fix(MCP): Fix ManagedServiceIdentity auth for MCP connections

[rllyy97]

Commit Type

• feature - New functionality
• fix - Bug fix
• refactor - Code restructuring without behavior change
• perf - Performance improvement
• docs - Documentation update
• test - Test-related changes
• chore - Maintenance/tooling

Risk Level

• Low - Minor changes, limited scope
• Medium - Moderate changes, some user impact
• High - Major changes, significant user/system impact

What & Why

Completes fix for #9205 — MCP connections using ManagedServiceIdentity auth in Consumption SKU. This PR adds identity threading to ensure the user-selected managed identity is correctly passed through all dynamic values requests.

Original Issue (#9205): Consumption MCP connections were missing the identity field in the listMcpTools API request, causing failures for user-assigned managed identity scenarios.

This PR Adds: Identity threading through the dynamic values pipeline to ensure consistency with Standard SKU:

1. Designer-v2 getListDynamicValues extracts the selected identity from connectionReference.connectionProperties.authentication.identity
2. Identity is threaded through queries/connector.ts to the ConnectorService layer
3. Both Consumption and Standard connector implementations use the passed identity (if provided) instead of always picking the first user-assigned identity from WorkflowService
4. This ensures the user-selected identity is used for all MCP operations, not just initial connection setup

Impact of Change

• Users: Consumption workflows using MCP connectors with user-assigned managed identity will now correctly send the user-selected identity in all listMcpTools and dynamic values requests, ensuring consistent tool discovery and parameters.
• Developers:
  • ConnectorService interface now accepts optional identity parameter in getListDynamicValues
  • Designer-v2 correctly threads identity through the dynamic values pipeline
  • Designer-v1 remains unchanged to minimize risk
• System: No architectural changes. Identity threading uses existing Redux state (connectionReference) and ConnectorService infrastructure.

Test Plan

• Unit tests added/updated
• E2E tests added/updated
• Manual testing completed

Updated connector tests with InitWorkflowService mock for managed identity scenarios. All existing tests pass:

• connector.spec.ts: 68 tests pass (38 Consumption + 30 Standard)
• dynamicdata.spec.ts (designer-v2): 8 tests pass
• dynamicdata.spec.ts (designer-v1): 8 tests pass

Contributors

Screenshots/Videos

N/A — no visual changes.

[github-actions]

🤖 AI PR Validation Report

PR Review Results

Thank you for your submission! Here's detailed feedback on your PR title and body compliance:

✅ PR Title

• Current: fix(MCP): Fix ManagedServiceIdentity auth for MCP connections
• Issue: None — the title is clear, scoped, and describes the behavior change well.
• Recommendation: No change needed.

---

✅ Commit Type

• Properly selected (fix).
• Only one commit type is checked, which is correct.

---

✅ Risk Level

• The selected risk level (Medium) matches the scope of the code change overall. I would not advise a higher risk level based on the diff.

---

✅ What & Why

• Current: The section clearly explains the issue, the fix, and the reasoning behind identity threading.
• Issue: None.
• Recommendation: No change needed.

---

✅ Impact of Change

• The impact section is specific and aligned with the diff.
• Recommendation:
  • Users: Correctly describes the user impact for Consumption MCP connections.
  • Developers: Good summary of interface and pipeline changes.
  • System: No additional system concerns identified from the diff.

---

✅ Test Plan

• Unit tests are added/updated in the diff, which satisfies the test-plan requirement.
• Manual testing is also noted. No E2E tests are required for this PR to pass review.

---

✅ Contributors

• Blank, but this is allowed and does not block the PR.
• Recommendation: Optional: add contributors if anyone assisted with design, implementation, or review.

---

✅ Screenshots/Videos

• Marked as N/A, which is appropriate because there are no visual changes.

---

Summary Table

Section	Status	Recommendation
Title	✅	No change needed
Commit Type	✅	No change needed
Risk Level	✅	No change needed
What & Why	✅	No change needed
Impact of Change	✅	No change needed
Test Plan	✅	No change needed
Contributors	✅	Optional: add contributors if applicable
Screenshots/Videos	✅	No change needed

---

This PR passes review for title and body compliance.

---

Last updated: Tue, 26 May 2026 16:42:58 GMT

[github-actions]

📊 Coverage Check

The following changed files need attention:

⚠️ libs/designer-v2/src/lib/core/queries/connector.ts - 53% covered (needs improvement)
⚠️ libs/designer-v2/src/lib/core/utils/parameters/dynamicdata.ts - 51% covered (needs improvement)
⚠️ libs/logic-apps-shared/src/designer-client-services/lib/consumption/connector.ts - 70% covered (needs improvement)
⚠️ libs/logic-apps-shared/src/designer-client-services/lib/standard/connector.ts - 63% covered (needs improvement)

Please add tests for the uncovered files before merging.

[Copilot]

Pull request overview

This PR fixes Consumption SKU MCP tool discovery failures when using ManagedServiceIdentity authentication by ensuring the listMcpTools request includes the appropriate identity (especially for user-assigned managed identities), aligning Consumption behavior more closely with the Standard connector path.

Changes:

• For managed MCP connections, enriches the managedConnection payload with connectionProperties.authentication and (when applicable) the user-assigned identity derived from WorkflowService().getAppIdentity().
• For built-in MCP connections, updates _buildMcpAuthentication to fall back to the workflow app’s managed identity configuration when the identity isn’t present in connection parameter values.
• Updates Consumption connector unit tests to initialize WorkflowService where needed.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
libs/logic-apps-shared/src/designer-client-services/lib/consumption/connector.ts	Adds workflow-identity-derived MSI identity into listMcpTools payloads for both managed and built-in MCP paths.
libs/logic-apps-shared/src/designer-client-services/lib/consumption/tests/connector.spec.ts	Initializes WorkflowService in tests and updates expectations for the managed MCP payload shape.