Connect Your AI Assistant

Register an AI assistant as a trusted client, then connect it to StratoLens. An administrator runs the Add Trusted Client wizard once per client; each user then signs in with their own work account. The connection is read-only.

How Sign-In Works

Two app registrations are involved, and keeping them apart avoids most setup errors. The StratoLens App Registration belongs to your StratoLens installation and holds the external_read scope. The client app registration is the app the assistant signs in with: Microsoft's own app for VS Code, or one the wizard's script creates in your tenant for Claude and ChatGPT.

StratoLens accepts a sign-in only when all three hold:

• The client app is pre-authorized for external_read on the StratoLens App Registration (in Entra ID).
• The client app is on the StratoLens Trusted clients list.
• Allow MCP connections is on.

Clients find the sign-in details on their own, from a public discovery document at https://<host>/.well-known/oauth-protected-resource/api/mcp that names your Entra tenant and the scope. Entra ID does not support dynamic client registration, so every MCP client needs an app registration in your tenant. No client secret is created, and the pre-authorization is what removes the consent prompt.

The Add Trusted Client Wizard

Open Settings > General, expand Security, and under Trusted clients click Add client. The wizard has three steps:

1. Choose the client. Pick a card under MCP clients (AI assistants), then fill in Client ID and Display name. The display name appears in the Trusted clients list and the audit log; for Claude and ChatGPT it is also the name of the new Entra app registration. (The Scripts and apps cards are for the External API.)
2. Configure the App Registration. Choose the Azure portal or Cloud Shell script tab; both make the same changes. Steps already done show as detected and are skipped. The wizard never writes to Entra ID itself: you make the change, StratoLens verifies it.
3. Verify. Click Verify and add. StratoLens re-reads the App Registration and lists exactly what is missing. Entra can take a minute to show changes, so wait and verify again if needed. When everything is in place the client is added and the final screen, Connect your MCP client, shows the values to enter in the assistant.

Sign-ins last about an hour and clients renew them through the normal sign-in flow. Users sign in once per client, and permission changes in StratoLens apply without reconnecting. Menu names in VS Code, Claude and ChatGPT below are quoted as of this release; those products may rename them.

VS Code (GitHub Copilot)

Administrator steps

1. Click Add client > VS Code (GitHub Copilot). The Client ID is fixed to Microsoft's Visual Studio Code app, aebc6443-996d-45c2-90f0-388ff96faa56, and the display name defaults to VS Code (GitHub Copilot).
2. In step 2, pre-authorize the client for external_read on the StratoLens App Registration:
   • Azure portal: open the Expose an API blade with the wizard's button. If the scope is missing, click + Add a scope, choose Admins only and Enabled, enter the scope name external_read, the display name Read StratoLens data (external API) and the description shown in the wizard, then Add scope. Then click + Add a client application, paste the client ID, tick /external_read and click Add application.
   • Cloud Shell script: run it in Azure Cloud Shell (PowerShell) as an App Registration owner. It is safe to re-run and keeps other scopes and clients.
3. Click Verify and add.

Connect VS Code

The final screen has two tabs. Workspace adds the server to one project: save this as .vscode/mcp.json, start the server from that file, sign in with your work account when VS Code asks, then use Copilot Chat in agent mode.

{
  "servers": {
    "stratolens": {
      "type": "http",
      "url": "https://<host>/api/mcp"
    }
  }
}

User profile adds the server for every workspace. Run this in Bash, zsh or PowerShell 7.3+, or run MCP: Open User Configuration in VS Code and paste the server from the Workspace tab.

code --add-mcp '{"name":"stratolens","type":"http","url":"https://<host>/api/mcp"}'

Claude

Claude has no shared Entra app, so the wizard gives you a script that creates one in your tenant. The steps need someone who owns the StratoLens App Registration and may create app registrations in Entra ID, plus a StratoLens user with Modify Settings and Manage Roles.

1. Choose the client

1. Click Add client > Claude.
2. Keep or change the Display name (default StratoLens Claude, up to 100 characters). The new Entra app registration gets the same name, so keep it recognizable.
3. Leave Client ID empty for now. You paste it after step 2.

2a. Run the Cloud Shell script (fastest)

On the Cloud Shell script tab, copy the script and run it in Azure Cloud Shell (PowerShell). It is generated for your tenant and does six things, skipping any that are already done:

1. Makes sure the external_read scope exists on the StratoLens App Registration, is enabled and is admin-consent only.
2. Adds the MCP server URL (https://<host>/api/mcp) to the StratoLens App Registration's Application ID URIs, keeping the existing api:// URI and any others.
3. Finds the client app by its exact display name, or creates it: single tenant, public client (Mobile and desktop) platform with the redirect URIs https://claude.ai/api/mcp/auth_callback and http://localhost:8080/callback. An existing app gets any missing redirect URI added. It then makes sure the app has a service principal in your tenant.
4. Requests the delegated external_read permission on the client app.
5. Pre-authorizes the client app for external_read on the StratoLens App Registration.
6. Prints Client ID: <clientAppId>.

