fix(MCP): Fix ManagedServiceIdentity auth for MCP connections (v5.961)

[rllyy97]

Commit Type

• feature - New functionality
• fix - Bug fix
• refactor - Code restructuring without behavior change
• perf - Performance improvement
• docs - Documentation update
• test - Test-related changes
• chore - Maintenance/tooling

Risk Level

• Low - Minor changes, limited scope
• Medium - Moderate changes, some user impact
• High - Major changes, significant user/system impact

What & Why

Completes fix for #9205 — MCP connections using ManagedServiceIdentity auth in Consumption SKU. This PR adds identity threading to ensure the user-selected managed identity is correctly passed through all dynamic values requests.

Original Issue (#9205): Consumption MCP connections were missing the identity field in the listMcpTools API request, causing failures for user-assigned managed identity scenarios.

This PR Adds: Identity threading through the dynamic values pipeline to ensure consistency with Standard SKU:

1. Designer-v2 getListDynamicValues extracts the selected identity from connectionReference.connectionProperties.authentication.identity
2. Identity is threaded through queries/connector.ts to the ConnectorService layer
3. Both Consumption and Standard connector implementations use the passed identity (if provided) instead of always picking the first user-assigned identity from WorkflowService
4. This ensures the user-selected identity is used for all MCP operations, not just initial connection setup

Impact of Change

• Users: Consumption workflows using MCP connectors with user-assigned managed identity will now correctly send the user-selected identity in all listMcpTools and dynamic values requests, ensuring consistent tool discovery and parameters.
• Developers:
  • ConnectorService interface now accepts optional identity parameter in getListDynamicValues
  • Designer-v2 correctly threads identity through the dynamic values pipeline
  • Designer-v1 remains unchanged to minimize risk
• System: No architectural changes. Identity threading uses existing Redux state (connectionReference) and ConnectorService infrastructure.

Test Plan

• Unit tests added/updated
• E2E tests added/updated
• Manual testing completed

Updated connector tests with InitWorkflowService mock for managed identity scenarios. All existing tests pass:

• connector.spec.ts: 68 tests pass (38 Consumption + 30 Standard)
• dynamicdata.spec.ts (designer-v2): 8 tests pass
• dynamicdata.spec.ts (designer-v1): 8 tests pass

Contributors

Screenshots/Videos

N/A — no visual changes.

[github-actions]

🤖 AI PR Validation Report

PR Review Results

Thank you for your submission! Here's detailed feedback on your PR title and body compliance:

✅ PR Title

• Current: fix(MCP): Fix ManagedServiceIdentity auth for MCP connections (v5.961)
• Issue: No blocking issue. The title is specific, uses a conventional prefix, and clearly describes the change.
• Recommendation: None required.

---

✅ Commit Type

• Properly selected (fix).
• Only one commit type is checked, which is correct.

---

⚠️ Risk Level

• The selected risk level is Medium, but the code change is a targeted auth/identity threading fix across shared connector services and both designer paths. That makes the impact closer to Medium than Low, so the submitter’s selection is acceptable.
• Label check: I did not find a matching risk:low, risk:medium, or risk:high label in the PR labels returned by the API, so please add the appropriate risk label and ensure it matches the body selection.

---

✅ What & Why

• Current: Clear and sufficiently detailed explanation of the MCP identity bug, the affected SKU, and the threaded identity fix.
• Issue: None blocking.
• Recommendation: None required.

---

✅ Impact of Change

• The impact section is well scoped and explains user, developer, and system impact clearly.
• Recommendation:
  • Users: Good as written.
  • Developers: Good as written.
  • System: Good as written.

---

✅ Test Plan

• Unit tests are updated in the diff, which satisfies the test-plan requirement.
• Manual testing is also checked and the explanation is reasonable.
• No E2E tests are required since unit tests are present.

---

⚠️ Contributors

• This section is blank.
• Assessment: Optional, but if there were PMs, designers, or other engineers involved, please add them for credit.
• Recommendation: Add contributor tags/names if applicable; otherwise this can remain empty.

---

✅ Screenshots/Videos

• Marked N/A and there are no visual/UI changes.
• No action needed.

