Connect and identify me

Replace the placeholders with values from your own authorized scope before copying this prompt into an MCP client.

Inputs

• {{mcp_url}} Approved application router or bound application URL ending in /mcp.
• {{expected_issuer}}, {{expected_subject}} and {{expected_audience}} Intended account identifiers and the deployment's MCP audience.

Prompt

Connect to {{mcp_url}} through the client's sign-in flow.
Call read_v2_session_identity with an empty argument object. Compare issuer, subject and audience with {{expected_issuer}}, {{expected_subject}} and {{expected_audience}}. Report whether the values match and include loginIdSha256 only when needed to compare an enrollment binding.
Keep credentials in the sign-in flow.
If sign-in is unavailable or the returned values differ from the intended session, stop and report which condition needs resolving. Check current directory enrollment and application visibility separately with the discovery recipe.

Example inputs

Use the approved router URL from your operator. The response identifies the verified token principal. The application discovery recipe checks current directory state and visible grants.

{}

Tools used include read_v2_session_identity. See the module guidelines and tool index.