<\/p>\n\n\n\n
Here\u2019s a Mermaid<\/strong> sequence diagram showing the flow:<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n walk you through every single step<\/strong> to set up OAuth correctly for your Azure Function App \u2192 MCP \u2192 Azure AI Search (private endpoints) \u2192 Blob Storage<\/strong> architecture.<\/p>\n\n\n\n This will be end-to-end<\/strong>, so you can follow it without missing anything. You have two main options:<\/p>\n\n\n\n If you can, use Managed Identity<\/strong> \u2014 it avoids most OAuth pitfalls. Whether using Managed Identity or App Registration:<\/p>\n\n\n\n OAuth endpoints are public<\/strong> \u2014 even if Search and Blob are private.<\/p>\n\n\n\n In Function App \u2192 Configuration \u2192 Application settings<\/strong>:<\/p>\n\n\n\n Client Credentials Example:<\/strong><\/p>\n\n\n\n Managed Identity Example:<\/strong><\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n proceed<\/strong> and finish the OAuth setup guide<\/strong> with the final implementation, validation, and troubleshooting steps<\/strong> so you can be 100% confident it\u2019s working in your Before wiring it into MCP or your production code, test the token manually.<\/p>\n\n\n\n From Function App Kudu Console or Cloud Shell:<\/strong><\/p>\n\n\n\n ✅ Expected:<\/strong> JSON with Once you have the token:<\/p>\n\n\n\n ✅ Expected:<\/strong> JSON listing indexes. If your Search indexer pulls from Blob Storage:<\/p>\n\n\n\n ✅ Expected:<\/strong> XML listing blobs. Once OAuth works in isolation:<\/p>\n\n\n\n Run this inside your Function App<\/strong> to confirm all hops:<\/p>\n\n\n\n ✅ If this works<\/strong> \u2014 OAuth is fully configured and your Function App can securely talk to Azure AI Search over private endpoints.<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n the OAuth handshake diagram<\/strong> for your This will clearly show your private endpoint traffic<\/strong> vs public OAuth traffic<\/strong>, so your network\/security team<\/strong> can validate the flow.<\/p>\n\n\n\nMermaid
sequenceDiagram
participant User as Website (Browser)
participant MCP as MCP Service (Private Endpoint)
participant Func as Azure Function App
participant OAuth as Azure Entra ID (OAuth)
participant Search as Azure AI Search (Private Endpoint)
participant Blob as Azure Blob Storage (Private Endpoint)
User->>MCP: HTTPS Request (Authenticated via OAuth)
MCP->>OAuth: OAuth Token Request (Client Credentials \/ Auth Code)
OAuth-->>MCP: Access Token (Bearer)
MCP->>Func: Forward Request with Token
Func->>Search: REST API Call (Index Query\/Run) with Token
Search->>Blob: Read Files from Blob Storage
Blob-->>Search: File Content
Search-->>Func: Search Results \/ Indexing Status
Func-->>MCP: Response
MCP-->>User: Final Response
<\/code><\/pre>\n\n\n\n2. Class Diagram<\/strong><\/h2>\n\n\n\n
MermaidCopy code
classDiagram
class Website {
+sendRequest()
+displayResults()
}
class MCPService {
+authenticateWithOAuth()
+forwardRequest()
+enforcePrivateEndpoint()
}
class AzureFunctionApp {
+triggerIndexer()
+callSearchAPI()
+handleOAuthToken()
}
class AzureAIsearch {
+runIndexer()
+queryIndex()
+connectToBlob()
}
class BlobStorage {
+listFiles()
+readFile()
}
class AzureEntraID {
+issueToken()
+validateToken()
}
Website --> MCPService
MCPService --> AzureFunctionApp
AzureFunctionApp --> AzureAIsearch
AzureAIsearch --> BlobStorage
MCPService --> AzureEntraID
AzureFunctionApp --> AzureEntraID<\/code><\/pre>\n\n\n\n
