Tool wizard has changed for OAuth Identity Passthrough

Question

Tool wizard has changed for OAuth Identity Passthrough

Sebastian Larsson 0

A few weeks ago I set up a new MCP tool for one of my agents. Went through the article, chose custom OAuth and followed the instructions.

Today I tried to create a new MCP tool the same way, but now I don't get the choice of custom OAuth or managed OAuth.

I am also not able to edit previously configured tools with OAuth Identity Passthrough. This was possible a few weeks ago aswell.

What has changed, and why is there no update on the Microsoft Learn article about this?

https://learn.microsoft.com/en-us/azure/foundry/agents/how-to/mcp-authentication?pivots=python#oauth-identity-passthrough

0 comments

1 answer

Your answer

Answer 1

Hello @Sebastian Larsson

Based on the current Microsoft documentation, OAuth identity passthrough has not been documented as removed from the Foundry Agent Service. In fact, the current MCP authentication documentation still lists OAuth identity passthrough as supported and describes both Managed OAuth and Custom OAuth.

The current documentation describes:

Managed OAuth - Microsoft or the MCP server publisher manages the OAuth application.
Custom OAuth - you supply your own OAuth application registration, including client ID, client secret, authorization/token URLs, and scopes.

Microsoft's newer MCP documentation also still gives the portal workflow as:

Foundry project → Build/Agent Builder → Add tool → Custom → Model Context Protocol

and explicitly lists OAuth identity passthrough (OBO) as an authentication option for a custom MCP server.

So if the current wizard no longer presents those choices, it suggests a difference between the current Foundry portal experience and the published documentation, rather than evidence that the feature was intentionally retired.

The fact that you also cannot edit previously created OAuth identity-passthrough tools makes this less likely to be simply an MCP-server configuration issue.

I would first check whether you're creating the MCP connection specifically through:

Tools → Add tool → Custom → Model Context Protocol

rather than selecting an MCP server from the newer Tools Catalog. Microsoft has introduced a newer managed MCP/catalog experience where the authentication UI is generated from the connector definition, so the workflow can differ from a custom MCP connection.

If Custom → Model Context Protocol also doesn't expose OAuth Identity Passthrough, I would capture:

Foundry project/account region.
Whether this is a new or existing Foundry project.
Screenshot of the current MCP authentication wizard.
Authentication configuration of one of the older MCP tools that can no longer be edited.
Approximate date when you last successfully created a Custom OAuth MCP connection.

At that point, I think you should raise this with Microsoft as either a portal regression/rollout issue or a documentation mismatch. I wouldn't recommend deleting or recreating the existing working MCP connections until Microsoft confirms the intended behavior.

The documentation you're referencing is still current and was updated recently:

Microsoft - Set up authentication for MCP tools

It still explicitly documents OAuth Identity Passthrough. So your question about why the portal changed while the Learn article didn't is valid; based on the publicly available documentation, I don't see a documented announcement that Custom OAuth/Managed OAuth support has been removed.

Help make this community better for everyone: if this answer resolved your issue, please accept it or leave an upvote. If not, share more details in a comment so we can continue the discussion and find the right solution.