> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corbado.com/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP for Enterprise Platforms

> Roll out the Corbado MCP server to your organization with an OAuth application and a client secret, for example as a federated connector in Microsoft 365 Copilot.

Enterprise platforms often don't let assistants register themselves at the **Corbado MCP server**. They ask for a client ID and a client secret instead, and an admin configures the server once for the whole organization. The setup has three parts:

1. A project owner adds an **OAuth application** in the [Management Console](https://app.corbado.com) and gets a client ID and a client secret.
2. An admin of your platform configures the **Corbado MCP server** for your organization with these values.
3. Each person signs in with their own Corbado account and allows **read-only** access, as described in [MCP for AI assistants](https://docs.corbado.com/corbado-observe/tools/mcp-server.md). The OAuth application only lets the platform start that sign-in. It gives no access by itself.

As an example, this page shows the setup for [Microsoft 365 Copilot](#3-example-microsoft-365-copilot).

## 1. Add an OAuth application

A project owner adds the application under [**Observe → Settings → MCP → OAuth applications**](https://app.corbado.com/observe/settings/mcp/applications):

**1. Add the application**

Click **Add application** and enter a name your team recognizes, for example `Microsoft 365 Copilot`.

**2. Enter the redirect URI**

Enter the redirect URI of your platform. Its documentation names it, or the platform shows it when you configure the server. If it appears only later, add it afterwards with **Edit**.

**3. Copy client ID and secret**

Corbado shows the client secret once. Store it in your platform right away. If it gets lost, create a new one with **Regenerate secret**.

The application belongs to this project. People who connect through it read this project only.

## 2. Values for your platform

The **Endpoints** button on the same page lists these values:

| Field | Value |
| - | - |
| MCP server URL | `https://app.corbado.com/mcp` |
| Authorization URL | `https://app.corbado.com/oauth2/authorize` |
| Token URL and refresh URL | `https://app.corbado.com/oauth2/token` |
| Revocation URL | `https://app.corbado.com/oauth2/revoke` |
| Scopes | `observe:read`, plus `offline_access` to keep the access without signing in again every hour |
| Client authentication | `client_secret_basic` or `client_secret_post` |
| PKCE | Required, method `S256` |

Platforms that read the server metadata find most of these values in `https://app.corbado.com/.well-known/oauth-authorization-server`.

## 3. Example: Microsoft 365 Copilot

In Microsoft 365 Copilot, the **Corbado MCP server** becomes a **custom federated connector**. Copilot then reads Observe data live in Copilot Chat, Researcher and Copilot in Word, Excel, PowerPoint and Outlook. Nothing is copied into Microsoft 365.

You need:

* **Admin role:** Global Administrator or AI Administrator in the Microsoft 365 admin center
* **Developer portal:** access to the [Teams Developer Portal](https://dev.teams.microsoft.com/)
* **Licenses:** a Microsoft 365 Copilot license for every person who uses the connector

**1. Add the OAuth application in Corbado**

Add an OAuth application as described in section 1 with this redirect URI:

```text theme={null}
https://teams.microsoft.com/api/platform/v1.0/oAuthRedirect
```

**2. Register the OAuth client in the Teams Developer Portal**

In the [Teams Developer Portal](https://dev.teams.microsoft.com/), open **Tools → OAuth Client Registration** and select **+ New OAuth connection**. Enter:

| Field | Value |
| - | - |
| **Name** | `Corbado Observe` |
| **Client ID** | The client ID of your Corbado application |
| **Client secret** | The client secret of your Corbado application |
| **Authorization endpoint** | `https://app.corbado.com/oauth2/authorize` |
| **Token endpoint** | `https://app.corbado.com/oauth2/token` |
| **Refresh endpoint** | `https://app.corbado.com/oauth2/token` |
| **Scopes** | `observe:read offline_access` |

Turn on **Proof Key for Code Exchange (PKCE)**, which Corbado requires. Select **Save** and copy the **OAuth client registration ID**.

**3. Create the connector in the Microsoft 365 admin center**

In the [Microsoft 365 admin center](https://admin.microsoft.com/), open **Copilot → Connectors** and the **Gallery** tab. Under **Created by your org**, select **Add** on the **Create a new connector** tile. On the **Custom connector** page, select **Add** under **Connect to MCP server** and enter:

| Field | Value |
| - | - |
| **Display name** | `Corbado Observe` |
| **Description** | `Authentication analytics from Corbado Observe: login success rates, login methods, passkey KPIs and findings about problems in login and signup flows.` |
| **Base URL** | `https://app.corbado.com/mcp` |
| **OAuth registration ID** | The ID from the Teams Developer Portal |

Select **Save**.

**4. Roll it out**

The connector appears under **Copilot → Connectors → Your connections**. Use **Staged rollout** to start with a test group, then **Deploy to all users**. Custom connectors also depend on **Allow agents and plugins built by your organization** under **Agents → Settings → Agent and plugin access**. Changes can take up to 10 minutes.

**5. Connect as a user**

In Microsoft 365 Copilot Chat, open **… → Settings → Sources**, select **Connect** next to **Corbado Observe** and sign in with your Corbado account. Then ask: "Which Corbado project am I connected to?"

Microsoft describes these settings in [Set up custom federated connectors](https://learn.microsoft.com/en-us/microsoft-365/copilot/connectors/set-up-custom-federated-connectors) and the admin controls in [Manage federated connector availability](https://learn.microsoft.com/en-us/microsoft-365/copilot/connectors/manage-federated-connectors).

## 4. Control and revoke access

All applications and everyone who connected through them are listed under [**Observe → Settings → MCP → OAuth applications**](https://app.corbado.com/observe/settings/mcp/applications). Owners can revoke one person's access, revoke all access of an application or delete the application. Access is **read-only**, follows each person's project permissions and ends after 30 days, or after 7 days without use.

To allow only the applications your owners added, turn off **Allow self-registered applications** on the same page. Assistants that register themselves then can't connect to this project.

> [card] [MCP for AI assistants](https://docs.corbado.com/corbado-observe/tools/mcp-server.md)
>
> Setup for Claude, ChatGPT, Codex, Cursor, VS Code and Gemini CLI, with tools and troubleshooting.

> [card] [Management Console access](https://docs.corbado.com/corbado-observe/overview/management-console-access.md)
>
> Who can sign in and what each role may do.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.