\n\n\n\n
\n\n\n\n
\n\n\n\n
We\u2019ll cover App Registration<\/strong>, Permissions<\/strong>, Network<\/strong>, Function App config<\/strong>, and Testing<\/strong>.<\/p>\n\n\n\nStep-by-Step OAuth Setup<\/strong><\/h2>\n\n\n\n
1. Plan Your Authentication Flow<\/strong><\/h3>\n\n\n\n
\n
If you must use Client Credentials, follow all steps below.<\/p>\n\n\n\n2. Create \/ Configure Azure Entra ID App Registration<\/strong><\/h3>\n\n\n\n
\n
FunctionApp-MCP-Search-Blob<\/code><\/li>\n\n\n\n\n
\n
client_credentials<\/code> flow, you can skip this.<\/li>\n\n\n\nauthorization_code<\/code> flow (browser-based), set it to your MCP or Function App callback URL exactly.<\/li>\n<\/ul>\n<\/li>\n\n\n\n3. Add API Permissions<\/strong><\/h3>\n\n\n\n
\n
\n
user_impersonation<\/code> (or use .default<\/code> scope later).<\/li>\n\n\n\nuser_impersonation<\/code>.<\/li>\n<\/ul>\n<\/li>\n\n\n\n4. Create Client Secret (if not using Managed Identity)<\/strong><\/h3>\n\n\n\n
\n
FunctionAppSecret<\/code><\/li>\n\n\n\n5. Assign Roles to the Identity<\/strong><\/h3>\n\n\n\n
\n
6. Configure Network for OAuth<\/strong><\/h3>\n\n\n\n
\n
\n
login.microsoftonline.com<\/code><\/li>\n\n\n\nlogin.microsoft.com<\/code><\/li>\n\n\n\nsts.windows.net<\/code><\/li>\n<\/ul>\n<\/li>\n\n\n\n\n
microsoftonline.com<\/code>.<\/li>\n\n\n\nprivatelink.search.windows.net<\/code> and privatelink.blob.core.windows.net<\/code> resolve to private IPs.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n7. Configure Azure Function App Settings<\/strong><\/h3>\n\n\n\n
\n
TENANT_ID=<your-tenant-id> CLIENT_ID=<your-app-registration-client-id> CLIENT_SECRET=<your-client-secret> SEARCH_SERVICE=<your-search-service-name><\/code><\/li>\n\n\n\nSEARCH_SERVICE=<your-search-service-name><\/code><\/li>\n\n\n\n8. Implement OAuth in Code<\/strong><\/h3>\n\n\n\n
PythonCopy code
from azure.identity import ClientSecretCredential\nimport requests, os\n\ntenant_id = os.environ[\"TENANT_ID\"]\nclient_id = os.environ[\"CLIENT_ID\"]\nclient_secret = os.environ[\"CLIENT_SECRET\"]\nsearch_service = os.environ[\"SEARCH_SERVICE\"]\n\ncred = ClientSecretCredential(tenant_id, client_id, client_secret)\ntoken = cred.get_token(\"https:\/\/search.azure.com\/.default\")\n\nurl = f\"https:\/\/{search_service}.search.windows.net\/indexes?api-version=2023-11-01\"\nheaders = {\"Authorization\": f\"Bearer {token.token}\"}\nr = requests.get(url, headers=headers)\nprint(r.status_code, r.text)\n<\/code><\/pre>\n\n\n\nPythonCopy code
from azure.identity import ManagedIdentityCredential\nimport requests, os\n\nsearch_service = os.environ[\"SEARCH_SERVICE\"]\n\ncred = ManagedIdentityCredential()\ntoken = cred.get_token(\"https:\/\/search.azure.com\/.default\")\n\nurl = f\"https:\/\/{search_service}.search.windows.net\/indexes?api-version=2023-11-01\"\nheaders = {\"Authorization\": f\"Bearer {token.token}\"}\nr = requests.get<\/code><\/pre>\n\n\n\n
\n\n\n\n
Azure Function App \u2192 MCP \u2192 Azure AI Search (private endpoints) \u2192 Blob Storage<\/strong> flow.<\/p>\n\n\n\n9. Validate OAuth Token<\/strong><\/h2>\n\n\n\n
BashCopy code
curl -X POST \\\n -H \"Content-Type: application\/x-www-form-urlencoded\" \\\n -d \"client_id=$CLIENT_ID\" \\\n -d \"client_secret=$CLIENT_SECRET\" \\\n -d \"scope=https:\/\/search.azure.com\/.default\" \\\n -d \"grant_type=client_credentials\" \\\n https:\/\/login.microsoftonline.com\/$TENANT_ID\/oauth2\/v2.0\/token\n<\/code><\/pre>\n\n\n\naccess_token<\/code> and expires_in<\/code>.
