Breadcrumbs

How to OAuth & Entra ID

This guide shows you how to register OAuth client to use your Microsoft Entra ID with LUY & LUY MCP Server and what information is required by LUY.

Summary

LUY requires the following information to setup MCP Server with OAuth:

  • Client ID / Application ID: A UUID like 123f01b2-0f0f-42aa-98ac-c55c4444a123

  • Entra tenant ID: A UUID like 123f01b2-0f0f-42aa-98ac-c55c4444a456

  • Client Secret: The value you copied in the previous step

  • Scope Name: chosen scope name in step Expose an API (e.g. luy-mcp)

  • Token Claim Structure: we need to know which token claim is used to reflect the LUY role (e.g. roles) and which claim reflects the unique principal name (e.g. user ID or email address). We recommend to sent a complete overview of configured claims and their values.

Store and send the secret securely. Never send them unencrypted via Mail.

Create an Entra ID App Registration

Create an App registration in Azure Portal to get the credentials needed for authentication.

Prerequisites

Before you begin, you will need:

  • Go to the Azure Portal and navigate to Microsoft Entra ID → App registrations.
    Click "New registration" to create a new application.

Configure Your Application

Fill in the application details:

  • Name: Choose a name users will recognize (e.g., “LUY MCP Server”)

  • Supported account types: Choose based on your needs:

    • Single tenant: Only users in your organization

    • Multitenant: Users in any Microsoft Entra directory

    • Multitenant + personal accounts: Any Microsoft account

  • Redirect URI: Select “Web” and enter mcp server URL + /auth/callback
    (e.g., https://customer-mcp.luy.app/auth/callback)

  • Expose an API: Configure your Application ID URI and define scopes

    • Go to Expose an API in the App registration sidebar.

    • Click Set next to “Application ID URI”

      • Keep the default api://{client_id}

    • Click Add a scope and create a scope your app will require, for example:

      • Scope name: luy-mcp

      • Admin consent display name/description: as appropriate for your org

      • Who can consent: as needed (Admins only or Admins and users)

      • Display name: LUY MCP

      • Display description: Gets access to LUY MCP Server

OAuth Application need to be configured to use OAuth accessToken v2 for Microsoft Graph API. In some cases, newly registered applications are still using v1.

In our case this can not verified via Azure Portal, only via entra.microsoft.com. Check “App registration” > “Manifest” > JSON with api.requestedAccessTokenVersion value equals 2 If null, set it to 2.

Create client secret

After registration, navigate to Certificates & secrets in your app’s settings.

  • Click “New client secret”

  • Add a description (e.g., “LUY MCP Server”)

  • Choose an expiration period

  • Click “Add”

Copy the secret value immediately - it won’t be shown again! You’ll need to create a new secret if you lose it.

User role or group mapping

The OAuth access token sent from IDP to LUY should include the assigned LUY roles to the user. This can be done via groups or app roles. This setting depends on company preferences to manage assigned roles.

This should reflect the role and permission settings used in your LUY instance.
Adapt optional claims under “Token configuration” to include role information with appropriate claim name.

API Permissions

The following permission is required but is created by default:

  • Microsoft Graph - User.Read