MatrixRecord of · MCP Authorization 2026-07-28

Microsoft Learn

By Microsoft. How it meets the 23 requirements of MCP Authorization.

Supported
0
Unsupported
0
Unknown, recorded
0
Not observed yet
23
Endpoint
https://learn.microsoft.com/api/mcp
Transport
Streamable HTTP
Access
Public Anyone can connect; where an account is needed, anyone can create one by self-service sign-up. Manual check · jbspeakr (documentation pass with Claude Code) · · evidence · Publicly available at no charge.
Auth
No authentication The listed endpoint accepts requests without any credential. Manual check · jbspeakr (documentation pass with Claude Code) · · evidence · No authentication is required to access the server.
Why it is listed
Added by the atlas maintainer from the vendor's own documentation. Source
Homepage
https://learn.microsoft.com

Against MCP Authorization 2026-07-28current

  • Unknown 23

Passive scanno OAuth to check · Why

Contribute a correctionWithdraw this serverJSON

Older revisions of the matrix: 2025-11-25

MCP server features 13

FeatureLevelStatusObservedEvidence
Protected Resource Metadata servedmcp.prm · Discovery · Authorization Server Discovery › Authorization Server LocationMUSTUnknown no observationno observation yet
PRM lists an authorization servermcp.prm.authorization-servers · Discovery · Authorization Server Discovery › Authorization Server LocationMUSTUnknown no observationno observation yet
PRM lists scopes_supportedmcp.prm.scopes-supported · Discovery · Authorization › Scope Selection StrategyMAYUnknown no observationno observation yet
PRM reachable at a well-known URImcp.prm.well-known · Discovery · Authorization Server Discovery › Protected Resource Metadata Discovery RequirementsMUSTUnknown no observationno observation yet
resource_metadata in the 401 challengemcp.prm.www-authenticate · Discovery · Authorization Server Discovery › Protected Resource Metadata Discovery RequirementsMUSTUnknown no observationno observation yet
403 insufficient_scope for step-upmcp.rs.insufficient-scope · Authorization · Authorization › Scope Challenge HandlingSHOULDUnknown no observationno observation yet
Scope in the WWW-Authenticate challengemcp.rs.scope-challenge · Authorization · Authorization › Scope Selection StrategySHOULDUnknown no observationno observation yet
No offline_access in advertised scopesmcp.prm.no-offline-access · Tokens · Authorization › Refresh TokensSHOULDUnknown no observationno observation yet
401 for missing or invalid tokensmcp.rs.401-on-invalid · Tokens · Authorization › Token HandlingMUSTUnknown no observationno observation yet
Audience validationmcp.rs.audience-validation · Tokens · Security Considerations › Access Token Privilege RestrictionMUSTUnknown no observationno observation yet
Bearer token only in the Authorization headermcp.rs.bearer-header · Tokens · Authorization › Access Token UsageMUSTUnknown no observationno observation yet
No token passthrough to upstream APIsmcp.rs.no-passthrough · Delegation · Security Considerations › Access Token Privilege RestrictionMUSTUnknown no observationno observation yet
Per-client consent on proxy serversmcp.proxy.consent · Consent · Security Considerations › Confused Deputy ProblemMUSTUnknown no observationno observation yet

Authorization server features 10

FeatureLevelStatusObservedEvidence
Metadata issuer matches the discovery URLmcp.as.issuer-match · Discovery · Authorization Server Discovery › Authorization Server Metadata DiscoveryMUSTUnknown no observationno observation yet
Authorization server metadata discoverablemcp.as.metadata · Discovery · Authorization Server Discovery › Authorization Server Metadata DiscoveryMUSTUnknown no observationno observation yet
Client ID Metadata Documents supportedmcp.as.cimd · Registration · Client Registration › Client ID Metadata DocumentsSHOULDUnknown no observationno observation yet
Dynamic Client Registration offeredmcp.as.dcr · Registration · Client Registration › Dynamic Client RegistrationMAYUnknown no observationno observation yet
Documented pre-registration pathmcp.as.preregistration · Registration · Client Registration › Pre-registrationSHOULDUnknown no observationno observation yet
Issuer identifier in authorization responsesmcp.as.iss-param · Authorization · Authorization › Authorization Response ValidationSHOULDUnknown no observationno observation yet
PKCE with S256 advertisedmcp.as.pkce-s256 · Authorization · Security Considerations › Authorization Code ProtectionMUSTUnknown no observationno observation yet
Refresh token rotation for public clientsmcp.as.refresh-rotation · Tokens · Security Considerations › Token TheftMUSTUnknown no observationno observation yet
Resource indicators honouredmcp.as.resource-indicator · Tokens · Security Considerations › Token Audience Binding and ValidationMUSTUnknown no observationno observation yet
All endpoints served over HTTPSmcp.as.https · Transport · Security Considerations › Communication SecurityMUSTUnknown no observationno observation yet

This server's ledger

No status change on record

Every cell of this server still shows the status of its first observation.

The whole ledger

What the scanner asked

Auth class no authentication: there is no OAuth authorization to check.

letsauth-scanner/0.4.0 · reproduce with pnpm scan microsoft-learn · scan JSON · data file · how the scanner works