Chapter 1 of 6
Module scope#
What we will do#
Objective. Give developers a controlled way to find MCP servers that already passed governance, without exposing draft or retired entries.
Configure Microsoft Entra-protected registry discovery for MCP servers with an approved API Center inventory record and runtime security decision. The API Center configuration owner limits Data API visibility to MCP records at the approved Production lifecycle stage, and the client owner configures supported developer clients to use the default-workspace MCP registry endpoint. The check then reads the full registry and confirms every approved server name appears with no unexpected name; it prints counts, not names or credentials.
Why it matters#
Problem. Developer clients need a controlled way to find approved MCP servers without listing draft or retired entries. Without that boundary, the registry can look like an approval system when it is only an inventory.
Solution. This module adds that boundary: Data API visibility limited to Production-stage MCP records, reached through Microsoft Entra sign-in.
Boundaries#
This module changes only Data API visibility and the developer registry client configuration for MCP servers already in the API Center inventory. A server becomes discoverable only after it passes the approved runtime control decision and moves to the Production lifecycle stage.
Azure API Center holds the registry contents, lifecycle state, Data API visibility, and portal access. Microsoft Entra ID holds sign-in state and the Azure API Center Data Reader assignment. The repository stores only the client settings and ownership record.
Discovery does not grant access to an MCP server or its tools, and it isn't a per-user allowlist. Runtime authentication, authorization, approval, and telemetry stay with the MCP tool security control and the server platform. The separate API Center MCP server at /mcp (Standard tier, broader catalog search) is out of scope.
Module preparation
Who should join
- API platform and developer-experience engineers
- MCP server owners and application security owners
- Developers who configure MCP-capable clients
What you need
- Session 07 has registered the approved remote or local MCP server in an Azure API Center default workspace.
- Session 08 has completed the runtime authorization, tool-boundary, and telemetry decisions for every discoverable MCP server.
- The API Center portal uses Microsoft Entra ID authentication; anonymous access is disabled.
- The developer access group has the Azure API Center Data Reader role at the exact API Center resource scope.
- An API Center configuration owner can update API visibility and MCP Registry settings through the approved Azure portal change path.
- The client owner has a supported MCP registry integration or approved adapter that reads
registry-client-settings.json.