The script creates no client secret and grants no admin consent, and it is safe to re-run. If several app registrations already share the display name, it stops and asks you to choose another name.

2b. Or use the Azure portal

The Azure portal tab makes the same changes by hand, in this order.

Create the client app registration

1. In Entra ID, open App registrations > + New registration.
2. Name it with the display name from the wizard and choose Accounts in this organizational directory only.
3. Under Redirect URI, choose Public client/native (mobile & desktop) and enter https://claude.ai/api/mcp/auth_callback. Click Register. No client secret is needed.
4. Open Authentication, click Add URI under Mobile and desktop applications, add http://localhost:8080/callback and click Save.
5. From the new app's Overview, copy the Application (client) ID into the wizard's Client ID field.

Update the StratoLens App Registration

1. Open the Manifest blade with the wizard's button. In identifierUris, add the MCP server URL next to the existing api:// entry, then click Save.
2. On Expose an API, create the external_read scope if it is missing (Admins only, Enabled).
3. Click + Add a client application, enter the new app's client ID and tick /external_read.

Back on the client app registration

1. Open API permissions > + Add a permission > APIs my organization uses and search for the StratoLens client ID.
2. Choose Delegated permissions, tick external_read and click Add permissions. Admin consent is not needed. This step comes last because the list only shows scopes that already exist.

3. Verify and add

Paste the client ID into Client ID if you haven't, then click Verify and add. For Claude, Verify also checks that the MCP server URL is an Application ID URI of the StratoLens App Registration. Hand the final screen's values to your users.

That check matters because Claude sends the MCP server URL to Entra as the sign-in resource, and Entra accepts it only if that exact URL is an Application ID URI of the StratoLens App Registration. Without it, sign-in fails with AADSTS9010010.

Connect claude.ai or Claude Desktop

1. In Claude, open Settings > Connectors > Add custom connector.
2. Enter the values from the claude.ai and Claude Desktop tab. The client ID goes under Advanced settings.
   Claude custom connectorText

   Copy

   Remote MCP server URL: https://<host>/api/mcp
   OAuth Client ID:       <clientAppId>
   OAuth Client Secret:   (leave empty)

3. Connect and sign in with your work account.

Connect Claude Code

Run the command from the Claude Code tab in any shell, then run /mcp in Claude Code and choose Authenticate. Keep the callback port at 8080; the client app registers that redirect.

claude mcp add --transport http --client-id <clientAppId> --callback-port 8080 stratolens https://<host>/api/mcp

Removing Claude later

Click Remove on the client's row. Because the wizard created the app registration, the dialog also offers Also delete the client app registration (optional) with this command. Run it in Azure Cloud Shell after removing the pre-authorization, and only if nothing else uses the app.

az ad app delete --id <clientAppId>

ChatGPT

ChatGPT works like Claude, except ChatGPT gives you its redirect URL, so start in ChatGPT.

1. In ChatGPT, start adding a custom MCP server with OAuth authentication, open Advanced OAuth settings, choose User-Defined OAuth Client and copy its Callback URL. Keep that form open; it takes the client ID at the end.
2. In StratoLens, click Add client > ChatGPT and paste the callback into Redirect URL from ChatGPT. It must start with https://chatgpt.com/connector/oauth/. The display name defaults to StratoLens ChatGPT.
3. In step 2, run the Cloud Shell script or follow the Azure portal steps. They are the same as for Claude, but register the ChatGPT redirect URL instead of Claude's two.
4. Paste the printed client ID and click Verify and add.
5. Back in ChatGPT, enter these values, then connect and sign in with your work account. ChatGPT reads the scope and Entra endpoints from the StratoLens discovery document.
   ChatGPT custom connectorText

   Copy

   MCP Server URL:  https://<host>/api/mcp
   Authentication:  OAuth
   Client ID:       <clientAppId>
   Client secret:   (leave empty)

Other MCP Client

For any other MCP client, use your own Entra app registration. It should be single tenant with a public client redirect.

1. Click Add client > Other MCP client and enter your app's Application (client) ID and a display name.
2. In step 2, create the scope and pre-authorize the client, as for VS Code.
3. Click Verify and add.

Your client must use the Streamable HTTP transport and sign the user in with the authorization code flow with PKCE at the authorization server named in the discovery document. The final screen shows these values:

MCP server URL (resource): https://<host>/api/mcp
Resource metadata:         https://<host>/.well-known/oauth-protected-resource/api/mcp
Scope:                     api://<stratolensClientId>/external_read
OAuth client ID:           <clientAppId>