--- title: "AI Activate - Connecting Microsoft Foundry" slug: "ai-activate-connecting-microsoft-foundry" description: "Learn how to connect Microsoft Foundry to the AI Activate MCP server using OAuth, including manual registration and Azure CLI updates." tags: ["AI Activate", "Configuration"] updated: 2026-10-16T17:55:11Z published: 2026-10-16T17:55:11Z canonical: "docs.nasuni.com/ai-activate-connecting-microsoft-foundry" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.nasuni.com/llms.txt > Use this file to discover all available pages before exploring further. # AI Activate - Connecting Microsoft Foundry ## Overview A Microsoft Foundry agent connects to the AI Activate MCP server via OAuth identity passthrough, so each user signs in with their own Nasuni account. Connecting Foundry takes a few more steps than a client such as Claude or ChatGPT, for two reasons: - Foundry does not support automatic Dynamic Client Registration (DCR), so you register the client with AI Activate manually to obtain a Client ID. - After you create a connection, the Foundry portal does not let you update the connection's OAuth credentials. You use the Azure Resource Manager (ARM) REST API to apply the registered Client ID. Microsoft's article is the authoritative source for Foundry's MCP authentication options and portal steps: [Set up authentication for Model Context Protocol (MCP) tools](https://learn.microsoft.com/en-us/azure/foundry/agents/how-to/mcp-authentication). This guide covers the AI Activate details and the steps that Microsoft's article does not. For background on how manual registration works, see [AI Activate - Connecting an MCP client that does not support DCR](/v1/docs/ai-activate-connecting-nodcr). ## Why Foundry needs extra steps ### The redirect URI loop Registering a client with AI Activate requires the connection's redirect URI. Foundry does not reveal the redirect URI until you save the connection, and saving the connection requires a Client ID. That creates a loop: - You cannot register with AI Activate to get a Client ID until you have the redirect URI. - You cannot get the redirect URI until you save the connection. - You cannot save the connection without a Client ID. You break this loop by saving the connection with a *placeholder* Client ID and Client Secret first. Saving the connection reveals the redirect URI, which you then use to register with AI Activate and obtain the real Client ID. ### The portal can't update OAuth credentials At that point, you reach the second limitation. When you try to update the credentials on the existing connection, the Foundry portal shows: "OAuth doesn't support updating the configuration. You can create a new connection or update to another auth option." Recreating the connection is not a fix. Recreating the connection restarts the loop and can change the redirect URI. A registration with AI Activate can't be changed after you create it, so if the redirect URI changes, the registration no longer matches. Instead, update the credentials on the existing connection by using the ARM REST API. The ARM update keeps the redirect URI that the registration is bound to. The portal restriction is a guard in the user interface only; the underlying API supports the update. ## Prerequisites - A Microsoft Foundry project. - At least one AI Activate volume that is activated and has MCP access turned on. See [Enable MCP Access and Connect your AI tool](/v1/docs/ai-activate-enable-mcp-access-and-connect-your-ai-tool). - Your account's MCP endpoint, copied from the Portal under **AI Activate** → **MCP Server**. See [Get your MCP endpoint](/v1/docs/ai-activate-enable-mcp-access-and-connect-your-ai-tool#get-your-mcp-endpoint). - Your organization's company name, which you enter when you sign in through Nasuni Portal single sign-on. - Assign the people who plan to use AI Activate to the Nasuni connection in your identity provider (Okta or Microsoft Entra ID). - Each person who plans to use the agent must have at least the **Foundry Agent Consumer** role on the project, and their Microsoft Entra tenant must match the project's tenant. See Microsoft's article. - Azure CLI installed and authenticated (`az login`). - PowerShell. - Sufficient permissions on the Foundry resource (Owner, Contributor, Foundry Account Owner, or equivalent). If Azure CLI does not recognize the `az cognitiveservices ... project` commands used below, update Azure CLI. If Azure CLI still does not recognize the commands, add the extension: `az extension add -n cognitiveservices` (see Troubleshooting at the end of this article). ## Step 1: Discover the OAuth endpoints You need the AI Activate OAuth endpoint values to configure the Foundry connection. Follow Step 1 of [AI Activate - Connecting an MCP client that does not support DCR](/v1/docs/ai-activate-connecting-nodcr) to retrieve the values from the server metadata. Use the following values: - MCP server endpoint - Authorization URL - Token URL - Registration endpoint (used in Step 5) Read the values