How to do the OAuth authentication for the MCP exposed from REST API based on Azure API Management service

OAuth for an MCP server exposed through Azure API Management is configured at the MCP client (Copilot) and enforced in API Management.

From the API Management side, there are two supported patterns:

1. Key-based authentication with subscription key
   • Protect the MCP endpoint with an API Management subscription key.
   • In the MCP client configuration (for example, VS Code mcp.json or Copilot CLI config), add a headers section that sends the key:

      {
        "servers": {
          "diabetes-prediction-mcp": {
            "type": "http",
            "url": "https://<apim-service-name>.azure-api.net/diabetes-prediction-mcp/mcp",
            "headers": {
              "Ocp-Apim-Subscription-Key": "<subscription-key>"
            }
          }
        }
      }
   

   • API Management validates the key on inbound requests. No OAuth flow is required in Copilot; it just sends the header.
2. Token-based authentication with Microsoft Entra ID (OAuth 2.1/JWT)
   • Configure API Management to validate Microsoft Entra tokens using the validate-azure-ad-token policy on the MCP API:

      <validate-azure-ad-token
          tenant-id="<your-entra-tenant-id>"
          header-name="Authorization"
          failed-validation-httpcode="401"
          failed-validation-error-message="Unauthorized. Access token is missing or invalid.">
        <client-application-ids>
          <application-id><your-client-application-id></application-id>
        </client-application-ids>
      </validate-azure-ad-token>
   

   • The MCP client (for example, VS Code or another MCP-capable agent) must obtain an access token from Microsoft Entra ID and send it in the Authorization header. API Management then validates the token and forwards it (or another token) to the backend as needed.
   • If the backend also needs the Authorization header, explicitly forward it in the outbound policy:

      <set-header name="Authorization" exists-action="override">
        <value>@(context.Request.Headers.GetValueOrDefault("Authorization"))</value>
      </set-header>
   

If Copilot CLI shows OAuth: needs authentication, configure the MCP server entry it uses so that it either:

• Sends the Ocp-Apim-Subscription-Key header (key-based), or
• Implements an OAuth flow to acquire a Microsoft Entra access token and send it in the Authorization header (token-based).

Once the appropriate header is present, the MCP server exposed via API Management can be called from GitHub Copilot agents in VS Code or CLI, and tool invocations will succeed.

References:

• Secure access to MCP servers in API Management
• Expose REST API in API Management as an MCP server
• Expose and govern an existing MCP server
• Secure Model Context Protocol calls to Azure App Service from Visual Studio Code with Microsoft Entra authentication
• Quickstart: Integrate Azure MCP Server with GitHub Copilot CLI