Add entra tutorial

[SanjanaBoggaramJ]

No description provided.

[github-actions]

Caution

Notebooks or Frontmatter Files Have Been Modified

• Please ensure that a frontmatter.md file is accompanying the notebook file, and that the frontmatter is up to date.
• These changes will be published to the developer portal tutorials only if frontmatter.md is included.
• Proofread all changes before merging, as changes to notebook and frontmatter content will update the developer tutorial.

2 Notebook Files Modified:

Notebook File	Frontmatter Included?
mcp_auth_entra/Entra_Tutorial.ipynb	❌
openai_agents/OpenAI_Agents_MCP_Tutorial.ipynb	✅

0 Frontmatter Files Modified:

Frontmatter File
Note: frontmatter will be checked and tested in the Test Frontmatter workflow.

[gemini-code-assist]

Code Review

This pull request introduces a comprehensive tutorial (Entra_Tutorial.ipynb) on securing the Couchbase MCP Server with Microsoft Entra ID, covering both static token verification and browser-based OAuth flows. The review feedback correctly identifies that Microsoft Entra ID does not support the http:// scheme for Application ID URIs, which would cause validation errors during setup. The reviewer has provided helpful suggestions to switch to the standard api://<SERVER_CLIENT_ID> format and update the corresponding scope configurations throughout the tutorial.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Microsoft Entra ID does not support the http:// scheme for Application ID URIs (Identifier URIs). It only supports https://, api://, urn:, and ms-appx://. Attempting to save http://127.0.0.1:8000/mcp as the Application ID URI in the Entra ID portal will result in a validation error.

Instead, you should use the default api://<SERVER_CLIENT_ID> format, which is the standard and supported way to identify your API in Entra ID. This also simplifies the setup as it is automatically generated by Entra ID.

Suggested change

	"3. Set it to match your MCP server's resource URL — `http://127.0.0.1:8000/mcp` — then click **Save**.\n",
	"\n",
	"> This must **exactly** match the URL your MCP server will run at, including the `/mcp` path. The server's PRM (Protected Resource Metadata) document advertises this exact value, and Entra requires the Application ID URI to match it.\n",
	"3. Click **Save** to accept the default Application ID URI (which is in the format `api://<SERVER_CLIENT_ID>`).\n",
	"\n",
	"> **Note:** While the MCP server runs at `http://127.0.0.1:8000/mcp`, Entra ID does not allow `http://` schemes for Application ID URIs. Using the default `api://<SERVER_CLIENT_ID>` format is the standard and supported way to identify your API in Entra ID.\n",

[gemini-code-assist]

Since the Application ID URI should be configured as api://<SERVER_CLIENT_ID> instead of http://127.0.0.1:8000/mcp, the scope requested in the device code flow must be updated to use the correct prefix.

Suggested change

	" -d \"scope=http://127.0.0.1:8000/mcp/couchbase-mcp:read http://127.0.0.1:8000/mcp/couchbase-mcp:write\"\n",
	" -d \"scope=api://<SERVER_CLIENT_ID>/couchbase-mcp:read api://<SERVER_CLIENT_ID>/couchbase-mcp:write\"\n"

[gemini-code-assist]

Since the Application ID URI should be configured as api://<SERVER_CLIENT_ID> instead of http://127.0.0.1:8000/mcp, the scope configured in MCP Inspector must be updated to use the correct prefix.

Suggested change

	"* **Scope:** `http://127.0.0.1:8000/mcp/couchbase-mcp:read http://127.0.0.1:8000/mcp/couchbase-mcp:write`\n",
	"\n",
	"> ⚠️ The scope format must be `<Application ID URI>/<scope-name>` — not just the bare scope name. Since the Application ID URI is `http://127.0.0.1:8000/mcp`, each scope becomes `http://127.0.0.1:8000/mcp/couchbase-mcp:read`.\n",
	"* **Scope:** `api://<SERVER_CLIENT_ID>/couchbase-mcp:read api://<SERVER_CLIENT_ID>/couchbase-mcp:write`\n",
	"\n",
	"> ⚠️ The scope format must be `<Application ID URI>/<scope-name>` — not just the bare scope name. Since the Application ID URI is `api://<SERVER_CLIENT_ID>`, each scope becomes `api://<SERVER_CLIENT_ID>/couchbase-mcp:read`.\n"