[Bug]: 403 responses when trying to read records, despite correct permissions and succesful auth

[jlpstolwijk]

What happened?

Following up on issue 3800 and the helpful response from aaronburtle there. I'm (still) trying to call Data API builder from a Foundry Agent. The DAB requires authentication with Entra ID and a role, which all seems to go fine now, looking at the logs.

(I used C# Foundry SDK to create a Foundry toolbox incl connection to DAB with custom X-MS-API-ROLE header, as it seems not to be possible to include custom http headers when creating an mcp tool connection from the Foundry portal or through CLI, or even in azure.yaml... see this issue)

But... in most cases, the Agent still gets a 403 from the DAB. Sometimes it works, but sometimes in the same session and with the same entities, 403 is returned. I really don't have a clue what's going wrong here. I atteched logs from DAB, showing that Bearer Auth is successful and the correct role ("BeverReader") is found. Also the correct X-MS-API-ROLE is present, as far as I can see: the agent consistently reports that it has READ permissions on all entities.

See below a snippet of the dab-config:

"host": {
      "mode": "development",
      "cors": {
        "origins": [],
        "allow-credentials": true
      },
      "authentication": {
        "provider": "EntraID",
        "jwt": {
          "audience": "@env('AUDIENCE')",
          "issuer": "@env('ISSUER')"
        }
      }
    }
  },
  "entities": {
    "Scenarios": {
      "health": {
        "enabled": false
      },
      "description": "List of Scenarios ",
      "source": {
        "object": "dbo.Scenarios",
        "type": "table"
      },
      "fields": [
        {
          "name": "ScenarioId",
          "description": "Unique Identifier for each Scenario",
          "primary-key": true
        },
        {
          "name": "Scenarioname",
          "description": "Full name for a Scenario",
          "primary-key": false
        }
      ],
      "graphql": {
        "enabled": true
      },
      "rest": {
        "enabled": true
      },
      "permissions": [
        {
          "role": "BeverReader",
          "actions": [
            "read"
          ]
        }
      ]
    }
  }
}

Version

2.1.3-rc (2.0.12 gave similar results)

What database are you using?

Azure SQL

What hosting model are you using?

Container Apps

Which API approach are you accessing DAB through?

