# Using on-behalf-of flow for Entra-based MCP servers

DevFeed: [Using on-behalf-of flow for Entra-based MCP servers](<https://devfeed.tech/articles/using-on-behalf-of-flow-for-entra-based-mcp-servers-21745.md>)

Original publisher: [Read original article](<http://blog.pamelafox.org/2026/01/using-on-behalf-of-flow-for-entra-based.html>)

Author: Pamela Fox (noreply@blogger.com)

Published: 2026-01-16T20:34:00Z

Content type: tutorial

Language: en

Sources: [Pamela Fox](<https://devfeed.tech/sources/pamela-fox.md>)

Topics: [Model Context Protocol (MCP)](<https://devfeed.tech/topics/model-context-protocol-mcp.md>), [Entra ID](<https://devfeed.tech/topics/entra-id.md>), [OAuth 2.0](<https://devfeed.tech/topics/oauth2.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Python](<https://devfeed.tech/topics/python.md>), [API](<https://devfeed.tech/topics/api.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [client](<https://devfeed.tech/topics/client.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [delegation](<https://devfeed.tech/tags/delegation.md>), [identity](<https://devfeed.tech/tags/identity.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [mcp-server](<https://devfeed.tech/tags/mcp-server.md>), [microsoft](<https://devfeed.tech/tags/microsoft.md>), [oauth2](<https://devfeed.tech/tags/oauth2.md>), [python](<https://devfeed.tech/tags/python.md>)

## AI overview

This tutorial explains how to use Microsoft Entra authentication and the OAuth on-behalf-of flow in a Python FastMCP server. It describes how an MCP server can use a user's identity to call another API, such as Microsoft Graph, and how FastMCP implements dynamic client registration through an OAuth proxy for arbitrary MCP clients.

## Source excerpt

In December, we presented a series about MCP, culminating in a session about adding authentication to MCP servers. I demoed a Python MCP server that uses Microsoft Entra for authentication, requiring users to first login to the Microsoft tenant before they could use a tool. Many developers asked how they could take the Entra integration further, like to check the user's group membership or query their OneDrive. That requires using an "on-behalf-of" flow, also known as "delegation" in OAuth, where the MCP server uses the user's identity to call another API, like the Microsoft Graph API. In this blog post, I will explain how to use Entra with OBO flow in a Python FastMCP server. How MCP servers can use Entra authentication The MCP authorization specification is based on OAuth2, but with some additional features tacked on top. Every MCP client is actually an OAuth2 client, and each MCP server is an OAuth2 resource server. MCP auth adds these features to help clients determine how to authorize a server: Protected resource metadata (PRM): Implemented on the MCP server, provides details about the authorization server and method Authorization server metadata: Implemented on the authorization server, gives URLs for OAuth2 endpoints Additionally, to allow MCP servers to work with arbitrary MCP clients, MCP auth supports either of these client registration methods: Dynamic Client Registration (DCR): Implemented on the authorization server, it can register new MCP clients as OAuth2 clients, even if it hasn't seen them before. Client ID Metadata Documents (CIMD): An alternative to DCR, this requires both the MCP client to make a CIMD document available on a server, and requires the authorization server to fetch the CIMD document for details about the client. Microsoft Entra does support authorization server metadata, but it does not support either DCR or CIMD. That's actually fine if you are building an MCP server that's only going to be used with pre-authorized clients, like i