Skip to main content
Question

Native SSO and user-level audit tracking for FME MCP with Entra ID and ArcGIS

  • October 15, 2026
  • 1 reply
  • 49 views
rsun
Contributor
Forum|alt.badge.img+6

Hi everyone,

I’m running FME Flow 2026.2 and would like a straightforward, native way to integrate FME MCP servers with our organization’s identity systems.

My goal is for FME MCP servers to offer an app-registration option with Microsoft Entra ID or ArcGIS Enterprise / ArcGIS Online, so staff can use MCP tools through their corporate AI agents with smooth single sign-on (SSO).

For example, staff could submit inspection or maintenance records for municipal assets or asset updates through an AI agent, using the Microsoft 365 identity they already use to sign in to ArcGIS Enterprise. When an FME MCP tool creates or updates an ArcGIS record, I would like the edit to be attributed to that employee’s corresponding ArcGIS account, with a traceable audit trail connecting the tool call, FME job, and resulting edit.

A few questions for Safe and the community:

  1. Could FME MCP support native app registration with these platforms? What configuration would be needed in FME, the identity provider, and the AI client? Is there a supported workflow using a manually registered OAuth client, and could automatic registration simplify the setup where supported?
  2. How granular is access control? Can credentials be restricted to particular MCP servers or tools, expire automatically, and be revoked individually? Can tool calls be attributed to the person using them, including when they submit inspection or maintenance records?
  3. How would SSO, editor tracking, and audit logging work end to end? Can the signed-in user’s identity and permissions be carried through the FME workflow to authorized ArcGIS edits, so ArcGIS editor tracking and FME audit records identify the person responsible?

I’m interested in a robust, easy-to-configure integration built into FME MCP, with centrally managed organizational access and traceable actions for each user.

Is this supported today, or being considered for a future release? I’d appreciate any documentation or examples showing how this could work.

Thanks!

      1 reply

      NickAtSafe
      Safer
      Forum|alt.badge.img+14

      Hi ​@rsun , thanks for the detailed write-up. This overlaps with your other thread on securing FME Flow MCP with Entra ID, so some of this repeats what I said there.

      Native app registration with Entra ID or ArcGIS. Entra isn’t supported directly for MCP in FME Flow today. The fix is tracked as FMEFLOW-29112 and is targeting 2027.1. It’s taking longer than expected because of how Entra implements OAuth for MCP, and it has required rearchitecting the authentication mechanism. 

      Access control and attribution. Access is governed at the MCP server level. If you need tool-level control, the check has to go into the workspace behind the tool, for example by looking at the running user and stopping the job if they aren’t allowed to use it. Every MCP user is provisioned as an FME Flow user through SAML, so roles, logging, and user details are tied to the individual in the MCP workspaces. 

      Carrying the user into ArcGIS edits. When FME Flow runs an MCP job, it passes the username of the person running the tool to the workspace as a parameter called FME_SECURITY_USER. You can use that value in the workspace to look up the matching ArcGIS account and pass those user details along with the requests to ArcGIS, so the edit can be tied to the employee who made the call. That mapping is something you’d build into the workflow rather than something configured automatically. Combined with the FME job record for the tool call, that gives you a trail from the person to the job to the resulting edit.

      Community Stats

      32,967
      Posts
      124,938
      Replies
      41,847
      Members
      Terms & ConditionsAccessibility statement
      A product of
      Safe Software respectfully acknowledges that we live, learn and work on the traditional and unceded territories of the Kwantlen, Katzie, and Semiahmoo First Nations.