Microsoft Entra ID and Dome

1. 01

   Register your tenant as a verification provider

   Use the v2.0 issuer for your tenant ID. Pin the audience to your app's client ID.

   $ dome verification-providers create \
     --name corporate-entra \
     --method oidc \
     --oidc-url https://login.microsoftonline.com/<tenant-id>/v2.0 \
     --oidc-expected-audience <client-id>

2. 02

   Issue v2 tokens with roles

   Set requestedAccessTokenVersion to 2 in your app's manifest, or tokens carry the v1 issuer and are refused. Define app roles and assign them; add the groups and email claims under Token configuration if rules need them.

3. 03

   Pass the user's token with each call

   The agent keeps its own Dome key and adds the person's access token for your app as a header.

   from openai import OpenAI
    
   client = OpenAI(
       base_url=f"{GATEWAY_URL}/v1",
       api_key=DOME_AGENT_KEY,
       default_headers={"X-Dome-Act-As": user_entra_token},
   )

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about Microsoft Entra ID itself, see Microsoft's documentation.

forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "github" &&
  resource.tool_name == "merge_pull_request"
}
unless {
  principal has act_as &&
  principal.act_as.roles.contains("Repo.Maintainer")
};