Skip to main content

Connect a Squid MCP agent to Claude with Microsoft Entra ID

Expose a Squid agent as an MCP server secured by Microsoft Entra ID, and let users call it from Claude with their Entra account​

What you'll need​

  • An account in the Squid Console with an existing Squid agent that you can edit
  • A Microsoft Entra ID tenant where you can create app registrations, edit their manifests, and grant tenant-wide admin consent (for example, the Application Administrator or Cloud Application Administrator role)
  • A Claude plan that supports custom connectors.

This tutorial uses one Squid agent, one Squid Entra connector, and two Entra app registrations: one represents the protected API; the other identifies Claude.

An administrator performs the setup once. Users then connect in Claude and sign in with Entra.

  1. Prepare your Squid agent and production URL

    Create or select your agent in Squid Agent Studio, and verify it works using the Test button (see Create an AI agent).

    Create the MCP server by navigating to the agent's Settings tab. Scroll down and enable Expose as MCP Server. Copy your MCP URL once you have enabled this option. For example (see Exposing an agent as an MCP server for details):

    https://agents.example.com/mcp/support-agent

    Throughout this tutorial, MCP_URL means this URL, without a trailing slash. It must be reachable from Claude over HTTPS. Replace all placeholders and example URLs with your own values.

  2. Create the Entra API registration

    In Microsoft Entra admin center, open Entra ID → App registrations → New registration.

    Create an application named squid-mcp-api, select Accounts in this organizational directory only, and leave the redirect URI blank.

    Record its Directory (tenant) ID as TENANT_ID and Application (client) ID as API_CLIENT_ID.

    Open Manifest, set the existing api.requestedAccessTokenVersion property to 2, and save. Preserve the other manifest properties. This makes Entra issue the token version Squid expects (see Microsoft token-version documentation for more info).

    Next, under Expose an API, set Application ID URI to your exact MCP_URL. If you are reusing a registration with an existing identifier needed by another client, preserve that identifier and add MCP_URL to identifierUris in the manifest.

    Add an enabled scope with these values:

    FieldValue
    Scope namemcp.access
    Who can consentAdmins only
    Admin consent display nameAccess the Squid agent
    Admin consent descriptionAllow this application to call the Squid agent on behalf of the signed-in user

    The resulting full scope for the example URL is:

    https://agents.example.com/mcp/support-agent/mcp.access

    Use this complete URL-based scope consistently in Entra and Squid (see Microsoft scope setup).

  3. Create the Entra OAuth client registration for Claude

    Create another single-tenant app registration in the same tenant, named squid-mcp-claude.

    Choose Web as the redirect platform and enter the following as the Redirect URI:

    https://claude.ai/api/mcp/auth_callback

    This callback belongs to Anthropic (see Claude callback documentation). Record this app registration's client ID as CLAUDE_CLIENT_ID.

    Under Certificates & secrets → Client secrets → New client secret, create a secret and securely record its Value and expiration date. Claude will need the value shown when you create the connector.

    Under API permissions → Add a permission → My APIs, select squid-mcp-api, choose Delegated permissions → mcp.access, and add it. Then select Grant admin consent (see Microsoft permission setup for more info).

    Leave Allow public client flows disabled. This tutorial uses a confidential Web client with a secret.

  4. Create the Squid Entra integration

    In Squid, open Connectors → Available Connectors → Microsoft Entra ID → Add Connector. Squid receives the API registration's client ID. Claude receives the Claude registration's client ID and secret.

    FieldValue
    Integration IDentra-mcp
    Tenant IDTENANT_ID
    Client IDAPI_CLIENT_ID
    MCP ScopeYour complete MCP_URL/mcp.access

  5. Attach Entra to the MCP server

    Navigate to the agent's Settings and ensure the following values are set:

    SettingValue
    Expose as MCP ServerOn
    OAuth Integrationentra-mcp
    Require Agent API KeyOff

    Subsequent MCP calls will now authenticate through Entra. Keep Require Agent API Key off: when both are set, Squid accepts either credential, so the agent API key would bypass Entra. See Configuration options and Protecting the endpoint.

  6. Verify the advertised OAuth configuration

    Run:

    curl -fsS \
      '<MCP_URL>/.well-known/oauth-protected-resource'

    This is the OAuth 2.0 Protected Resource Metadata document that MCP clients use to discover the authorization server (see OAuth authentication). Check these values:

    Metadata fieldExpected value
    resourceExact MCP_URL
    authorization_serversArray containing https://login.microsoftonline.com/<TENANT_ID>/v2.0
    API scope in scopes_supportedExact MCP_URL/mcp.access

    The standard openid, profile, email, and offline_access scopes should also appear. The full API scope must match the scope exposed in Entra. Do not put only the standard identity scopes in Squid's MCP Scope field.

  7. Add the connector in Claude

    On an individual account, open Customize → Connectors → + → Add custom connector.

    For Team or Enterprise, an owner opens Organization settings → Connectors → Add → Custom → Web.

    Enter:

    FieldValue
    NameSquid Agent
    MCP server URLMCP_URL
    Advanced settings → OAuth Client IDCLAUDE_CLIENT_ID
    Advanced settings → OAuth Client SecretThe Claude registration's secret value

    Add the connector. Each user then selects Connect and signs in with their Entra account (see Claude connector instructions).

  8. Run a real tool call

    Start a Claude conversation and enable Squid Agent under + → Connectors.

    Ask Claude to use the connector for a task your agent supports. Approve the tool call if prompted, and verify that Claude actually invokes the tool and returns the agent's result.

    Confirm the corresponding execution appears in Squid's agent activity or traces.

The Entra client secret authenticates Claude to Entra during token acquisition. Squid receives a bearer token and checks its signature, configured tenant issuer, API audience, and expiration/not-before claims when present. Missing or invalid tokens receive 401 Unauthorized.