---
title: "MCP identity provider support"
description: "Which identity providers support dynamic client registration (RFC 7591) and resource indicators (RFC 8707), the two OAuth details the MCP specification's flow depends on. Every row cites a source and a date."
canonicalUrl: "https://zuplo.com/learn/mcp/compatibility/identity-providers"
pageType: "mcp-idp-support"
---

# MCP identity provider support

Which identity providers support dynamic client registration (RFC 7591) and resource indicators (RFC 8707), the two OAuth details the MCP specification's flow depends on. Every row cites a source and a date.

As of the 2026-07-28 revision, dynamic client registration is deprecated in favour of client ID metadata documents. The Registration column below records what each provider does, so read a "Yes" as "this provider will register a client for you" rather than as advice to use it.

| Provider | Registration (RFC 7591) | Resource indicators (RFC 8707) | Verified | Source | Notes |
| --- | --- | --- | --- | --- | --- |
| Microsoft Entra ID | No | No | 2026-07-24 | [Source](https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols) | No dynamic client registration, and no RFC 8414 metadata endpoint. Ask for an audience with `scope={resource}/.default` rather than the `resource` parameter. |
| Amazon Cognito | No | No | 2026-07-24 | [Source](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-app-idp-settings.html) | Cognito's own docs state it does not support dynamic client registration. Pre-register the client. |
| Keycloak | Yes | No | 2026-07-24 | [Source](https://www.keycloak.org/securing-apps/mcp-authz-server) | Keycloak documents that it "cannot recognize the `resource` parameter". Use the `scope` parameter plus an audience mapper on a client scope. |
| Auth0 | Yes | Partial | 2026-07-31 | [Source](https://auth0.com/ai/docs/mcp/guides/resource-param-compatibility-profile) | Dynamic registration must be enabled per tenant. Auth0 accepts `resource` on the standard authorization flow, pushed and JWT-secured authorization requests, backchannel authentication, and the refresh grant — but when a request carries both `resource` and `audience`, the `audience` value is the one used. |
| Ory Hydra | Yes | No | 2026-07-24 | [Source](https://github.com/ory/hydra) | Dynamic registration is off by default. Its registration response includes empty `client_uri` and `logo_uri` fields, which some clients reject during validation. |
| Zitadel | No | No | 2026-07-24 | [Source](https://github.com/zitadel/zitadel/issues/9810) | Dynamic client registration is not implemented; the tracking issue has been open since April 2025. |
| authentik | No | No | 2026-07-24 | [Source](https://github.com/goauthentik/authentik/issues/8751) | Not shipped. An implementation for the enterprise OAuth2 provider is in review. |

Each date is the day someone last checked that row against its source. For the method guides these providers feed into, see [MCP authentication](/learn/mcp/authentication). For the client half of the matrix, see the [compatibility overview](/learn/mcp/compatibility).