Microsoft Entra ID

Microsoft Entra ID was formerly known as Azure Active Directory.

IDScan is a company in the Identity Verification as a Service (IDVaaS) sector.

Azure AD has been renamed to Microsoft Entra ID.

Clicking the issue details link automatically launches SSMS with the current server and database context and authenticates via Microsoft Entra ID, with no need to manually enter connection information.

Domain routing built by the application side may be inconsistent with platform-level tenant discovery, because a user may sign in with a personal account email to an identity outside the enterprise tenant, so the mapping table should be based on verified domains and tenant IDs rather than inferred from the email string alone.

Entra SSO is enterprise-grade single sign-on, configured by the customer enterprise's IT administrator in their own Entra tenant; user authentication happens within the customer tenant, and the application trusts that tenant rather than generic Microsoft accounts.

A tenant in Entra ID is an independent identity directory instance for an organization within Entra ID, with its own users, groups, app registrations, and security policies; each tenant has a unique tenant ID and default domain (such as contoso.onmicrosoft.com).

The Microsoft identity platform allows an application to be registered as multi-tenant, so that any Entra tenant administrator can consent to and connect the same application without publishing a separate app for each customer.

Microsoft Entra (formerly Azure AD) provides identity-based access control and is a standard practice for secure cloud access.

IAM typically includes an identity provider (IdP), single sign-on (SSO), multi-factor authentication, directory services, and an authorization policy engine; common commercial solutions include Okta and Microsoft Entra ID, and open-source solutions include Keycloak.

The MCP server acts as an OAuth-protected resource and Entra ID as the authorization server; clients without a token receive an authentication challenge and discover the authorization metadata; the server must validate issuer, audience, validity period and scope or role; a token intended for a downstream API should not be automatically accepted as a token for accessing this MCP server.

In the reference architecture, the AI host connects via Azure API Management to MCP servers running on Container Apps or Functions; Microsoft Entra ID provides identity, API Management validates tokens, enforces rate limits and captures traces, the servers use managed identities to access backend APIs, and Azure Monitor and Application Insights record latency, failures and correlation identifiers.

The reason EMA can consolidate authorization into the IdP is the premise that the enterprise has already unified employee identities with an IdP; after an application integrates with the IdP, user login follows the SAML or OpenID Connect standard, with identity assertions issued by the IdP.

Using IQ MCP Server requires a Microsoft Entra work or school account, a tenant whose home region supports all Fabric workloads, and access to at least one report or semantic model; the content does not have to be placed on Fabric or Premium capacity.

Copilot Studio offers three authentication options: no authentication, Microsoft authentication (connecting to channels such as Teams, Power Apps, and Microsoft 365 Copilot via Entra ID), and manual authentication (supporting Entra ID or any OAuth2 identity provider).

Okta和Entra ID与RFC 7644的偏离主要体现在三个方面：操作语义（Okta偏好PATCH，Entra ID偏好PUT）、属性过滤（Entra ID可能发送RFC未强制要求的属性如manager，Okta可能省略某些标准属性）、错误处理（两个目录对端点错误码反应不同）。

一个实用的做法是在SCIM端点中同时支持PATCH和PUT，并在PATCH处理中显式检查active属性的任何操作；对于Entra ID的DELETE请求，实现软删除逻辑（标记为非活跃）而非物理删除，可以避免重试风暴。

当用户在Entra ID中被禁用或从供给范围中移除时，Entra ID可能发送active: false的PATCH，也可能直接停止发送请求，具体取决于配置是软删除还是硬删除；如果配置为硬删除，Entra ID可能发送DELETE请求。

Entra ID的SCIM供给服务更倾向于使用PUT操作来替换整个资源，而不是PATCH；其请求体包含完整的用户表示，如果端点在PUT处理中只更新部分字段可能意外覆盖已有数据。

如果SCIM端点未实现DELETE，Entra ID发送的DELETE请求会返回405，导致Entra ID重试并最终使该对象进入隔离状态。