{"record":{"id":"a7e8508343f021c4","repo":"microsoft/aspire","slug":"mcp-server-configuration-builder-resource-name-configures","errorCode":null,"errorMessage":"MCP server configuration '{builder.Resource.Name}' configures access policies and cannot be marked as existing.","messagePattern":"MCP server configuration '(.+?)' configures access policies and cannot be marked as existing\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Azure.ConnectorNamespace/AzureConnectorNamespaceExtensions.cs","lineNumber":513,"sourceCode":"    public static IResourceBuilder<AzureConnectorNamespaceMcpServerConfigResource> AsExisting(\n        this IResourceBuilder<AzureConnectorNamespaceMcpServerConfigResource> builder)\n    {\n        ArgumentNullException.ThrowIfNull(builder);\n        if (builder.Resource.Connectors.Count > 0)\n        {\n            throw new InvalidOperationException(\n                $\"MCP server configuration '{builder.Resource.Name}' has connector routes and cannot be marked as existing.\");\n        }\n\n        if (!string.IsNullOrWhiteSpace(builder.Resource.Description))\n        {\n            throw new InvalidOperationException(\n                $\"MCP server configuration '{builder.Resource.Name}' configures a description and cannot be marked as existing.\");\n        }\n\n        if (builder.Resource.AccessPolicies.Count > 0)\n        {\n            throw new InvalidOperationException(\n                $\"MCP server configuration '{builder.Resource.Name}' configures access policies and cannot be marked as existing.\");\n        }\n\n        builder.Resource.IsExisting = true;\n        return builder;\n    }\n\n    /// <summary>\n    /// Adds a Microsoft Entra user or group access policy to a managed MCP server configuration.\n    /// </summary>\n    /// <param name=\"builder\">The MCP server configuration resource builder.</param>\n    /// <param name=\"name\">The Aspire resource name for the policy.</param>\n    /// <param name=\"options\">The authorized user or group.</param>\n    /// <returns>The MCP server configuration resource builder.</returns>\n    /// <remarks>\n    /// Managed MCP endpoints reject callers that do not have a config-scoped access policy.\n    /// Connector Namespace currently supports Microsoft Entra users and groups for these policies.\n    /// The Azure child resource name is set to the principal object ID as required by the service.","sourceCodeStart":495,"sourceCodeEnd":531,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Azure.ConnectorNamespace/AzureConnectorNamespaceExtensions.cs#L495-L531","documentation":"AsExisting rejects MCP server configurations that already carry access policies. Access policies are child resources Aspire would create; on an existing (read-only) reference they cannot be deployed, so the conversion is refused to keep the model consistent.","triggerScenarios":"Calling builder.AsExisting() after WithAccessPolicy calls have populated Resource.AccessPolicies on the MCP server configuration.","commonSituations":"A config modeled with identity access policies that is later pointed at pre-provisioned infrastructure via AsExisting without removing the policy calls.","solutions":["Remove all WithAccessPolicy calls before calling AsExisting.","Manage access policies on the existing MCP server configuration outside Aspire (portal/CLI/Bicep).","Split into two resources: an unconfigured builder marked AsExisting, and drop the modeled policies."],"exampleFix":"// before\nvar mcp = ns.AddMcpServerConfig(\"tools\", options)\n    .WithAccessPolicy(\"api\", policyOptions);\nmcp.AsExisting(); // throws\n\n// after\nvar mcp = ns.AddMcpServerConfig(\"tools\", options); // no access policies\nmcp.AsExisting(); // grant policies out-of-band instead","handlingStrategy":"validation","validationCode":"if (mcp.Resource.AccessPolicies.Count == 0)\n{\n    mcp.AsExisting();\n}","typeGuard":null,"tryCatchPattern":"try\n{\n    mcp.AsExisting();\n}\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"configures access policies\"))\n{\n    // remove WithAccessPolicy calls and grant policies out-of-band\n}","preventionTips":["Never mix access-policy modeling with existing-mode references.","For existing configs, assign access policies in Azure (portal/CLI/Bicep).","Check AccessPolicies.Count before converting to existing mode."],"tags":["azure","aspire-hosting","mcp","access-policy"],"backgroundTag":"invalid-state-transition","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}