Auth for agents and tools
Agents act on behalf of users, so every tool call needs a clear identity, scoped permissions and an audit trail.
Evolving: the basics hold, details shift. Reviewed 17 Oct 2026.
Key ideas
- Use OAuth 2.1 with PKCE for user-delegated access; request the narrowest scopes.
- Use token exchange (on-behalf-of) to call downstream APIs as the user rather than a shared service account.
- Entra ID / Azure AD: register the MCP server as an API, expose scopes, validate audience and issuer.
- Store refresh tokens in a secrets manager, never in prompts or logs.
- Audit log: user, agent, tool, arguments, result status.
Common mistakes
- One super-privileged service account for all tool calls, which lets any user reach any data through the agent.