Facing Error Access denied when connecting to the Dynamics 365 MCP server from AI Foundry

A 403 Forbidden during MCP tool enumeration points to an authorization or access-path problem between Foundry and the Dynamics MCP endpoint, not a general OAuth consent success issue.

Based on the reported behavior, the most relevant checks are:

1. Verify the selected auth configuration is still valid For MCP connections, 401/403 errors indicate the key or token used for the selected authentication method should be validated. If credentials may have changed or been exposed, rotate them and update the saved connection.
2. Recheck OAuth configuration values For OAuth passthrough scenarios, confirm the authorization URL, token URL, and scopes in the Foundry tool configuration still match the OAuth provider settings. Also verify the client ID and client secret are correct and not expired. Scope mismatches or incorrect endpoint values are called out as common causes of token exchange failures.
3. Confirm the downstream principal still has required access For identity-based auth, the principal used by the toolbox must have the required RBAC role on the target resource before the toolbox is called. A 403 specifically means the configured credential, connection, or selected identity may no longer have the required downstream permission.
4. Check whether this is a consent-first-call scenario For OAuth-based MCP endpoints in Foundry projects, the first call can return CONSENT_REQUIRED with error code -32006. That is expected. After opening the consent URL and completing authorization, retry the call. If consent completes but the next call returns 403, the issue is after consent and is usually permissions or OAuth configuration rather than the consent flow itself.
5. Validate network access to the MCP endpoint If the endpoint is behind proxy, firewall, private networking, or IP restrictions, Foundry must be allowed to reach it. For MCP connectivity issues, verify the server URL is reachable and that outbound HTTPS access is not blocked. If private endpoints are involved, confirm the private networking setup is correct.
6. Check whether the endpoint itself is returning the denial Since Postman can fetch data, compare the exact auth path used by Postman with the one used by Foundry. A working direct API call does not prove the MCP endpoint accepts the same token audience, scopes, or auth mode. The MCP server can be reachable while still denying tool enumeration.
7. Review server-side logs For custom MCP servers, check the server or hosting logs for authorization failures and confirm what request is arriving during tool discovery. A successful connection with failed tool publication or denied enumeration can produce the exact symptom being seen.
8. Recreate and retest with a minimal setup Since recreating the connector did not help, test with a minimal MCP configuration and verify whether tool discovery succeeds independently. If the endpoint is reachable but returns no usable tools or denies enumeration, focus on MCP server auth and access control rather than agent instructions.

If the MCP endpoint is OAuth-enabled and not one of the Foundry-managed OAuth connectors, Foundry requires a custom app registration for that server.

References:

• Build and register a Model Context Protocol (MCP) server
• Connect agents to Model Context Protocol servers (typescript)
• Foundry MCP Server best practices and security guidance
• Troubleshoot the Dynamics 365, Dataverse (Common Data Service), and Dynamics CRM connectors in Azure Data Factory and Azure Synapse