Azure AI Foundry Agent execution fails for MCP RemoteTool connection with OAuth2: uses oauth2 which is not allowed by feature flag

Salazar Lerma, Jaime Andres 0 Puntos de reputación
2026-05-15T10:41:40.73+00:00

Hello Microsoft Support,

We are requesting confirmation and guidance regarding a failure in Azure AI Foundry when invoking an agent configured to use a remote MCP tool connection authenticated with OAuth2.

Issue summary: During agent execution, Azure AI Foundry rejects the configured MCP RemoteTool connection with the following error:

uses oauth2 which is not allowed by feature flag

Based on our validation, the failure appears to occur before the OAuth flow is completed. The platform recognizes the connection as OAuth2, but blocks its use due to a feature-flag restriction.

Environment details: REMOVED PII

Affected connection details:

  • Connection name: RespiraMCP
  • Connection category/type: RemoteTool
  • Authentication type: OAuth2
  • MCP endpoint: https://efen-mcp-server.sdigitaldev.sener/mcp

Associated OAuth/OpenID Connect configuration:

  • Authorization endpoint: https://efen-back.sdigitaldev.sener/connect/authorize
  • Token endpoint: https://efen-back.sdigitaldev.sener/connect/token
  • OpenID configuration metadata: https://efen-back.sdigitaldev.sener/.well-known/openid-configuration

Validation already completed:

  • The OpenID Connect discovery endpoint is reachable and returns valid metadata.
  • The metadata correctly exposes at least the following fields:
    • issuer
      • authorization_endpoint
        • token_endpoint
          • jwks_uri
          • Current evidence indicates the issue is not caused by malformed OAuth/OIDC metadata, but rather by a platform-side restriction tied to feature availability.

We would appreciate confirmation on the following points:

  1. Is the use of Azure AI Foundry agent connections of type RemoteTool with authType=OAuth2 currently supported?
  2. If supported, is this capability gated by a feature flag, private preview, regional availability, subscription eligibility, or project/resource-level enablement?
  3. If a feature flag or additional prerequisite is required, what is the exact process to request or enable it for this subscription/resource/project?
  4. If this scenario is not currently supported, what supported alternative do you recommend for securing a remote MCP tool connection used by Azure AI Foundry agents?

If useful for investigation, we can provide additional execution timestamps, request correlation IDs, screenshots, or exported connection configuration details.

Regards,

Jaime Salazar

Foundry Tools
Foundry Tools

Anteriormente conocido como servicios de Azure AI o Azure Cognitive Services es una colección unificada de funcionalidades de IA precompiladas dentro de la plataforma Microsoft Foundry.

1 respuesta

Ordenar por: Lo más útil
Lo más útil Más reciente Menos reciente
  1. Anshika Varshney 15,625 Puntos de reputación Personal externo de Microsoft Moderador
    2026-05-15T11:56:54.91+00:00

    Hi Salazar Lerma, Jaime Andres,

    This looks like a common issue when using Azure AI Foundry agents with MCP remote tools. I’ll explain it in a simple way and share some practical things you can check.

    What is happening here

    When an agent calls an MCP remote tool, the flow looks like this:

    • Agent runs your prompt
    • Agent connects to MCP endpoint
    • MCP tool executes and returns response

    If execution fails, it usually means something in this chain is not working properly, such as connection, configuration, or response format.

    Common causes and what to check

    1. MCP endpoint accessibility

    Make sure your MCP server is reachable from the agent environment

    Check:

    • endpoint URL is correct
    • no network restrictions or firewall blocks
    • service is actually running

    If the agent cannot reach the endpoint, execution will fail before any tool logic runs

    1. Authentication or permissions

    If MCP requires authentication:

    • verify API keys or tokens are valid
    • check if headers or credentials are correctly passed
    • confirm the agent has permission to call the endpoint

    Authentication issues often cause silent failures or generic errors

    1. Tool configuration in Foundry

    Sometimes the issue comes from how the tool is configured

    Check:

    • tool name matches exactly
    • correct schema or parameters are defined
    • input format matches what MCP expects

    If the schema and actual payload do not match, the agent may fail to execute the tool

    1. Request and response format

    MCP tools usually expect structured input and output

    Check:

    • request format is valid JSON
    • response structure is correct and complete
    • no missing fields or invalid types

    If the response is not in expected format, agent execution can fail

    1. Timeout or latency issues

    If the MCP endpoint takes too long:

    • agent may timeout
    • execution will fail even if the tool works eventually

    Try:

    • reducing processing time
    • checking logs for long-running operations
    1. Logs and diagnostics

    This is very helpful for identifying root cause

    • check agent execution logs in Foundry
    • check MCP server logs
    • compare request and response

    Logs usually show if the failure happened:

    • before calling the tool
    • during execution
    • or while parsing the response

    Practical troubleshooting approach

    You can follow this simple flow:

    1. Test MCP endpoint separately using REST tool or curl
    2. Verify request and response format
    3. Check authentication and headers
    4. Review agent logs for exact failure point
    5. Validate tool configuration in Foundry

    Useful documentation

    You can refer to:

    These explain how agents interact with external tools and how to configure them correctly.

    Simple summary

    • Agent failure usually means MCP tool is not reachable or not configured correctly
    • Most issues are related to endpoint, authentication, or response format
    • Start by testing the MCP endpoint separately and then validate integration step by step

    Hope this helps you narrow down the issue. Do let me know if you have any further queries.

    If you share the exact error message, it will be easier to guide more precisely.

    Thankyou!

    ¿Le resultó útil esta respuesta?

Su respuesta

Las respuestas pueden ser marcadas como Respuestas aceptadas por el autor de la pregunta, lo que indica a los usuarios que la respuesta resolvió su problema.