Using Entra ID OAuth Flow with Claude Code and APIM-Hosted MCP Server

Question

Hi,

We’re testing Claude Code with APIM-hosted MCP Servers. These are external, home-grown MCP servers that use Entra ID (Azure AD) OAuth flow for authentication.

We expect the flow to work like this:

1. In the Claude Code terminal, run

      claude mcp add --transport http apim-mcp-crm https://apim-poc.azure-api.net/mcp/crm
   

2. The browser automatically opens a sign-in window.
3. The user signs in with their Entra ID account.
4. After successful authentication, the MCP server is added and connected.
5. If the user is already signed in to another Entra ID-enabled site or app, Claude Code reuses the existing token without asking to reauthenticate.

However, after reviewing the documentation, we couldn’t find a sample that supports this browser pop-up OAuth flow. The closest reference we found is this guide: OAuth 2.0 Authorization Grant Flow in Azure API Management

Unfortunately, it doesn’t seem to work in the MCP scenario.

Could you please advise if this OAuth flow is supported when using Claude Code with APIM-hosted MCP servers? Or if not, what would be the recommended configuration?

Thank you!

Answer 1

Hi Amy Zhang,

Thank you for posting your question in the Microsoft Q&A forum

Register the APIM instance and your MCP server in Azure AD as applications with proper redirect URIs.

Configure APIM with OAuth 2.0 Authorization Server tied to Azure AD.

Ensure Claude Code is set up to handle OAuth 2.0 Authorization Code Flow and support the browser pop-up for interactive sign-in.

Check redirect URI used by Claude Code matches the APIM OAuth server configuration.

Use refresh tokens and caching tokens to enable token reuse.

Yes, OAuth 2.0 Authorization Code Flow with a browser pop-up is supported by APIM and Microsoft Entra ID. While documentation directly involving Claude Code with APIM OAuth pop-up is limited, the standard OAuth flow should apply. Recommended configuration involves proper Azure AD app registrations, APIM OAuth server setup, and matching redirect URIs. Troubleshooting should focus on OAuth app settings, redirect URI correctness, and client ability to handle browser-based auth.

References

Authorization Code | Azure API Management Hands on Lab

Microsoft identity platform and OAuth 2.0 authorization code flow - Microsoft identity platform | Microsoft Learn