---

Summary Table

Section	Status	Recommendation
Title	✅
Commit Type	✅
Risk Level	⚠️	Add a matching risk:medium label to align with the PR body
What & Why	✅
Impact of Change	✅
Test Plan	✅
Contributors	⚠️	Add contributors if applicable
Screenshots/Videos	✅

---

Overall: this PR passes review of the title/body template, with the only notable follow-up being the missing risk label.

---

Last updated: Tue, 26 May 2026 17:31:51 GMT

[github-actions]

🤖 AI PR Validation Report

PR Review Results

Thank you for your submission! Here's detailed feedback on your PR title and body compliance:

✅ PR Title

• Current: fix(MCP): Fix ManagedServiceIdentity auth for Consumption MCP connections (v5.961)
• Issue: No blocking issue. The title is specific and describes the affected area and behavior.
• Recommendation: Consider shortening slightly if you want to match a more concise conventional style, but it is already high quality.

---

✅ Commit Type

• Properly selected (fix).
• Only one commit type is checked, which is correct.

---

⚠️ Risk Level

• The PR body marks Medium, which is reasonable for a targeted auth flow fix with user impact.
• Advised risk from the diff: still medium. I do not see evidence that this should be escalated to high.

---

✅ What & Why

• Current: Clear explanation of the bug, affected SKU, and why the fix is needed.
• Issue: None blocking.
• Recommendation: You could make the opening sentence even shorter, but the current detail is strong and actionable.

---

✅ Impact of Change

• Impact is described clearly and maps to the code change.
• Recommendation:
  • Users: Correctly calls out Consumption workflows using user-assigned managed identity.
  • Developers: Good note that there are no API changes.
  • System: Good note that the change is localized and uses an existing service call.

---

✅ Test Plan

• Unit tests are added/updated in the diff, which satisfies the test-plan requirement.
• The absence of E2E tests is acceptable because unit tests are present.
• Recommendation: If you want to make this even stronger, you could mention the specific behavior verified by the updated tests (managed MCP payload and _buildMcpAuthentication identity fallback).

---

⚠️ Contributors

• Blank, but this is not required.
• Recommendation: Add contributors only if there were PM/design/peer contributors worth crediting.

---

✅ Screenshots/Videos

• N/A is appropriate because this is a non-visual change.

---

Summary Table

Section	Status	Recommendation
Title	✅
Commit Type	✅
Risk Level	✅
What & Why	✅
Impact of Change	✅
Test Plan	✅	Mention the specific unit-test coverage if desired
Contributors	⚠️	Optional; add only if you want to credit collaborators
Screenshots/Videos	✅

---

Overall: this PR passes. The body is compliant, the selected risk level matches the scope of the diff, and the unit test updates back the test-plan checkbox. The advised risk level remains medium, which matches the submitter's estimate.

---

Last updated: Fri, 22 May 2026 02:42:43 GMT

[github-actions]

📊 Coverage Check

The following changed files need attention:

⚠️ libs/designer-v2/src/lib/core/queries/connector.ts - 53% covered (needs improvement)
⚠️ libs/designer-v2/src/lib/core/utils/parameters/dynamicdata.ts - 51% covered (needs improvement)
⚠️ libs/logic-apps-shared/src/designer-client-services/lib/consumption/connector.ts - 70% covered (needs improvement)
⚠️ libs/logic-apps-shared/src/designer-client-services/lib/standard/connector.ts - 63% covered (needs improvement)

Please add tests for the uncovered files before merging.

[Copilot]

Pull request overview

Fixes Consumption-SKU MCP listMcpTools requests for Managed Service Identity (MSI) authentication by ensuring the user-assigned managed identity (UAMI) resource ID is included when required (aligning behavior with the Standard connector’s approach of deriving identity from WorkflowService().getAppIdentity()).

Changes:

• Consumption MCP listMcpTools request building now derives UAMI from WorkflowService().getAppIdentity() and includes it in MSI authentication payloads.
• Managed MCP connection path now adds connectionProperties.authentication in the request (previously only referenced { connection: { id } }).
• Consumption connector unit tests updated to initialize WorkflowService to support the new identity-derivation behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
libs/logic-apps-shared/src/designer-client-services/lib/consumption/connector.ts	Adds workflow-identity-derived UAMI support for MSI in Consumption MCP listMcpTools payload construction.
libs/logic-apps-shared/src/designer-client-services/lib/consumption/tests/connector.spec.ts	Updates Consumption connector tests to initialize WorkflowService for MCP scenarios and validates managed MCP request shape.