from your own metadata response rather than copying example values. ## Step 2: Create the connection in Foundry with placeholder credentials In the Foundry portal, add AI Activate as an MCP tool and choose **OAuth identity passthrough** with your own OAuth app (custom OAuth), as described in Microsoft's article. Saving the connection generates the redirect URI that you need for registration. Enter the following information: - **MCP server endpoint:** Your account's MCP endpoint from the Portal. - **Auth URL (Authorization URL):** The authorization endpoint from Step 1. - **Token URL:** The token endpoint from Step 1. - **Refresh URL:** The same token endpoint from Step 1. - **Client ID:** Any placeholder value. You replace it in Step 6. - **Client Secret:** Any placeholder value. - **Scopes:** `offline_access`. This scope lets Foundry refresh each person's sign-in automatically, so people are not asked to sign in again when their session expires. Save the connection. > [!NOTE] > ***Important:*** *Choose OAuth identity passthrough. Foundry's other authentication methods give every user of the agent the same identity. AI Activate returns results based on the permissions of the person who signs in, so each person must sign in with their own account.* ## Step 3: Set variables and get an ARM token The remaining steps call the ARM REST API. First, gather the identifiers for your connection, then set the identifiers as variables and obtain an access token. ### Find your resource, project, and connection names The Foundry portal displays the project name at the top. You also need the underlying Foundry resource name and associated resource group, which can differ from the project name. List your Foundry accounts and resource groups: ```powershell az cognitiveservices account list -o table ``` Note the **Name** (account name) and **ResourceGroup** columns for your Foundry account. List the projects on that account to confirm the project name: ```powershell az cognitiveservices account project list --resource-group --name -o table ``` List the connections on the project to find your MCP tool connection name: ```powershell az cognitiveservices account project connection list --resource-group --name --project-name -o table ``` ### Set variables and obtain the token Obtain an ARM access token: ```powershell $ARM_TOKEN = az account get-access-token --resource "https://management.azure.com/" --query accessToken --output tsv ``` Set the connection identifiers, replacing the placeholders with your values: ```powershell $SUBSCRIPTION_ID = "" $RESOURCE_GROUP  = "" $ACCOUNT_NAME    = "" $PROJECT_NAME    = "" $CONNECTION_NAME = "" $CONNECTION_URL = "https://management.azure.com/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.CognitiveServices/accounts/$ACCOUNT_NAME/projects/$PROJECT_NAME/connections/$CONNECTION_NAME" ``` ## Step 4: Retrieve the connection and its redirect URI Retrieve the full connection, including the redirect URI that Foundry assigned: ```powershell curl.exe --silent --show-error --fail `  --request GET `  --header "Authorization: Bearer $ARM_TOKEN" `  "${CONNECTION_URL}?api-version=2026-05-01" ``` In the response, under `properties`: - Find `redirectUrl` and copy the value. You register this exact value with AI Activate in Step 5. The redirect URL has a form similar to `https://global.consent.azure-apim.net/redirect/<unique-id>`. - Confirm that `authType` is `OAuth2` and that `category` is `RemoteTool` to verify that you retrieved the correct connection. - Note the `target`, the OAuth URLs (`authorizationUrl`, `tokenUrl`, `refreshUrl`), and `scopes`. Preserve these values in the update payload in Step 6. The `credentials` field appears as `null` because Azure redacts stored credentials on read. ## Step 5: Register with AI Activate Register the client with AI Activate using the `redirectUrl` from Step 4. Follow Step 3 of [AI Activate - Connecting an MCP client that does not support DCR](/v1/docs/ai-activate-connecting-nodcr). Copy the `client_id` from the response. The response also returns a `client_secret`. Because AI Activate registers the client as a public client that uses PKCE, the Foundry connection does not require the `client_secret`, so you leave the Client Secret empty in the update payload. You do not need the `registration_token` for this procedure. ## Step 6: Build the update payload Create a file named `body.json`. Use the `client_id` from Step 5 for `clientId`, and leave `clientSecret` as an empty string. Fill `target`, `authorizationUrl`, `tokenUrl`, and `refreshUrl` with the values you noted from the Step 4 response, and keep `offline_access` in `scopes`. ```json {  "properties": {    "category": "RemoteTool",    "authType": "OAuth2",    "target": "",    "credentials": {      "clientId": "",      "clientSecret": ""    },    "authorizationUrl": "",    "tokenUrl": "",    "refreshUrl": "",    "scopes": ["offline_access"]  } } ``` > [!NOTE] > ***Important:*** *The ARM endpoint uses create-or-update (PUT) semantics and replaces the entire connection with the submitted payload. Although you change only the Client ID, include all properties. To prevent ARM from erasing required connection properties, preserve* `target`*,* `category`*,* `authType`*, the OAuth URLs, and* `scopes` *from the* *Step 4* *response.