AI foundry, Voice Live does not support interactive OAuth authorization for MCP tools.

Babak Fak 20 Reputation points
2026-08-13T11:26:07.77+00:00

Hi

I have a custom MCP tool and configured with OAuth Identity Passthrough.

I have my own Identity service. I can get a token using postman or any other tool to post client_id+secret.

Token URL: mydomain.com/connect/token

AuthUrl: mydomain.com/connect/authorize

When configured it gave me a url and asked me to enter into valid redirects, so I added into redirects of the client in my identity service.

However, when I want to try the agent in AI foundry, I see this error:

Voice Live does not support interactive OAuth authorization for MCP tools.

How can it be changed to use "Grant type: Client Credentials" and not look for " interactive OAuth authorization".

User's image

Foundry Agent Service
Foundry Agent Service

A fully managed platform in Microsoft Foundry for hosting, scaling, and securing AI agents built with any supported framework or model

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vikram Singh 2,670 Reputation points Microsoft Employee Moderator
    2026-08-17T08:41:15.3+00:00

    Hello @Babak Fak

    Welcome to the Microsoft Q&A Forum! Thank you for posting your query here.

    This is currently a Voice Live limitation. OAuth identity passthrough is designed to preserve the end user’s identity and therefore requires an interactive sign-in and consent flow. Voice Live executes MCP tools server-side and cannot complete this interactive authorization flow.

    Voice Live also does not currently provide settings for a token URL, client ID, client secret, grant type, or automatic token renewal. Therefore, an OAuth identity-passthrough connection cannot be changed to grant_type=client_credentials.

    The require_approval property only controls whether users approve individual tool executions. It does not change the MCP authentication method.

    Available alternatives:

    1. Acquire the access token outside Voice Live and supply it as the MCP authorization value or Authorization header. This is mainly suitable for testing because Voice Live does not document automatic token renewal; the value must be replaced when it expires.
    2. For production, use Voice Live function calling. Your application backend can securely acquire, cache, and renew a client-credentials token and then invoke the MCP server or underlying API.
    3. Place a trusted gateway or proxy in front of the MCP server. The gateway can obtain and renew the client-credentials token before forwarding requests.

    Do not place the client secret directly in the Voice Live session configuration or client application.

    References:

    Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

    Thanks!

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.