一个60分钟的技术会议，讲述搭建基于Microsoft Entra ID的企业级MCP（模型上下文协议）服务器——涵盖身份、同意、授权、可审计性以及新的代理ID主体类型。

由梅里尔·费尔南多主持

录音室

幻灯片

查看幻灯片（PDF）|查看幻灯片（HTML）|幻灯片源代码（Marp）

你将学到的东西

1. MCP 认证的工作原理 —— PRM、ASM、CIMD（SEP-991）、DCR、资源指示器及规范的演变
2. Entra 适合（与不适合）——哪些支持，哪些不支持（CIMD、DCR），以及原因
3. 先选认证模型——标准认证与远程认证选项，决策树，先选一，再建
4. 参考架构——以Microsoft Graph MCP Server为范例，然后将其应用到你的API中
5. Entra代理ID——AI代理的新ServiceIdentity主体
6. 哪个Azure平台 – 函数 vs 应用服务 vs APIM vs 容器应用
7. 如何审计和扩展 ——图活动日志、Sentinel、多租户、缓存
8. 需要注意的事项——36个真实部署中的已知陷阱

仓库结构

知识库

Building MCPs with Entra: Design Choices for Enterprise Agents

A 60-minute technical session on building enterprise-grade MCP (Model Context Protocol) servers with Microsoft Entra ID – covering identity, consent, authorization, auditability, and the new Agent ID principal type.

Presented by Merill Fernando

Session Recording

Slides

View the slides (PDF) | View the slides (HTML) | Slide source (Marp)

What You’ll Learn

1. How MCP auth works – PRM, ASM, CIMD (SEP-991), DCR, Resource Indicators, and how the spec evolved
2. Where Entra fits (and doesn’t) – what’s supported, what’s not (CIMD, DCR), and why
3. Auth model first – stdio vs remote auth options, decision trees, choose before you build
4. Reference architecture – Microsoft Graph MCP Server as the exemplar, then apply it to your API
5. Entra Agent ID – the new ServiceIdentity principal for AI agents
6. Which Azure platform – Functions vs App Service vs APIM vs Container Apps
7. How to audit and scale – Graph Activity Logs, Sentinel, multi-tenant, caching
8. What to watch out for – 36 documented pitfalls from real deployments

Repo Structure

mcpentra/
├── slides/          # Marp slide deck (md, pdf, pptx, html)
├── docs/            # 17-document knowledge base with deep-dive content
└── demo/            # Contoso Directory MCP Server (TypeScript demo project)

Knowledge Base

The docs/ folder contains the full knowledge base behind the presentation:

Key Standards