MCP

Relevant log output

2026-09-17T20:31:02.7472367Z stdout F       Request starting HTTP/1.1 POST http://dabdev.artemetra.com/mcp - application/json;+charset=utf-8 -
2026-09-17T20:31:02.7472481Z stdout F trce: Microsoft.AspNetCore.HostFiltering.HostFilteringMiddleware[2]
2026-09-17T20:31:02.7472508Z stdout F       All hosts are allowed.
2026-09-17T20:31:02.7472533Z stdout F dbug: Microsoft.AspNetCore.ResponseCompression.ResponseCompressionProvider[1]
2026-09-17T20:31:02.7472556Z stdout F       No response compression available, the Accept-Encoding header is missing or invalid.
2026-09-17T20:31:02.7474059Z stdout F dbug: Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware[1]
2026-09-17T20:31:02.7474144Z stdout F       POST requests are not supported
2026-09-17T20:31:02.7474572Z stdout F dbug: Microsoft.AspNetCore.Routing.Matching.DfaMatcher[1001]
2026-09-17T20:31:02.7474658Z stdout F       2 candidate(s) found for the request path '/mcp'
2026-09-17T20:31:02.7474707Z stdout F dbug: Microsoft.AspNetCore.Routing.Matching.DfaMatcher[1005]
2026-09-17T20:31:02.7474731Z stdout F       Endpoint 'MCP Streamable HTTP | HTTP: POST /mcp/' with route pattern '/mcp/' is valid for the request path '/mcp'
2026-09-17T20:31:02.7474778Z stdout F dbug: Microsoft.AspNetCore.Routing.Matching.DfaMatcher[1005]
2026-09-17T20:31:02.7474800Z stdout F       Endpoint 'Azure.DataApiBuilder.Service.Controllers.RestController.Insert (Azure.DataApiBuilder.Service)' with route pattern '{*route}' is valid for the request path '/mcp'
2026-09-17T20:31:02.7474824Z stdout F dbug: Microsoft.AspNetCore.Routing.EndpointRoutingMiddleware[1]
2026-09-17T20:31:02.7474846Z stdout F       Request matched endpoint 'MCP Streamable HTTP | HTTP: POST /mcp/'
2026-09-17T20:31:02.7474867Z stdout F trce: Microsoft.AspNetCore.Routing.EndpointRoutingMiddleware[8]
2026-09-17T20:31:02.7474888Z stdout F       The endpoint does not specify the IRequestSizeLimitMetadata.
2026-09-17T20:31:02.7477619Z stdout F dbug: Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler[2]
2026-09-17T20:31:02.7477755Z stdout F       Successfully validated the token.
2026-09-17T20:31:02.7477824Z stdout F dbug: Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler[8]
2026-09-17T20:31:02.7477850Z stdout F       AuthenticationScheme: Bearer was successfully authenticated.
2026-09-17T20:31:02.7478106Z stdout F dbug: Azure.DataApiBuilder.Core.AuthenticationHelpers.ClientRoleHeaderAuthenticationMiddleware[0]
2026-09-17T20:31:02.7478142Z stdout F       7d340e86-03a9-46dd-9601-8f24dfd037b7 AuthN state: Authenticated. Role: BeverReader. Scheme: Bearer
2026-09-17T20:31:02.7478170Z stdout F info: Microsoft.AspNetCore.Routing.EndpointMiddleware[0]
2026-09-17T20:31:02.7478193Z stdout F       Executing endpoint 'MCP Streamable HTTP | HTTP: POST /mcp/'
2026-09-17T20:31:02.7479038Z stdout F dbug: Microsoft.AspNetCore.Server.Kestrel[25]
2026-09-17T20:31:02.7479102Z stdout F       Connection id "0HNOKV6BBV510", Request id "0HNOKV6BBV510:00000002": started reading request body.
2026-09-17T20:31:02.7480686Z stdout F dbug: Microsoft.AspNetCore.Server.Kestrel[26]
2026-09-17T20:31:02.7480787Z stdout F       Connection id "0HNOKV6BBV510", Request id "0HNOKV6BBV510:00000002": done reading request body.
2026-09-17T20:31:02.7489689Z stdout F dbug: ModelContextProtocol.Server.McpServer[330297028]
2026-09-17T20:31:02.7489863Z stdout F       Server (SQL MCP Server 2.1.3), Client (ToolServer 1.0.0.0) read JsonRpcRequest message from channel.
2026-09-17T20:31:02.7489945Z stdout F info: ModelContextProtocol.Server.McpServer[570385771]
2026-09-17T20:31:02.7489970Z stdout F       Server (SQL MCP Server 2.1.3), Client (ToolServer 1.0.0.0) method 'tools/call' request handler called.
2026-09-17T20:31:02.7489994Z stdout F info: Microsoft.AspNetCore.Authorization.DefaultAuthorizationService[2]
2026-09-17T20:31:02.7491622Z stdout F       Authorization failed. Fail() was explicitly called.
2026-09-17T20:31:02.7492694Z stdout F warn: Azure.DataApiBuilder.Mcp.BuiltInTools.ReadRecordsTool[0]
2026-09-17T20:31:02.7493028Z stdout F       MCP Tool error PermissionDenied: Permission denied for read on entity 'Scenarios'. Authorization Failure: Access Not Allowed.
2026-09-17T20:31:02.7494446Z stdout F info: ModelContextProtocol.Server.McpServer[2065726448]
2026-09-17T20:31:02.7494498Z stdout F       "read_records" completed. IsError = True.
2026-09-17T20:31:02.7495869Z stdout F trce: ModelContextProtocol.Server.McpServer[1672174748]
2026-09-17T20:31:02.7495919Z stdout F       Server (SQL MCP Server 2.1.3), Client (ToolServer 1.0.0.0) sending message. Message: '{"result":{"content":[{"type":"text","text":"{\n  \u0022toolName\u0022: \u0022read_records\u0022,\n  \u0022status\u0022: \u0022error\u0022,\n  \u0022error\u0022: {\n    \u0022type\u0022: \u0022PermissionDenied\u0022,\n    \u0022message\u0022: \u0022Permission denied for read on entity \\u0027Scenarios\\u0027. Authorization Failure: Access Not Allowed.\u0022\n  }\n}"}],"isError":true},"id":2,"jsonrpc":"2.0"}'.
2026-09-17T20:31:02.7501519Z stdout F info: ModelContextProtocol.Server.McpServer[1867955179]
2026-09-17T20:31:02.7501636Z stdout F       Server (SQL MCP Server 2.1.3), Client (ToolServer 1.0.0.0) method 'tools/call' request handler completed in 1.4317ms.

Code of Conduct

• I agree to follow this project's Code of Conduct