MCP Server using .Net and Microsoft Entra ID

A .NET boilerplate for building secure MCP servers integrated with Microsoft Entra ID.

This project provides a ready-to-use foundation for anyone who wants to quickly set up a Model Context Protocol (MCP) server that’s secured with Microsoft Entra ID (Azure AD). It includes all the core components needed to authenticate users from your organization, manage user identity securely, and expose MCP tools in a trusted enterprise environment.

Out of the box, it’s tested and compatible with Claude AI and ChatGPT, making it the fastest way to get your own Entra-protected MCP server running in minutes.

This project demonstrates how to bridge the authentication gap between MCP clients (Claude AI, ChatGPT) and Microsoft Entra ID, ensuring these systems can work together securely and seamlessly.

A .NET 8.0 example implementation showing how to build an OAuth 2.1 proxy that enables Claude AI to authenticate with Microsoft Entra ID for Model Context Protocol (MCP) servers.

Overview

This project demonstrates how to bridge the authentication gap between Claude AI and Microsoft Entra ID (Azure AD). Claude requires RFC 7591 Dynamic Client Registration, which Entra ID doesn't support. This proxy translates between these incompatible systems while maintaining enterprise security.

Built with the official Model Context Protocol C# SDK - This SDK was a game-changer for implementing MCP servers in .NET, providing strongly-typed interfaces and automatic protocol handling.

┌──────────┐      OAuth 2.1       ┌──────────────────────┐      OAuth 2.0      ┌────────────┐
│          │  (with Dynamic Reg)  │                      │   (Pre-registered)  │            │
│ Claude   ├─────────────────────►│  MCP (OAuth) Server  ├────────────────────►│ Entra ID   │
│   AI     │◄─────────────────────┤   (this project)     │◄────────────────────┤            │
└──────────┘                      └──────────────────────┘                     └────────────┘
                                  

Key Features

• ✅ Custom Login UI - Branded consent page before Entra ID authentication
• ✅ WhoAmI Tool - Example MCP tool that displays authenticated user information
• ✅ Dynamic Client Registration - Implements RFC 7591 for Claude compatibility
• ✅ Dual PKCE Flows - Secure authentication between all components (RFC 7636)
• ✅ Token Mapping - Opaque external tokens, JWT internal tokens with user claims
• ✅ User Claims Extraction - Name, email, OID, UPN from Entra ID tokens
• ✅ Production Ready - CORS, HTTPS, error handling, structured logging

Screenshots

OAuth login flow with custom branding before Entra ID authentication

Tested Platforms

✅ Claude AI - Fully tested and working with Claude Desktop and web interface

✅ ChatGPT - Tested and working; see Troubleshooting for notes about Dynamic Client Registration and persistent client storage requirements.

⚠️ Other MCP Clients - This proxy implements the MCP OAuth specification. While it may work with other MCP clients, it has primarily been tested with Claude AI and ChatGPT. VS Code's MCP integration typically uses direct OAuth with pre-configured client credentials and may not require this proxy

What's Included

MCP Server with OAuth

This project includes a complete MCP server implementation with:

• WhoAmI Tool - Displays authenticated user information

  ✅ Authentication Status: Authenticated via Entra ID OAuth
  📋 User Information:
    • Name: John
  

... View full README on GitHub