Ce navigateur n’est plus pris en charge.
Effectuez une mise à niveau vers Microsoft Edge pour tirer parti des dernières fonctionnalités, des mises à jour de sécurité et du support technique.
Translate
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(220.8, 44%, 31%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESL%3C/text%3E%3C/svg%3E)
I'm trying to use the new MCP Server feature preview in Azure API Management (https://learn.microsoft.com/en-us/azure/api-management/export-rest-mcp-server) and apply the OAuth strategy proposed a few months ago (https://techcommunity.microsoft.com/blog/integrationsonazureblog/azure-api-management-your-auth-gateway-for-mcp-servers/4402690).
Works fine until I try to use Inbound Policies in the MCP Server that modify the backend request sent to my API. I tried applying set-header or set-query-parameter, both have no effect on the actuel backend request sent to my HTTP API. Why is this ? How could I route the call to the backend API with its access_token from Entra ?
Question verrouillée. Vous pouvez voter pour indiquer si elle est utile, mais vous ne pouvez pas ajouter de commentaires ou de réponses ni suivre la question.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(57.599999999999994, 5%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPK%3C/text%3E%3C/svg%3E)
Hello Sebastien Lescure,
Thanks for raising this. It sounds like the set-header or set-query-parameter policies you're applying in the inbound section aren't affecting the backend call — and that’s definitely worth digging into.
Just to help narrow it down: are those policies placed only in the <inbound> section, or have you tried adding them to the <backend> section as well? In the MCP Server model, headers or query changes need to happen in the backend section to impact the actual request sent to your API.
If you're open to it, feel free to share a snippet of your policy XML or a quick example of how it's set up — that would help me give you a more targeted answer.
Please refer below documentation:
Ce commentaire a été supprimé en raison d’une violation de notre Code de conduite. Le commentaire a été signalé manuellement ou identifié via la détection automatisée avant que l’action ne soit entreprise. Pour obtenir plus d’informations, veuillez consulter notre Code de conduite.
Ce commentaire a été supprimé en raison d’une violation de notre Code de conduite. Le commentaire a été signalé manuellement ou identifié via la détection automatisée avant que l’action ne soit entreprise. Pour obtenir plus d’informations, veuillez consulter notre Code de conduite.
Ce commentaire a été supprimé en raison d’une violation de notre Code de conduite. Le commentaire a été signalé manuellement ou identifié via la détection automatisée avant que l’action ne soit entreprise. Pour obtenir plus d’informations, veuillez consulter notre Code de conduite.
Ce commentaire a été supprimé en raison d’une violation de notre Code de conduite. Le commentaire a été signalé manuellement ou identifié via la détection automatisée avant que l’action ne soit entreprise. Pour obtenir plus d’informations, veuillez consulter notre Code de conduite.
Hello Sebastien Lescure,
Could you please help me with the APIM current status.
Hi Praveen,
I've been trying pushing you a detailed answer of my policies but my comment is rejected and deleted for code of conduct violation, I have no idea why :(.
I've verified my policies and simplified to have a really basic case. The API is just echoing back the headers. The MCP Server just has the set-header policy at the correct place (Inside the inbound section, and alone in it). The MCP Server is working, with correct calls from Visual Studio Code, and response is the one from the API, but without the headers.
My REST API is just this :
<inbound>
<base />
<return-response>
<set-status code="200" reason="OK" />
<set-header name="Content-Type" exists-action="override">
<value>text/html</value>
</set-header>
<set-body>@{
return "Received : Authorization=" + context.Request.Headers.GetValueOrDefault("Authorization") + " / X-CustomHeader=" + context.Request.Headers.GetValueOrDefault("X-CustomHeader");
}</set-body>
</return-response>
</inbound>
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(192, 28.999999999999996%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGK%3C/text%3E%3C/svg%3E)
Hello Sebastien Lescure,
Thank you for your detailed explanation.
In the MCP Server model, policies in the <inbound> section modify the request context for API Management’s internal routing logic, but do not affect the actual HTTP request sent to the backend API.
So, even though your <inbound> policy like the one below executes:
<inbound>
<set-header name="Authorization" exists-action="override">
<value>Test Token</value>
</set-header>
<set-header name="X-CustomHeader" exists-action="override">
<value>Test Value</value>
</set-header>
<base />
</inbound>
The headers are not included in the request made to the backend service.
Try the below workaround to fix this issue:
Use the <backend> Section to Modify the Outbound Request
To modify the headers actually sent to the backend API, you must move the header changes to the <backend> section of your policy:
<backend>
<set-backend-service base-url="https://your-backend-api.azurewebsites.net" />
<set-header name="Authorization" exists-action="override">
<value>Test Token</value>
</set-header>
<set-header name="X-CustomHeader" exists-action="override">
<value>Test Value</value>
</set-header>
</backend>
This ensures the specified headers are part of the HTTP request that API Management sends to your REST API backend.
