Skip to main content
AI Data Engine

Connect AI Data Engine to Microsoft Entra ID for governed AI access

Contributors netapp-dbagwell
PDFs

Connect Microsoft Entra ID to AI Data Engine (AIDE) as an identity provider so that you can authenticate users and control which collections they can work with through the Model Context Protocol (MCP). As an AI Data Engine administrator, you set up the identity provider, configure collections for MCP, and verify your configuration in NetApp Console.

Governed AI access uses Entra ID to authenticate users, and the scopes that you include for each collection determine which collections a user can work with through MCP.

Before you begin

  • You must have the AI Data Engine administrator role.

  • AI Data Engine is deployed and has scanned at least one data source. Refer to Connect a data source.

  • The AIDE cluster host name is set up on a registered DNS domain that is verified in your Entra ID tenant. Refer to Prepare the MCP host.

  • A Microsoft Entra ID administrator has registered the AI Data Engine application for this AI Data Engine instance and given you the Directory (tenant) ID and the Application (client) ID. Refer to Configure Microsoft Entra ID for governed AI access.

Set up an identity provider

Connect Microsoft Entra ID as an identity provider (IdP) to authenticate and authorize access to the data resources in your data collections.

Before you begin

  • You must have the AI Data Engine administrator role.

  • You have the tenant ID and the application (client) ID of the AI Data Engine application that is registered in Microsoft Entra ID for this AI Data Engine instance.

Steps

  1. In NetApp Console, go to AI data hub > AI Data Engine.

  2. Select Configuration > Identity providers.

  3. Select Add identity provider.

    The Add identity provider panel opens.

  4. From Select identity provider, select Microsoft EntraID.

  5. In Entra Tenant ID, enter the Directory (tenant) ID of your Entra ID tenant.

  6. In Application (Client) ID, enter the Application (client) ID of the AI Data Engine application.

    Important Enter the Application (client) ID, which is a GUID. Don't enter the Application ID URI. Tokens identify the AI Data Engine application by its GUID, so a URI causes sign-in failures.

    Use the identifiers from your Microsoft Entra ID configuration. AI Data Engine checks the format of both values and confirms that the tenant exists. If an Invalid identity message appears, verify the values and correct them before you try again.

  7. Select Add identity provider.

When setup completes, AI Data Engine displays the confirmation message Identity provider successfully created. The provider appears in the Identity providers list. Before you continue, confirm that its Connection status is Connected.

Use the same Application (client) ID as the client ID in your AI clients.

Changes to identity provider and collection settings might not take effect immediately because NetApp Console applies them to the MCP server asynchronously.

Adding an identity provider doesn't automatically associate it with a data collection. Select the identity provider when you configure the collection so that AI applications can access its resources with authentication and authorization. Refer to Configure collections for MCP. You can delete an identity provider only if no collection uses it. To edit one, refer to Update an identity provider.

Configure collections for MCP

After you set up an identity provider and create a collection, configure the collection for MCP in NetApp Console. You select the identity providers and user scopes that can access the collection, and then copy the MCP server URL or a client-specific configuration snippet for your AI client. Refer to Configure a collection for MCP.

Verify your configuration

Before users connect, confirm that each of the following is true. The Application ID URI, scope, tenant ID, and client ID must match exactly in Entra ID, NetApp Console, and your AI clients.

AIDE cluster host

  • The AIDE cluster host name is on a domain that is verified in Entra ID.

  • The host name resolves from user machines.

  • The host presents a certificate that client machines trust.

  • The well-known endpoint of the MCP server returns the expected response. Refer to Verify the host.

Microsoft Entra ID

  • A dedicated application is registered for this AI Data Engine instance.

  • The Application ID URI is https://<host>/mcp/tools.

  • The power_users scope exists, and requestedAccessTokenVersion is set to 2 in the manifest.

  • A redirect URI is registered for each AI client, and public client flows are allowed.

  • The AIDEPowerUsers app role is assigned to your users.

NetApp Console

  • The Entra ID identity provider has the tenant ID and the application (client) ID, and its connection status is Connected.

  • Enable connection to MCP is turned on under MCP collections > MCP settings > MCP server connection.

  • The MCP server has a status of Running.

  • The collection is configured for MCP with the identity provider and the power_users scope.

  • You generated the MCP code snippet.

AI client

  • You added the snippet to the AI client.

  • The client ID is the application (client) ID.

  • The scope is the Application ID URI plus /power_users.

  • After you sign in once, the AI Data Engine tools are listed.

What's next

Manage data collections and connect AI clients.