Dev.to
7/8/2026
mcp-sso: bridging MCP client OAuth with Entra ID and Cloudflare Access
Original: MCP clients can't easily authenticate with Entra. Here's the bridge.
Short summary
The MCP spec mandates OAuth 2.1, but enterprise identity providers like Entra ID and Cloudflare Access lack Dynamic Client Registration, breaking the seamless paste-a-URL onboarding experience. mcp-sso is an open-source bridge that speaks DCR+PKCE to MCP clients while verifying identity against your real IdP and minting scoped tokens that never expose upstream credentials. It has been tested end-to-end against five real MCP clients including Claude Code, ChatGPT, and Codex CLI with both Cloudflare Access and Entra ID tenants.
- •MCP clients need OAuth 2.1 with DCR, but Entra ID and Cloudflare Access don't support it
- •mcp-sso bridges the gap by acting as an OAuth server to clients while delegating identity verification to your real IdP
- •Tested against Claude Code, Codex CLI, claude.ai, ChatGPT, and MCP SDK with Cloudflare Access and Entra ID
Generated with AI, which can make mistakes.
Is this a good recommendation for you?