If your goal is to pass a token issued by Microsoft Entra ID, consider using either:
Managed Identity authentication:
<backend>
<set-backend-service base-url="https://your-api" />
<authentication-managed-identity resource="https://resource.azure.com" />
</backend>
Or get-access-token with OAuth2:
<inbound>
<send-request mode="new" response-variable-name="tokenResponse" timeout="10" ignore-error="false">
<set-url>https://login.microsoftonline.com/<tenant_id>/oauth2/v2.0/token</set-url>
</send-request>
<set-variable name="access_token" value="@((string)context.Variables["tokenResponse"].Body.As<JObject>()["access_token"])" />
</inbound>
<backend>
<set-header name="Authorization" exists-action="override">
<value>Bearer @{context.Variables["access_token"]}</value>
</set-header>
</backend>
If the issue still persists, feel free to share your full (anonymized) policy so we can take a closer look.
Hi,
No, problem is still there.
I've been unable to post my inbound policy on the MCP Server side that contains the set-header, due to website identifying code of conduct violation.
I would like to know if it is expected behavior ? set-header does not apply. Other policys (Like reading current header of the MCP Request) works fine. Is it a limitation of the preview ? Without ability to set-header, it will be impossible to implement proper OAuth specification of MCP Server for replacing the token expected by the backend API.
Hello Sebastien Lescure,
Thank you for your detailed explanation.
In the MCP Server model, policies in the <inbound> section modify the request context for API Management’s internal routing logic, but do not affect the actual HTTP request sent to the backend API.
So, even though your <inbound> policy like the one below executes:
<inbound>
<set-header name="Authorization" exists-action="override">
<value>Test Token</value>
</set-header>
<set-header name="X-CustomHeader" exists-action="override">
<value>Test Value</value>
</set-header>
<base />
</inbound>
The headers are not included in the request made to the backend service.
Try the below workaround to fix this issue:
Use the <backend> Section to Modify the Outbound Request
To modify the headers actually sent to the backend API, you must move the header changes to the <backend> section of your policy:
<backend>
<set-backend-service base-url="https://your-backend-api.azurewebsites.net" />
<set-header name="Authorization" exists-action="override">
<value>Test Token</value>
</set-header>
<set-header name="X-CustomHeader" exists-action="override">
<value>Test Value</value>
</set-header>
</backend>
This ensures the specified headers are part of the HTTP request that API Management sends to your REST API backend.
If your goal is to pass a token issued by Microsoft Entra ID, consider using either:
Managed Identity authentication:
<backend>
<set-backend-service base-url="https://your-api" />
<authentication-managed-identity resource="https://resource.azure.com" />
</backend>
Or get-access-token with OAuth2:
<inbound>
<send-request mode="new" response-variable-name="tokenResponse" timeout="10" ignore-error="false">
<set-url>https://login.microsoftonline.com/<tenant_id>/oauth2/v2.0/token</set-url>
</send-request>
<set-variable name="access_token" value="@((string)context.Variables["tokenResponse"].Body.As<JObject>()["access_token"])" />
</inbound>
<backend>
<set-header name="Authorization" exists-action="override">
<value>Bearer @{context.Variables["access_token"]}</value>
</set-header>
</backend>
If the issue still persists, feel free to share your full (anonymized) policy so we can take a closer look.
Hi,
If I only put a set-header in the backend policy, the API backend seems not to be called anymore (A call to the MCP Server from Visual Studio Code Insiders just never ends) :
<backend>
<set-header name="Authorization" exists-action="override">
<value>Test Token</value>
</set-header>
</backend>
If I try to add a call to <base> or <set-backend-service>, I can't save, Azure Portal returns the error : Error in element 'backend': backend section allows only one policy to be specified
<backend>
<set-header name="Authorization" exists-action="override">
<value>Test Token</value>
</set-header>
<base />
</backend>
Cette réponse a été supprimée en raison d’une violation de notre Code de conduite. La réponse a été signalée manuellement ou identifiée via la détection automatisée avant que l’action ne soit entreprise. Pour obtenir plus d’informations, veuillez consulter notre Code de conduite.
Les commentaires ont été désactivés. En savoir plus
Cette réponse a été supprimée en raison d’une violation de notre Code de conduite. La réponse a été signalée manuellement ou identifiée via la détection automatisée avant que l’action ne soit entreprise. Pour obtenir plus d’informations, veuillez consulter notre Code de conduite.
1 commentaire suppriméLes commentaires ont été désactivés. En savoir plus
Bonjour Sébastien, vous avez été victime de l'anti-spam, pouvez-vous ouvrir une nouvelle demande, si vous avez un problème, n'hésitez pas à me @Bryx
Je clôture cette question, le système la considère comme étant du SPAM !