nprasad2077/mcp-microsoft
1
0 Fork 0
mirror of https://github.com/microsoft/mcp.git synced 2026-11-04 12:01:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added documentation for 401 missing auth config (#4009)

Browse Source
This commit is contained in:
Connie Yau authored and GitHub committed 2026-10-22 12:45:13 -07:00
1 parent 2d6ad88ed2
commit f7ab24de64
1 file changed
+16
Download Patch File Download Diff File Expand all files Collapse all files
servers/Azure.Mcp.Server/TROUBLESHOOTING.md
+16
View File
@@ -1188,6 +1188,22 @@ export AZURE_MCP_DANGEROUSLY_ENABLE_FORWARDED_HEADERS=true
### Common Issues
#### 401 Unauthorized - Missing incoming authentication configuration
**Causes:** Missing incoming authentication settings, resulting in `IDX10204` errors or an empty tenant in OAuth metadata (`https://login.microsoftonline.com//v2.0`).
**Resolution:** Set these environment variables on the server container, then restart:
| Environment variable | Value |
|---|---|
| `AzureAd__Instance` | `https://login.microsoftonline.com/` (use your cloud's login endpoint for sovereign clouds). |
| `AzureAd__TenantId` | The MCP server app registration's tenant ID. |
| `AzureAd__ClientId` | The MCP server app registration's client ID, not the managed identity's client ID. |
**Important:** `AZURE_TENANT_ID` and `AZURE_CLIENT_ID` do not configure incoming authentication. Keep incoming authentication enabled.
**Setup reference:** [Container configuration](https://github.com/Azure-Samples/azmcp-foundry-aca-mi/blob/main/infra/modules/aca-infrastructure.bicep#L98) and [app registration](https://github.com/Azure-Samples/azmcp-foundry-aca-mi/blob/main/infra/modules/entra-app.bicep). The incoming-auth settings also apply to AKS.
#### 401 Unauthorized - Invalid Token
**Causes:** Token expired, wrong audience, or missing bearer token.