AzureProvider cannot authenticate with external Microsoft APIs - PowerBI

[rpgeddam]

Description

I'm trying to create an MCP server that interacts with the PowerBI REST API using Azure AD authentication. I need the powerBI scope https://analysis.windows.net/powerbi/api/Report.Read.All

# Attempt #1
auth_provider = AzureProvider(
    client_id=os.getenv("AZURE_CLIENT_ID"),
    client_secret=os.getenv("AZURE_CLIENT_SECRET"),
    tenant_id=os.getenv("AZURE_TENANT_ID"),
    base_url="http://localhost:8000",
    required_scopes=["custom.scope"],
    additional_authorize_scopes=["openid", "offline_access", "https://analysis.windows.net/powerbi/api/Report.Read.All"],
)

# Wont work because custom.scope and powerbi scopes are on different resources
# AADSTS28000: Provided value for the input parameter scope is not valid 
# because it contains more than one resource.

# Attempt #2
auth_provider = AzureProvider(
    client_id=os.getenv("AZURE_CLIENT_ID"),
    client_secret=os.getenv("AZURE_CLIENT_SECRET"),
    tenant_id=os.getenv("AZURE_TENANT_ID"),
    base_url="http://localhost:8000",
    required_scopes=["https://analysis.windows.net/powerbi/api/Report.Read.All"],
)

# Wont work because AzureProvider replaces the prefix on the scope
# The application asked for scope 'Report.Read.All' that doesn't exist.

What I expect would work:

  auth_provider = AzureProvider(
      client_id=os.getenv("AZURE_CLIENT_ID"),
      client_secret=os.getenv("AZURE_CLIENT_SECRET"),
      tenant_id=os.getenv("AZURE_TENANT_ID"),
      base_url="http://localhost:8000",
      required_scopes=["https://analysis.windows.net/powerbi/api/Report.Read.All"],
      additional_authorize_scopes=["openid", "offline_access"],
  )
# Should accept full scope URIs and use the correct audience

I expect his affects anyone using AzureProvider with:

• PowerBI
• Azure Storage
• Azure DevOps
• Any Microsoft API that isn't Graph or a custom API

Version Information

$ fastmcp version

FastMCP version:                                                                            2.13.1
MCP version:                                                                                1.21.2
Python version:                                                                             3.13.2
Platform:                                                      macOS-15.6.1-arm64-arm-64bit-Mach-O
FastMCP root path: *

[sakhan-rio]

Hey. My issue seems to be related to this one. Providing details:

I am trying to perform OBO token exchange to access my MCP tool that checks my access to Sharepoint sites.

I have two App registrations:

1. AppRegA is used to generate the token to connect to MCP Server using AzureProvider()
2. Then the JWT token generated is used to generate OBO exchange token which can be then used by my tool to authenticate and check sharepoint sites access.

Since audience for OBO exchange to work needs to be api://<app_regb> and the one in AzureProvider() generated token is <app_reg_a>, the exchange fails with assertion error on audience side.

Error snippet:

Any idea how this can be fixed? How can I pass audience claim when generating the first token.
Let me know, happy to provide code details.

[jlowin]

Thanks for the detailed report! After digging into this, I think the core issue is that Azure doesn't allow a single token to work for multiple resources - you can't get one token that's valid for both your custom API (api://my-client-id/my.scope) and PowerBI (https://analysis.windows.net/powerbi/api/Report.Read.All). When you request both, Azure returns the "scope contains more than one resource" error.

Maybe a correct approach is to use additional_authorize_scopes for the PowerBI scopes:

auth_provider = AzureProvider(
    client_id=os.getenv("AZURE_CLIENT_ID"),
    client_secret=os.getenv("AZURE_CLIENT_SECRET"),
    tenant_id=os.getenv("AZURE_TENANT_ID"),
    base_url="http://localhost:8000",
    required_scopes=["custom.scope"],  # Your MCP server's API scopes
    additional_authorize_scopes=[
        "https://analysis.windows.net/powerbi/api/Report.Read.All",
        "openid",
        "offline_access"
    ],
)

When users authenticate, they'll consent to all scopes at once. Azure will return a token for your MCP server (with your custom scopes) plus a refresh token. When your server needs to call PowerBI APIs, you'll use that refresh token to acquire a separate PowerBI-specific token that has the PowerBI audience and scopes.

The additional_authorize_scopes not being validated on the MCP token is intentional - those scopes appear in the separate PowerBI token, not your server's token.

Does this pattern work for your use case? Happy to help clarify the implementation if needed.

[rpgeddam]

Thanks for the pointer @jlowin. I don't expect that'll work - as you rightly called out, Entra will not issue a token that applies for both custom.scope and https://analysis.windows.net/powerbi/api/Report.Read.All, only one or the other.

Looking through AzureProvider implementation, it's design is

• Not intended to handle more than 1 entra token
• Always creates a required_scopes token

In it's current form, IMO, there is no way to make AzureProvider acquire a token for https://analysis.windows.net/powerbi/api/Report.Read.All

you'll use that refresh token to acquire a separate PowerBI-specific token that has the PowerBI audience and scopes.

This matches my understanding as well, and I can do this in a custom client. But I wont be able to make a 3rd party/Commercial client (Claude Code, Cursor, Copilot, even MCP Inspector) to mint a new token after the initial oauth flow.

[jlowin]

I believe that is correct and an MCP limitation for the moment, but I believe I saw auth proposals for forwarding clients to external oauth flows that should make this work in future MCP protocol versions! Apologies it isn't well covered at the moment.

[rpgeddam]

Thanks for looking into this @jlowin.

I wanted to leave one thought for future consideration -
If AzureProvider didn't force the creation of a custom scope and allowed full-URI scopes to pass through unmodified, users could authenticate directly against PowerBI (or Azure Storage, DevOps, etc.) without needing the multi-resource token flow. As a side benefit, it would also simplify Entra ID app registration since users wouldn't need to expose a custom API. cc @nbaju1 @JonasKs would love to hear your thoughts!

Totally understand if this isn't a priority given the broader MCP auth landscape is very much evolving. Thanks again for your work on FastMCP!

[jlowin]

I believe full URIs will pass through! See #2506 . However I'm not an Azure expert and welcome extensions/expansions/enhancements.