* ## Step 7: Apply the update Send the update to ARM. From the directory that contains `body.json`, run the following command: ```powershell curl.exe --silent --show-error --fail `  --request PUT `  --header "Authorization: Bearer $ARM_TOKEN" `  --header "Content-Type: application/json" `  --data-binary "@body.json" `  "${CONNECTION_URL}?api-version=2026-05-01" ``` A successful call returns the updated connection and no error. ## Step 8: Verify Re-run the GET request to confirm that the connection still returns successfully and that the connection properties remain intact: ```powershell curl.exe --silent --show-error --fail `  --request GET `  --header "Authorization: Bearer $ARM_TOKEN" `  "${CONNECTION_URL}?api-version=2026-05-01" ``` Because Azure continues to redact the `credentials` field as `null`, test the connection in Step 9 for the definitive functional check. ## Step 9: Test the connection 1. Return to the Foundry portal and test the MCP tool. When prompted, sign in through Nasuni Portal single sign-on with your organization's company name and your own account. 2. Turn off approval for the AI Activate tools. By default, Foundry asks for approval before every MCP tool call. AI Activate only reads your files, so approval adds a stop to every query without protecting against any change. In the agent's MCP tool configuration, set `require_approval` to `never`. 3. Test with a second person who has different file permissions. Confirm they are prompted to sign in and that their results reflect their permissions rather than yours. If you call the agent from your own application, the first response for each new user includes a consent link. Your application must show that link so the user can sign in. See the OAuth identity passthrough section of Microsoft's article. ## Things to know - Each tool call the agent makes to AI Activate counts as one Activate Query, and a single question can trigger several calls. For more information, see [Monitor Your Usage](/v1/docs/ai-activate-monitor-your-usage). - For sign-in problems or missing results that aren't specific to Foundry, see [AI Activate - Troubleshooting](/v1/docs/ai-activate-troubleshooting). ## Troubleshooting `curl` **behaves unexpectedly in PowerShell.** In Windows PowerShell, `curl` is an alias for `Invoke-WebRequest`, which does not accept curl's flags. Use `curl.exe` (as shown above) to call the real curl. **PowerShell line continuation.** In PowerShell (including Azure Cloud Shell), end each line with a backtick (the key to the left of 1 on a US keyboard) to continue a command on the next line. Do not use a backslash (`\`). Alternatively, put the whole command on one line. **A GET or PUT returns 401 Unauthorized.** The ARM token might have expired. Re-run the token command in Step 3 to refresh `$ARM_TOKEN` then retry. **A request fails with an api-version error.** Confirm the `api-version` value. This guide uses API version `2026-05-01`. If your environment requires a different version, adjust it in the GET and PUT URLs. **"Resource group could not be found."** The resource group name might differ from what you expect. Run `az group list -o table` to list all resource groups in your subscription, or run `az cognitiveservices account list -o table` to find the resource group for your Foundry resource. `az cognitiveservices ... project` **commands not recognized.** The `project` subcommands require a current Azure CLI. If Azure CLI does not recognize the commands, update Azure CLI. If Azure CLI still does not recognize the commands, add the extension: ```plaintext az extension add -n cognitiveservices ``` **A command fails because the resource provider is not registered.** If a command fails with a provider registration error, register the Microsoft.CognitiveServices provider on your subscription, then retry: ```plaintext az provider register --namespace Microsoft.CognitiveServices ``` Registration can take a few minutes to complete. **Sign-in fails after updating credentials (redirect URI mismatch).** Confirm that the redirect URI you registered in Step 5 matches the `redirectUrl` that the connection currently shows, character for character. If the redirect URI has changed, register again (Step 5) to obtain a Client ID bound to the new URI, then update the connection again (Step 6 and Step 7). **People are asked to sign in again after a while.** Confirm that the connection's scopes include `offline_access`. Re-run the GET request in Step 4 and check `scopes`. If `offline_access` is missing, add it to `body.json` and repeat Step 7. **The agent stops and asks for approval before each AI Activate call.** The tool's `require_approval` setting is still at Foundry's default. Set it to `never`, as described in Step 9.