mirror of
https://github.com/PrefectHQ/fastmcp.git
synced 2026-08-09 15:19:10 +02:00
4d22d9c4d7Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
76 lines
2.9 KiB
Text
76 lines
2.9 KiB
Text
---
|
|
title: azure
|
|
sidebarTitle: azure
|
|
---
|
|
|
|
# `fastmcp.server.auth.providers.azure`
|
|
|
|
|
|
Azure (Microsoft Entra) OAuth provider for FastMCP.
|
|
|
|
This provider implements Azure/Microsoft Entra ID OAuth authentication
|
|
using the OAuth Proxy pattern for non-DCR OAuth flows.
|
|
|
|
|
|
## Classes
|
|
|
|
### `AzureProviderSettings` <sup><a href="https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/server/auth/providers/azure.py#L34" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
|
|
|
|
|
|
Settings for Azure OAuth provider.
|
|
|
|
|
|
### `AzureProvider` <sup><a href="https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/server/auth/providers/azure.py#L67" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
|
|
|
|
|
|
Azure (Microsoft Entra) OAuth provider for FastMCP.
|
|
|
|
This provider implements Azure/Microsoft Entra ID authentication using the
|
|
OAuth Proxy pattern. It supports both organizational accounts and personal
|
|
Microsoft accounts depending on the tenant configuration.
|
|
|
|
Scope Handling:
|
|
- required_scopes: Provide unprefixed scope names (e.g., ["read", "write"])
|
|
→ Automatically prefixed with identifier_uri during initialization
|
|
→ Validated on all tokens and advertised to MCP clients
|
|
- additional_authorize_scopes: Provide full format (e.g., ["User.Read"])
|
|
→ NOT prefixed, NOT validated, NOT advertised to clients
|
|
→ Used to request Microsoft Graph or other upstream API permissions
|
|
|
|
Features:
|
|
- OAuth proxy to Azure/Microsoft identity platform
|
|
- JWT validation using tenant issuer and JWKS
|
|
- Supports tenant configurations: specific tenant ID, "organizations", or "consumers"
|
|
- Custom API scopes and Microsoft Graph scopes in a single provider
|
|
|
|
Setup:
|
|
1. Create an App registration in Azure Portal
|
|
2. Configure Web platform redirect URI: http://localhost:8000/auth/callback (or your custom path)
|
|
3. Add an Application ID URI under "Expose an API" (defaults to api://{client_id})
|
|
4. Add custom scopes (e.g., "read", "write") under "Expose an API"
|
|
5. Set access token version to 2 in the App manifest: "requestedAccessTokenVersion": 2
|
|
6. Create a client secret
|
|
7. Get Application (client) ID, Directory (tenant) ID, and client secret
|
|
|
|
|
|
**Methods:**
|
|
|
|
#### `authorize` <sup><a href="https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/server/auth/providers/azure.py#L312" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
|
|
|
|
```python
|
|
authorize(self, client: OAuthClientInformationFull, params: AuthorizationParams) -> str
|
|
```
|
|
|
|
Start OAuth transaction and redirect to Azure AD.
|
|
|
|
Override parent's authorize method to filter out the 'resource' parameter
|
|
which is not supported by Azure AD v2.0 endpoints. The v2.0 endpoints use
|
|
scopes to determine the resource/audience instead of a separate parameter.
|
|
|
|
**Args:**
|
|
- `client`: OAuth client information
|
|
- `params`: Authorization parameters from the client
|
|
|
|
**Returns:**
|
|
- Authorization URL to redirect the user to Azure AD
|
|
|