ceos/fastmcp
1
0
Fork 0
mirror of https://github.com/PrefectHQ/fastmcp.git synced 2026-08-10 07:39:10 +02:00
Code Issues Projects Releases Packages Wiki Activity
fastmcp/examples/auth/azure_oauth
History
Exact
Jeremiah Lowin ba47db9b8c
 Fix Azure scope validation (#2269) 
* Update docs for required scopes

* add scopes

* Fix Azure scope validation

Azure returns unprefixed scopes in JWT tokens but requires prefixed scopes in authorization requests. The previous implementation incorrectly validated tokens against prefixed scopes, causing "invalid_token" errors.

Simplified AzureProvider to use standard JWTVerifier with unprefixed scopes for validation. Scopes are only prefixed when building the Azure authorization URL via _build_upstream_authorize_url() override.

Closes #2263
2025-10-26 11:41:22 -04:00
..
client.py Add WorkOS and Azure OAuth providers (#1550) 2025-08-20 16:22:03 -04:00
README.md Add WorkOS and Azure OAuth providers (#1550) 2025-08-20 16:22:03 -04:00
server.py Fix Azure scope validation (#2269) 2025-10-26 11:41:22 -04:00

README.md

Azure (Microsoft Entra) OAuth Example

This example demonstrates how to use the Azure OAuth provider with FastMCP servers.

Setup

1. Azure App Registration

  1. Go to Azure Portal → App registrations
  2. Click "New registration" and configure:
    • Name: Your app name
    • Supported account types: Choose based on your needs
    • Redirect URI: http://localhost:8000/auth/callback (Web platform)
  3. After creation, go to "Certificates & secrets" → "New client secret"
  4. Note these values from the Overview page:
    • Application (client) ID
    • Directory (tenant) ID

2. Environment Variables

Create a .env file:

# Required
AZURE_CLIENT_ID=your-application-client-id
AZURE_CLIENT_SECRET=your-client-secret-value
AZURE_TENANT_ID=your-tenant-id  # From Azure Portal Overview page

3. Run the Example

Start the server:

uv run python server.py

Test with client:

uv run python client.py

Tenant Configuration

The tenant_id parameter is required and controls which accounts can authenticate:

  • Your tenant ID: Single organization (most common)
  • organizations: Any work/school account
  • consumers: Personal Microsoft accounts only