CrossTenantCredentialRequestForbidden error when adding MCP server with OAuth Identity Passthrough (same tenant)

[mitesh-kpmguk]

I'm trying to add a custom MCP (Model Context Protocol) server to my Azure AI Foundry project using OAuth Identity Passthrough authentication, but I'm encountering an error during the setup process.

Error Message

• ErrorFailed to add secrets: Bad request to get identity secret: {"error":{"code":"CrossTenantCredentialRequestForbidden","messag

Configuration Details

• Authentication Method: OAuth Identity Passthrough
• MCP Server: Custom hosted server
• Scopes: Custom API scope for MCP access

Important Notes

• Same Tenant: Both Azure AI Foundry project and App Registration are in the same tenant
• Verified Configuration: Double-checked Client ID, Token URL, and Auth URL are correct
• Tried Adding Secrets: Attempted to manually add secrets but same error persists

Questions

• Why am I getting a "cross-tenant" error when everything is in the same tenant?
• Are there specific App Registration permissions required for MCP server OAuth Identity Passthrough?
• Is there a known issue with this authentication method in Azure AI Foundry?

Any guidance on resolving this cross-tenant authentication issue would be greatly appreciated.