fix(MCP): Fix ManagedServiceIdentity auth for Consumption MCP connections#9208
Open
rllyy97 wants to merge 1 commit into
Open
fix(MCP): Fix ManagedServiceIdentity auth for Consumption MCP connections#9208rllyy97 wants to merge 1 commit into
rllyy97 wants to merge 1 commit into
Conversation
…9205) Align Consumption connector with Standard for MCP connections: - Managed MCP path: build connectionProperties with MSI auth and user-assigned identity from WorkflowService().getAppIdentity() - Built-in MCP _buildMcpAuthentication: add WorkflowService fallback for identity when not in parameterValues - Remove debug console.log statements - Update tests with WorkflowService mock initialization
Contributor
🤖 AI PR Validation ReportPR Review ResultsThank you for your submission! Here's detailed feedback on your PR title and body compliance:✅ PR Title
✅ Commit Type
✅ Risk Level
✅ What & Why
✅ Impact of Change
✅ Test Plan
|
| Section | Status | Recommendation |
|---|---|---|
| Title | ✅ | No change needed |
| Commit Type | ✅ | No change needed |
| Risk Level | ✅ | No change needed |
| What & Why | ✅ | No change needed |
| Impact of Change | ✅ | No change needed |
| Test Plan | ✅ | Unit tests in diff satisfy the test plan |
| Contributors | Optional: add contributors if applicable | |
| Screenshots/Videos | ✅ | No visual changes, N/A is fine |
This PR passes review for title/body compliance. The advised risk level matches the submitted risk level.
Last updated: Fri, 22 May 2026 02:35:48 GMT
Contributor
📊 Coverage CheckThe following changed files need attention:
Please add tests for the uncovered files before merging. |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR fixes Consumption SKU MCP tool discovery failures when using ManagedServiceIdentity authentication by ensuring the listMcpTools request includes the appropriate identity (especially for user-assigned managed identities), aligning Consumption behavior more closely with the Standard connector path.
Changes:
- For managed MCP connections, enriches the
managedConnectionpayload withconnectionProperties.authenticationand (when applicable) the user-assigned identity derived fromWorkflowService().getAppIdentity(). - For built-in MCP connections, updates
_buildMcpAuthenticationto fall back to the workflow app’s managed identity configuration when the identity isn’t present in connection parameter values. - Updates Consumption connector unit tests to initialize
WorkflowServicewhere needed.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
| libs/logic-apps-shared/src/designer-client-services/lib/consumption/connector.ts | Adds workflow-identity-derived MSI identity into listMcpTools payloads for both managed and built-in MCP paths. |
| libs/logic-apps-shared/src/designer-client-services/lib/consumption/tests/connector.spec.ts | Initializes WorkflowService in tests and updates expectations for the managed MCP payload shape. |
Bhavd13
reviewed
May 22, 2026
| const identity = WorkflowService().getAppIdentity?.(); | ||
| const userIdentity = | ||
| equals(identity?.type, ResourceIdentityType.USER_ASSIGNED) && identity?.userAssignedIdentities | ||
| ? Object.keys(identity.userAssignedIdentities)[0] |
Contributor
There was a problem hiding this comment.
If the workflow will have multiple user managed identities, this will select the first one by default, irrespective of what user selected. Should we change this to selected user choice?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Commit Type
Risk Level
What & Why
Fixes #9205 — MCP connections using ManagedServiceIdentity auth in Consumption SKU are missing the
identityfield in thelistMcpToolsAPI request, causing failures for user-assigned managed identity scenarios.The Consumption connector's MCP handling had two gaps compared to the Standard connector:
{ connection: { id } }withoutconnectionPropertiesor authentication info, so the backend had no identity context._buildMcpAuthenticationonly read identity fromconnectionProperties['identity'](which is never populated by the MCP manifest), with no fallback to the workflow's managed identity configuration.This PR aligns Consumption with Standard by calling
WorkflowService().getAppIdentity()to derive the user-assigned identity resource ID in both paths.Impact of Change
listMcpToolsrequest, unblocking tool discovery.WorkflowServiceandResourceIdentityTypeare now imported in the Consumption connector service.WorkflowService().getAppIdentity()which is already available in all host environments.Test Plan
Updated
connector.spec.tswithInitWorkflowServicemock for managed MCP and_buildMcpAuthenticationMSI test blocks. All 68 tests pass (38 Consumption + 30 Standard).Contributors
Screenshots/Videos
N/A — no visual changes.