❌ If fails:<\/strong><\/p>\n\n\n\n\n
TENANT_ID<\/code>, CLIENT_ID<\/code>, CLIENT_SECRET<\/code> values.<\/li>\n\n\n\nlogin.microsoftonline.com<\/code> is allowed.<\/li>\n\n\n\n10. Test Azure AI Search API with Token<\/strong><\/h2>\n\n\n\n
BashCopy code
curl -X GET \\\n -H \"Authorization: Bearer <access_token>\" \\\n \"https:\/\/<search-service>.search.windows.net\/indexes?api-version=2023-11-01\"\n<\/code><\/pre>\n\n\n\n
❌ If fails with 403\/401:<\/strong><\/p>\n\n\n\n\n
https:\/\/search.azure.com\/.default<\/code>.<\/li>\n\n\n\n11. Test Blob Storage Access (If Indexer Reads from Blob)<\/strong><\/h2>\n\n\n\n
BashCopy code
curl -X GET \\\n -H \"Authorization: Bearer <access_token>\" \\\n \"https:\/\/<storage-account>.blob.core.windows.net\/<container>?restype=container&comp=list\"\n<\/code><\/pre>\n\n\n\n
❌ If fails:<\/strong><\/p>\n\n\n\n\n
12. Integrate with MCP<\/strong><\/h2>\n\n\n\n
\n
login.microsoftonline.com<\/code>.<\/li>\n<\/ul>\n\n\n\n13. Common Pitfalls Checklist<\/strong><\/h2>\n\n\n\n
Issue<\/th> Symptom<\/th> Fix<\/th><\/tr><\/thead> Private DNS hijacking<\/strong><\/td> DNS to login.microsoftonline.com<\/code> resolves to private IP<\/td>Remove private zone for microsoftonline.com<\/code><\/td><\/tr>Outbound HTTPS blocked<\/strong><\/td> Curl to OAuth endpoint fails<\/td> Update NSG\/firewall to allow port 443<\/td><\/tr> Wrong scope<\/strong><\/td> Token works but API returns 401<\/td> Use https:\/\/search.azure.com\/.default<\/code><\/td><\/tr>Missing admin consent<\/strong><\/td> Token request fails with AADSTS65001<\/code><\/td>Grant admin consent in Entra ID<\/td><\/tr> Role missing<\/strong><\/td> Token works but API returns 403<\/td> Assign Search Index Data Contributor \/ Blob Data Reader<\/td><\/tr> Expired secret<\/strong><\/td> Token request fails<\/td> Rotate client secret<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n 14. Final Verification Flow<\/strong><\/h2>\n\n\n\n
PythonCopy code
from azure.identity import ClientSecretCredential, ManagedIdentityCredential\nimport os, requests\n\nsearch_service = os.environ[\"SEARCH_SERVICE\"]\nscope = \"https:\/\/search.azure.com\/.default\"\n\nif os.environ.get(\"CLIENT_SECRET\"):\n cred = ClientSecretCredential(\n os.environ[\"TENANT_ID\"],\n os.environ[\"CLIENT_ID\"],\n os.environ[\"CLIENT_SECRET\"]\n )\nelse:\n cred = ManagedIdentityCredential()\n\ntoken = cred.get_token(scope)\nprint(\"✅ Token acquired\")\n\nurl = f\"https:\/\/{search_service}.search.windows.net\/indexes?api-version=2023-11-01\"\nheaders = {\"Authorization\": f\"Bearer {token.token}\"}\nr = requests.get(url, headers=headers)\nprint(f\"Search API status: {r.status_code}\")\nprint(r.text[:200] + \"...\")\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
\n\n\n\n
Azure Function App \u2192 MCP \u2192 Azure AI Search (private endpoints) \u2192 Blob Storage<\/strong> setup.<\/p>\n\n\n\nMermaid OAuth Handshake Diagram<\/strong><\/h2>\n\n\n\n
MermaidCopy code
sequenceDiagram\n participant User as Website (Browser)\n participant MCP as MCP Service (Private Endpoint)\n participant Func as Azure Function App (VNet Integrated)\n participant OAuth as Azure Entra ID (Public Endpoint)\n participant Search as Azure AI Search (Private Endpoint)\n participant Blob as Azure Blob Storage (Private Endpoint)\n\n User->>MCP: HTTPS Request (User Action)\n MCP->>Func: Forward API Request\n Note over Func,OAuth: Step 1: Function App requests OAuth token
via Client Credentials or Managed Identity\n Func->>OAuth: POST \/{tenant}\/oauth2\/v2.0\/token (Public Internet)\n OAuth-->>Func: Access Token (Bearer)\n Note over Func,Search: Step 2: Function App calls Azure AI Search
over Private Endpoint with token\n Func->>Search: GET \/indexes?api-version=2023-11-01 (Bearer token)\n Search->>Blob: Read files from Blob Storage (Private Endpoint)\n Blob-->>Search: File Content\n Search-->>Func: Search Results \/ Indexing Status\n Func-->>MCP: Response\n MCP-->>User: Final Response\n<\/code><\/pre>\n\n\n\nKey Points for Security Review<\/strong><\/h2>\n\n\n\n