Set up identity provider for MCP in Power Pages

This article shows you how to set up Microsoft Entra ID or Microsoft Entra External ID as an identity provider for your Power Pages site and configure it to expose the MCP scope. This is the first step for implementing MCP server in Power Pages.

You can choose between two options:

Microsoft Entra ID: Standard identity provider with simpler configuration
Microsoft Entra External ID: External customer identity and access management (CIAM) solution

Prerequisites

Before you begin, ensure you have:

A functional Power Pages site
Maker or admin access to the Power Pages environment
Access to an MCP protocol-compatible client (VS Code, Microsoft Copilot Studio)
Access to the Microsoft Entra admin center with permissions to create app registrations

Configure identity provider

In this section, you configure delegated access that MCP clients need to authenticate by using the Power Pages MCP server.

Microsoft Entra ID
Microsoft Entra External ID

If you want to use Microsoft Entra ID, follow the steps in the following sections to add a custom scope, create a new app registration, and assign delegated permissions.

Expose a custom scope

Sign in to the Microsoft Entra admin center, and go to App Registration.
Copy the application ID of the portal from Power Pages design studio Site Details and paste it in the search bar. Select the application.
On the overview page of the application, expand Manage, select Expose an API, and then select Add a scope.
On the Add a Scope pane, configure the following settings:
- Scope name: Enter an appropriate scope name.
- Who can consent: Select the option that works best for your organization.
- Admin consent display name: Enter an appropriate display name.
- Admin consent description: Enter an appropriate description.
- Select Add scope to complete.

Create a new app registration

Go to App Registration, and then select New Registration.
Enter a friendly name for your application (for example, MCP-Demo-Testing), and then select Register.

Assign delegated permissions to app registration

Select API permissions, and then select Add a permission.
On the Request API permissions tab, select APIs my organization uses, search for the name of the Microsoft Entra ID app that you created earlier, and select it.
Select the check box next to MCP and select Add permissions.
From the left navigation, select API permissions again, and then select Add a permission.
Select Microsoft APIs and then select Microsoft Graph.
Select Delegated permissions, select the check boxes next to openid and profile, and then select Add permissions.
Select Grant admin consent for [your tenant], and then select Yes to finish the permissions setup.

If you want to use Microsoft Entra External ID, follow the steps in this section to add a custom scope, create a new app registration, and assign delegated permissions.

Expose a custom scope

In the Microsoft Entra admin center, select App registrations from the navigation pane.
Select the existing Microsoft Entra External ID application in your external tenant (the same one you previously used to configure the External ID identity provider). You can refer to Configure site settings in Power Pages to locate your application.
Select the application, select Expose an API, and then select Add a scope.
In the Scope name field, enter a friendly name, for example mcp, and configure the following settings:
- Who can consent: Select the option that works for your organization.
- Admin consent display name: Enter an appropriate display name.
- Admin consent description: Enter an appropriate description.
- Select Add scope to complete.

Create a new app registration

Select App registrations, and then select New registration.
Enter a name for your application and then select Register.
Create a user flow by following the steps in create a user flow.
Add your application to the user flow by following the steps in add your application to the user flow.
In the Microsoft Entra admin center, go to App registrations, select All applications, and locate the application you created.

Assign delegated permissions to app registration

Select API permissions, and then select Add a permission.
On the Request API permissions tab, select APIs my organization uses, search for the name of the Microsoft Entra External ID app that you created earlier, and select it.
Select the check box next to MCP and select Add permissions.
From the left navigation, select API permissions again, and then select Add a permission.
Select Microsoft APIs and then select Microsoft Graph.
Select Delegated permissions, select the check boxes next to openid and profile, and then select Add permissions.
Select Grant admin consent for [your tenant], and then select Yes to finish the permissions setup.

Next steps

After you create and configure the third party app registration, configure the site settings for MCP server.

Configure site settings for MCP server

Feedback

Was this page helpful?

Last updated on 2026-02-10

Share via

Set up identity provider for MCP in Power Pages

Prerequisites

Configure identity provider

Expose a custom scope

Create a new app registration

Assign delegated permissions to app registration

Next steps

Feedback

Additional resources