validate-azure-ad-token validation fails for APIs exposed as MCPServer
- Dominant language
- No language data
- Stars
- 28
- Forks
- 75
- Avg merge
- 9d 2h
- Merged PRs (30d)
- 3
Description
When an API is exposed as an MCP server, the policy defined at the API level causes authentication to fail when a tool is invoked even though the List Tools call works fine, indicating that the initial authentication is successful.
However, when the same policy is moved to the MCP server-level policy, both the tool invocation and authentication work as expected.
Validate-azure-ad-token policy at API level
Validate-azure-ad-token policy at MCP Server level
**Actual Behavior**
• List Tools endpoint → Works (auth succeeds)
• Tool execution → Fails with 401 Unauthorized
• Moving the policy to the MCP layer → Both work
[validate-azure-ad-token validation fails for APIs exposed as MCPServer .docx](https://github.com/user-attachments/files/20890582/validate-azure-ad-token.validation.fails.for.APIs.exposed.as.MCPServer.docx)
**Expected Behavior**
Authentication should succeed whether the policy is applied at the API level or at the MCP server level.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.