry:

az provider register --namespace Microsoft.CognitiveServices

Registration can take a few minutes to complete.

Sign-in fails after updating credentials (redirect URI mismatch). Confirm that the redirect URI you registered in Step 5 matches the redirectUrl that the connection currently shows, character for character. If the redirect URI has changed, register again (Step 5) to obtain a Client ID bound to the new URI, then update the connection again (Step 6 and Step 7).

People are asked to sign in again after a while. Confirm that the connection's scopes include offline_access. Re-run the GET request in Step 4 and check scopes. If offline_access is missing, add it to body.json and repeat Step 7.

The agent stops and asks for approval before each AI Activate call. The tool's require_approval setting is still at Foundry's default. Set it to never, as described in Step 9.

Related articles