Securing FME Flow MCP with organizational Microsoft Entra ID accounts

I totally second this. Especially because SAML has another flaw, where incorrect SAML Identity Provider URLs under Authentication Services are created, in case your hostname contains the string 'fmeserver’.(FMEFLOW-20430)

Yes, this needs to be addressed!  I haven’t heard of any expected fixes yet.  I can confirm that using Auth0 as a federated connection with Entra works. However, not acceptable long term solution for an enterprise. In my case every user needs to be provisioned, and the auditing in FME is the same as any other SAML user.     

Hi ​@rsun , thanks for the detailed question, and thanks ​@jglick and ​@tb09114  for chiming in. I’ll take your questions in order.

1. Fix timing. This is tracked as FMEFLOW-29112. Unfortunately the fix is taking longer than we hoped, and it’s currently targeting 2027.1. It turned out to be much more complex than expected, because of how Entra implements OAuth for MCP. We’ve had to rework the authentication mechanism itself rather than patch around it. That target could still change, so the known issues article will have the latest status.

2. Recommended setup today. Short of using a different identity provider, there is no recommended way to use Entra directly with MCP in FME Flow right now. As ​@jglick  mentioned, putting an intermediary IdP in front of Entra (federating Entra into it) is one option people have used. I can’t offer guidance on how to set that up, so you’d want to validate it against your own security and Conditional Access requirements.

3 and 4. User provisioning and audit logging. Every MCP user is provisioned as an FME Flow user through SAML. That’s what lets you keep per-user roles, logging, and user details available in the MCP workspaces, and it applies whether or not an intermediary IdP is involved. As ​@jglick  noted, auditing for these users looks the same as for any other SAML user. Access can’t currently be managed purely from the Entra side without those FME Flow users.

I would be curious on any feedback about user provisioning and what cases may benefit with direct authentication. 

I know it’s not the update with the best news just yet- it is a widely recognised challenge with MCP adoption in FME Flow and so it has been a priority with the development team(s) and the product management group lately.

Hi ​@NickAtSafe, 

It sensed the answer regarding FMEFLOW-20430 did not make it into your answer. 😉

Hi ​@tb09114 - I did forget to mention it 😀 I did do some digging into on my own and there is a comment from our support team that says “this is only a UI issue and if the URLs are corrected before applying on the SAMl IDP side, the SAML configuration should work as designed. “

I’ve had to check with another colleague about the status of it- they’re away right now, but as soon as I hear more, I’ll report back.