Skip to main content
AI Data Engine

Configure Microsoft Entra ID for AI Data Engine governed AI access

Contributors netapp-dbagwell
PDFs

Governed AI access in AI Data Engine (AIDE) uses Microsoft Entra ID to authenticate users. As a Microsoft Entra ID administrator, you register AI Data Engine in the Microsoft Entra admin center, define the scope and the app role, and add redirect URIs for your AI clients so that users can sign in and work with their authorized collections.

When you finish, give the values that you record to the AI Data Engine administrator, who connects AI Data Engine to Entra ID in NetApp Console. Refer to Connect AI Data Engine to Microsoft Entra ID.

Before you begin

  • You have a Microsoft Entra ID tenant and a role that lets you register applications and grant consent in that tenant, such as Application Administrator or Cloud Application Administrator.

  • You have the AIDE cluster host name that the AI Data Engine administrator set up in Prepare the MCP host. The host name must be on a registered DNS domain that is verified in your Entra ID tenant.

How MCP access works

AI Data Engine doesn't issue tokens and doesn't hold a secret. It validates the Entra ID access tokens that AI clients present. When a user connects an AI client, the user signs in with Microsoft Entra ID, and Entra ID issues an access token for the AI Data Engine application. AI Data Engine checks the token against your Entra ID tenant and lets the client work only with the collections whose granted scopes match.

You register one dedicated application in Entra ID for each AI Data Engine instance. If you have more than one AI Data Engine installation, register a separate application for each one, because the Application ID URI is built from the host name of that instance. The application defines the Application ID URI, the scope, and the app role, and its Application (client) ID is the client ID that the AI Data Engine administrator enters in NetApp Console and that users enter in their AI clients.

Microsoft Entra ID is the only identity provider that AIDE governed AI access supports.

NetApp Console doesn't create or change Entra ID app registrations. You complete all of the Entra ID tasks in this topic manually in the Microsoft Entra admin center.

Register the AI Data Engine application and define its scope

Register a dedicated application for the AI Data Engine instance, set its Application ID URI, and define the power_users scope. Complete this task once for each AI Data Engine instance. If you have more than one instance, register a separate application for each instance, and use a name that identifies the instance.

AI Data Engine recognizes the power_users delegated scope. You define the scope on the application registration in Entra ID. The scope doesn't map to a NetApp Console role, and the scope name must match exactly, including the plural form.

The power_users scope requests a power-user session. A power-user session can search file metadata in the collections that you grant the scope access to, list tags, create tags, and add tags to or remove tags from files. AI Data Engine grants a power-user session only if the user also holds the AIDEPowerUsers app role. Refer to Create and assign the power-user app role.

The full scope value that AI clients request is the Application ID URI plus /power_users: https://<host>/mcp/tools/power_users. AI clients must request this exact value.

Note Microsoft might change the Microsoft Entra ID UI, so these steps might differ from what you see. The essential configurations remain the same.
Steps

  1. In the Microsoft Entra admin center, go to App registrations and select New registration.

  2. Enter a name, such as NetApp AI Data Engine MCP - <instance>, select Single tenant only, and select Register. Use an application that is dedicated to this AI Data Engine instance.

  3. On the Overview page, record the Application (client) ID and the Directory (tenant) ID. The AI Data Engine administrator enters both values in NetApp Console, and users enter the Application (client) ID as the client ID in their AI clients.

  4. Open Manifest, set requestedAccessTokenVersion to 2, and save. AI Data Engine accepts only v2.0 access tokens.

  5. Open Expose an API and select Add next to Application ID URI. Enter https://<host>/mcp/tools, where <host> is the AIDE cluster host name that you set up in Prepare the MCP host, and save. Record this URI; AI clients use it to build the scope that they request.

    The domain of the host name must be verified in your Entra ID tenant. Entra ID accepts an Application ID URI only on a verified domain.

    Note If Entra ID rejects the URI with the error Failed to add identifier URI, make sure that requestedAccessTokenVersion is set to 2 and that the domain is verified in your tenant, and then try again.

  6. In Expose an API, select Add a scope and add the power_users scope:

    • Who can consent: Admins and users, or Admins only to restrict consent

    • Admin consent display name: Access AIDE as a Power User

    • Admin consent description: Allows the app to access NetApp AI Data Engine as a power user on behalf of the signed-in user.

