Support Azure SRE Agent as an OAuth MCP host

[omerbenishay12]

Problem

Work IQ publishes this hosted MCP configuration:

• Endpoint: https://workiq.svc.cloud.microsoft/mcp
• Public client ID: ba081686-5d24-4bc6-a0d6-d034ecffed87
• Authorization Code + PKCE

Azure SRE Agent's generic Streamable HTTP OAuth connector currently supports only dynamic client registration. Microsoft Entra does not expose DCR, so authorization times out before the user can sign in.

A manually supplied delegated bearer token proves the endpoint and full entity tool surface work, but the token expires and cannot be refreshed by Azure SRE.

Request

Please provide a supported Azure SRE integration by one of these approaches:

1. Register Azure SRE callback URI(s) on the existing Work IQ public client.
2. Issue an Azure-SRE-specific public client.
3. Support or document MCP pre-registration / Client ID Metadata Documents for this host.

Acceptance criteria

• One interactive delegated sign-in.
• Secure refresh-token handling and automatic access-token renewal.
• Connection survives token expiry and agent restart.
• Full hosted tool surface remains available, including create_entity and fetch.
• No copied bearer tokens or service-account workaround.