How to connect a Microsoft Fabric Data Agent to Claude

Hello, apprentices! 🧙

Have you ever imagined using data already prepared in a Microsoft Fabric semantic model directly in Claude? With a Data Agent, you can query that data using natural-language questions.

In this tutorial, we will connect the agent to Claude using MCP, following the process from publishing the agent to running the first query.

This procedure starts with an agent that has already been configured. The options available depend on your environment’s settings and permissions.

1. Prerequisites

Before you start, check the following:

• Microsoft Fabric: a paid F2 or higher capacity, or Power BI Premium per capacity P1 or higher with Fabric enabled. You need a Data Agent already created, with configured sources, data access, and permission to publish it. See the official Fabric prerequisites.
• Microsoft Entra: access to the directory for the same environment, with permission to register applications and configure their credentials.
• Claude: custom MCP connectors are available starting with the Free plan, as well as Pro, Max, Team, and Enterprise. Free is limited to one custom connector. Check the official connector availability.
• Permissions: the delegated Data Agent execution permission must be available, with administrator approval when required by your organization.

2. Publish the agent and copy its MCP URL

In Fabric, open the Data Agent and click Publish. If it is already published, continue to its settings.

Under Settings → Model Context Protocol, copy the MCP server URL using the copy button. Use your own agent’s full address. Paste it into a local text file, labeled MCP URL, and keep it temporarily to fill in Claude in step 5.

Figure 1 — Agent MCP settings, with environment information hidden. Tutorial screenshot.

3. Register an application in Microsoft Entra

Open the Microsoft Entra admin center and sign in with your environment’s account. In the sidebar, go to Entra ID → App registrations → New registration. Choose a descriptive name, such as Integracao-Fabric-Claude. For an organization-only scenario, select accounts in the same directory.

Click Register. Then open the application under App registrations → your application → Overview.

Find Application (client) ID and click the copy icon next to its value. Paste it into the same local text file, labeled Client ID, and keep it until step 5. This is the Client ID you will paste into the first Use your own OAuth client field in Claude (step 5). Do not copy the Object ID or Directory (tenant) ID.

Figure 2 — Application registration, with the directory identifier hidden. Tutorial screenshot.

Figure 3 — Copy the Application (client) ID highlighted in Overview. Values have been hidden.

4. Configure the execution permission

In the application, open API permissions → Add a permission → APIs my organization uses. Search for Power BI Service, select it, and choose Delegated permissions.

Search for DataAgent, select only DataAgent.Execute.All for this flow, and click Add permissions. Check that it appears in the list as Delegated.

Check whether your organization requires administrator approval. The application’s permission does not replace the access the user needs in Fabric.

Figure 4 — Selecting the DataAgent.Execute.All delegated permission. Tutorial screenshot.

5. Start the connector in Claude

In Claude Desktop, open the profile menu → Settings → Personalization → Connectors. Click Add → Add custom connector.

1. Enter a descriptive integration name in Name.
2. In MCP server URL, paste the MCP URL saved in step 2.
3. Click Continue. Under Authentication, keep Sign in now and, under OAuth client, select Use your own OAuth client.
4. Copy the Client ID saved in step 3 and paste it into the first OAuth client field in Claude.

Figure 5 — Fill in Name and paste the MCP URL into the second field. Then click Continue.

Keep this form open and do not click Add yet. Before finishing, configure the callback URI and prepare the secret in Entra, as described next.

6. Prepare OAuth authentication

6.1. Register the callback URI

In Microsoft Entra, open Entra ID → App registrations → the application created in step 3. In that application’s sidebar, go to Authentication — shown as Authentication (Preview) in the source document.

On the Redirect URI configuration tab, click Add redirect URI, next to the + symbol. If your portal shows Add a platform, use it to open the platform selection.

Figure 6 — Open Authentication and select the command to add a redirect URI.

In the platform panel, find Web applications → Web and click Select on that card.

Figure 7 — Select the Web platform for the sign-in callback.

In the first field, Redirect URI, paste exactly:

https://claude.ai/api/mcp/auth_callback

For this flow, leave Front-channel logout URL blank and keep Access tokens and ID tokens unchecked. Check the address and click Configure at the bottom. Wait for confirmation and check that the URI appears under the Web platform.

Figure 8 — Paste the URI into the first field and save using Configure.

This address is Claude’s authentication callback. Check the URI in the current documentation before configuring it.

The URI receives the sign-in callback; it is not the agent’s MCP URL.

6.2. Prepare the client secret

To find Certificates & secrets, open Microsoft Entra and follow Entra ID → App registrations → your application. In the application’s left sidebar, under Manage, click Certificates & secrets (the key icon). On that page, select the Client secrets tab.

Figure 9 — In the application sidebar, open Manage → Certificates & secrets, highlighted in red. Identifying information has been hidden.

If the flow requires a client secret:

1. In the Entra application, open Certificates & secrets → Client secrets → New client secret.
2. Enter a generic description, select an expiration allowed by your organization, and click Add.
3. In the new row, immediately copy the Value column using its copy icon. This is the Client Secret; the Secret ID column cannot be used to authenticate.
4. In step 7, paste the value into the second Use your own OAuth client field when the server requires a secret.

The Value is available to copy only after creation. If you can no longer access it, create a new secret according to your environment’s policy. Do not include the credential in the article, screenshots, or messages.

Figure 10 — Use the copy button next to Value, highlighted in red; do not copy the Secret ID. Data has been hidden.

6.3. Check before connecting

What to copy	Where to copy it	Where to paste it in Claude
MCP server URL	Fabric → Data Agent settings → Model Context Protocol	MCP server URL
Application (client) ID	Entra → App registrations → your application → Overview	First field under Use your own OAuth client
Secret value	Entra → your application → Certificates & secrets → Client secrets → Value	Second field under Use your own OAuth client, when required

Use the ID and secret from the same registered application. The redirect URI belongs in Entra’s authentication configuration; do not paste it into the MCP URL field.

7. Finish the connector and link the account

Return to the connector form left open in step 5.

1. Check the name and the MCP server URL copied from Fabric.
2. Keep Sign in now and Use your own OAuth client.
3. In the first field (OAuth client ID / Client ID), paste the Application (client) ID copied from Overview in Entra. In the screenshot below, it is the top field covered by a purple bar.
4. In the second field (OAuth client secret / Client Secret), paste the Value from Certificates & secrets, when required. In the screenshot, it is the bottom field covered by a purple bar.
5. Click Add and wait for verification. If Link appears, click it and sign in with the Microsoft account that has access to the agent. Check the requested permissions and complete the authorized consent.
6. When you see Connected in the browser, return to Claude Desktop. Check that the connector shows Unlink and that the agent’s tool is available. Keep approval for tool use enabled.

Figure 11 — OAuth client in Claude, with authentication values hidden. Tutorial screenshot.

8. Run a simple query and check the result

In Claude’s conversation, first ask it to connect to the connector you configured. Specify its name and wait for Claude to load it and confirm that the Data Agent tool is available.

After confirming the connection, ask a question about data the agent can access.

Review the tool-use request: check the connector, tool, and submitted question. Click Allow once to approve that execution. Then compare the response with the original source.

Figure 12 — Review the request and click Allow once. Only the Data Agent’s name has been hidden.

The connection is validated only when the tool runs the query and the result is checked. Filling out the form is not enough.

9. References

• Data Agent as an MCP server — Microsoft Learn
• Custom connectors — Claude
• MCP connector authentication — Anthropic

Until our next adventure!

Karine Batista