    • User consent display name and User consent description: If you select Admins and users, enter text that users see when they consent.

    • State: Enabled

    • Select Add scope.

  7. Optional: To skip the consent prompt for users, under Authorized client applications, select Add a client application, enter the Application (client) ID of this application, select the power_users scope, and select Add application.

Create and assign the power-user app role

Create the power-user app role on the AI Data Engine application, and assign it to the users or groups who use governed AI access. The app role name must match exactly, including the plural form.

Steps

  1. Open App roles and select Create app role:

    • Display name: AIDE Power Users

    • Allowed member types: Users/Groups

    • Value: AIDEPowerUsers

    • Description: Grants power-user sessions in AI Data Engine.

    • Select Do you want to enable this app role?, and then select Apply.

  2. Go to Entra ID > Enterprise apps > All applications, open the AI Data Engine application, and select Users and groups > Add user/group. Select the users or groups who use governed AI access, select the AIDE Power Users role, and select Assign.

To assign the app role to groups instead of individual users, your tenant needs Microsoft Entra ID P1 or P2. Assignment to a group doesn't apply to the members of nested groups.

Important Assigning the app role, not only defining it, is required. A user who doesn't hold the app role doesn't get a power-user session.
How power-user sessions work

A user gets a power-user session only when both of these are true:

  • The user holds the AIDEPowerUsers app role.

  • The AI client requests the power_users scope.

If a client requests power_users for a user who doesn't hold the role, AI Data Engine doesn't start a power-user session for the user.

Add redirect URIs for your AI clients

Add the redirect URIs that your AI clients use to the AI Data Engine application, and allow public client flows. AI clients sign in with the AI Data Engine application's Application (client) ID. They use PKCE, so you don't create a client secret.

Steps

  1. In the Microsoft Entra admin center, open the AI Data Engine application and go to Authentication.

  2. Select Add a platform > Mobile and desktop applications, and add the redirect URIs for the AI clients that you use. Add one URI for each callback that a client uses:

    Client Redirect URI

    Claude Desktop

    http://localhost:6491/oauth/callback

    Claude Code

    http://localhost:8080/callback

    Cursor

    http://localhost:8787/callback

    OpenCode

    http://127.0.0.1:19876/callback

  3. Optional: If users also sign in from Cursor on the web or from Cursor Agents, select Add a platform > Web, and add https://www.cursor.com/agents/mcp/oauth/callback.

  4. On the Settings tab, set Allow public client flows to Yes, and save.

  5. Under API permissions, add the Microsoft Graph delegated permission offline_access so that the client can refresh tokens without asking the user to sign in again.

  6. If your tenant requires admin consent, select Grant admin consent.

If sign-in fails with error AADSTS50011, the callback URI of the AI client isn't registered. The error shows the exact URI to add. Add it under Mobile and desktop applications, and use the same port in the client configuration that you register here.

Token expectations

AI clients must send an Entra ID access token in the Authorization: Bearer header of each request. AI Data Engine validates the token on every request. It accepts a token only if all of these are true:

  • The signature is valid, and the token is a v2.0 token issued by your Entra ID tenant (issuer).

  • Its audience (aud) matches the Application (client) ID of the AI Data Engine application.

  • It hasn't expired. Entra ID access tokens typically last about one hour. Clients that request offline_access can refresh tokens without asking the user to sign in again.

A token for a power-user session carries the power_users scope in its scp claim and the AIDEPowerUsers app role in its roles claim.

If a token is missing, expired, or invalid, AI Data Engine returns 401 Unauthorized. A 401 response after sign-in usually means that Entra ID issued a v1 token, or that the tenant ID or Application (client) ID in AI Data Engine doesn't match your Entra ID application. Confirm that requestedAccessTokenVersion is set to 2 and that the identity provider values in NetApp Console match.

If AI Data Engine can't verify a user's identity or scope, it returns no data from the collection.

You don't need to configure optional claims in Entra ID for AI Data Engine to accept a token.

Give the values to the AI Data Engine administrator

Give the AI Data Engine administrator the following values. The administrator needs them to connect AI Data Engine to Entra ID and to configure collections for MCP:

  • The Directory (tenant) ID

  • The Application (client) ID

  • The Application ID URI, https://<host>/mcp/tools

  • The full scope value, https://<host>/mcp/tools/power_users

What's next

The AI Data Engine administrator connects AI Data Engine to Microsoft Entra ID.