Azure AD B2C

Warning

No longer recommended and replaced by Microsoft Entra External ID. Will be retired in May 2030.

To set up a single sign-on through Azure Active Directory B2C, go to the Azure portal.

Configure the authentication in the cluster configuration

In the cluster configuration file, you will have to fill in the following configuration by replacing the corresponding tags:

Authentication:
  Preset: AzureAdB2C
  Authority: https://xxx.b2clogin.com/xxx.onmicrosoft.com/B2C_1A_SIGNUP_SIGNIN/v2.0
  ClientId: [CLIENT_ID]
  ClientSecret: [CLIENT_SECRET]
  Scopes:
    - [CLIENT_ID]

Replace :

[CLIENT_ID] by the Application (client) ID of the cluster resource.
[CLIENT_SECRET] by the Client secret of the cluster resource.

Configure MCP client authentication

An external MCP client (for example Claude Code) authenticates as a public client: it uses PKCE instead of a client secret. Azure AD B2C custom policies never advertise the none token endpoint authentication method, even for an App Registration configured as a public client — the cluster's MCP endpoint compensates for this automatically (see Model Context Protocol (MCP)), but the App Registration itself still has to be set up as a genuine public client, separate from the confidential one used by the cluster's own web login.

Register a dedicated public client application

In the Azure portal, in App registrations, select New registration.
Give it a distinct name (for example [CLUSTER_NAME]-mcp) so it is not confused with the cluster's own (confidential) App Registration.
Under Manage, select Authentication.
Select Add a platform, then Mobile and desktop applications.
Add a loopback redirect URI with a fixed port, for example http://localhost:5001/callback (an MCP client normally picks a random port for its OAuth callback listener at every attempt; a fixed, pre-registered port is required since Azure AD B2C rejects a redirect URI that was not registered — see Configuring Claude Code for the flag that pins it).
Under Advanced settings, set Allow public client flows to Yes.
Under Manage, select API permissions, then grant this application the API scope exposed by the cluster's own (confidential) App Registration (the same scope you use for McpScopes below).

Configure the scope advertised to MCP clients

The cluster's own web login and an MCP client do not always request the same scope: the web login can use the bare Azure AD B2C App ID URI as its scope, while an MCP client needs the full API scope URI to be granted an access token for it. Configure the MCP-specific scope with McpScopes (see Configuration) instead of reusing Scopes, so a change made for one does not break the other:

Authentication:
  Preset: AzureAdB2C
  Authority: https://xxx.b2clogin.com/xxx.onmicrosoft.com/B2C_1A_SIGNUP_SIGNIN/v2.0
  ClientId: [CLIENT_ID]
  ClientSecret: [CLIENT_SECRET]
  Scopes:
    - [CLIENT_ID]
  McpScopes:
    - https://xxx.onmicrosoft.com/[CLIENT_ID]/[API_SCOPE_NAME]