Decisions and boundaries | Optional module: Azure API Center registry discovery for approved MCP servers

Chapter 4 of 6

Decisions and stop conditions#

Discovery scope#

Choose the API Center that already owns the API Center inventory. Record its name and region in the private copy of registry-client-settings.json. The generated endpoint must end with /workspaces/default/v0.1/servers.

Stop if the proposed path uses the portal hostname, the /mcp catalog endpoint, a shortened /default/v0.1/servers path, a nondefault workspace, or an undocumented API version.

Approval and lifecycle#

The server owner, runtime owner, and security owner decide when an MCP record may use the Production lifecycle stage. The ownership record names those roles and the next review date. Design, Preview, Deprecated, and ownerless records stay outside the discoverable condition.

Stop if Production is already used for another meaning, if a synchronized source can overwrite the lifecycle value without the approval path, or if the portal preview contains a record that is not in approvedServers.

Authentication and client access#

Use Microsoft Entra ID. The developer group receives Azure API Center Data Reader at the exact API Center resource scope. The client configuration pipeline resolves the portal application and tenant references from its approved private store.

Stop if anonymous access is enabled, if the role is assigned above the intended API Center scope, or if a client requires a secret to be committed in its configuration file.

Visibility boundary#

Configure two built-in Data API visibility conditions:

API type equals MCP.
Lifecycle stage equals Production.

Review the portal preview before saving. Microsoft documents that visibility applies globally to all users and related data-plane consumption features.

Stop if the current portal cannot express both conditions, if the conditions are combined in a way that exposes either all MCP records or all Production APIs, or if custom metadata is being treated as an authorization rule.

Client integration#

registry-client-settings.json is input to the approved client adapter. The client owner maps registry.endpoint and the Microsoft Entra references to the client's current supported settings.

Stop if the client silently falls back to a public registry, merges another registry without an owner decision, or stores an access token in source control.