--- title: "DreamFactory 7.4.0: MCP Server Integration, Azure AD Group Mapping, and Critical Security Enhancements" description: DreamFactory 7.4.0 introduces MCP Server integration for AI applications, Azure AD group-to-role mapping, critical security fixes, and enhanced OAuth authentication for enterprise API management. image: https://blog.dreamfactory.com/hubfs/Gemini_Generated_Image_dgj6ijdgj6ijdgj6-1.png --- [![DreamFactory logo](https://cdn.prod.website-files.com/64ed8da8a866be7a702fbae0/68d51994d3678214b54acb60_dreamfactory-navbar-logo.svg)](https://www.dreamfactory.com/) Products & Services [AI Data Gateway](https://www.dreamfactory.com/ai-data-gateway/overview) [Overview Why DreamFactory exists](https://www.dreamfactory.com/ai-data-gateway/overview) [Data Gov, Comp, Security Policy enforcement at the API layer](https://www.dreamfactory.com/ai-data-gateway/ai-data-governance) [Standard API Layer One contract for every backend](https://www.dreamfactory.com/ai-data-gateway/standard-api-layer) [API Gateway Functionality Routing, auth, rate limits, observability](https://www.dreamfactory.com/ai-data-gateway/api-gateway-functionality) [Deployment & Integration Self-hosted, cloud, hybrid](https://www.dreamfactory.com/ai-data-gateway/on-premise-deployment-and-integration) [Developer Productivity Auto-generated, never hand-coded](https://www.dreamfactory.com/ai-data-gateway/ai-development-accelerated) [AI App Architectures Patterns for RAG, agents, MCP](https://www.dreamfactory.com/ai-data-gateway/enterprise-ai-architectures) AI Data Models [AIOpenAI](https://www.dreamfactory.com/use-cases/openai) [GGoogle Gemini](https://www.dreamfactory.com/use-cases/google-gemini) [CAnthropic Claude](https://www.dreamfactory.com/use-cases/anthropic-claude-landing) [LMeta Llama](https://www.dreamfactory.com/use-cases/meta-llama) [MMistral AI](https://www.dreamfactory.com/use-cases/mistral) [CoCohere](https://www.dreamfactory.com/use-cases/cohere) Services and support [Quickstart Service Packages Expert-led Quickstarts to production](https://www.dreamfactory.com/services-and-support/quickstart-services-packages) API Management [Generate & Manage REST APIs From any database, in seconds](https://www.dreamfactory.com/api-management/generate-rest-apis) [Features Security, scripting, self-hosted & more](https://www.dreamfactory.com/api-management/features) [API Generation The complete guide to auto-generated APIs](https://blog.dreamfactory.com/a-complete-guide-to-api-generation) [API Management Concepts, tools, and best practises](https://blog.dreamfactory.com/what-is-api-management-a-brief-overview-of-api-management-concepts-and-tools?_gl=1*jl0njh*_gcl_au*MjQzMjgwMTc3LjE3ODIzMjI3MzY) Use Cases AI Use Cases [AI Data Access Secure, governed reads for your LLMs](https://www.dreamfactory.com/use-cases/ai-data-access) [MCP Server Drop-in Model Context Protocol](https://www.dreamfactory.com/use-cases/mcp-server) [Legacy Modernization Wrap mainframes with REST](https://www.dreamfactory.com/use-cases/legacy-modernization) [Data Governance Audit every call, enforce every policy](https://www.dreamfactory.com/use-cases/data-governance) [Customer Case Studies](https://www.dreamfactory.com/case-studies) [Energy Modernization](https://www.dreamfactory.com/case-studies/energy-snowflake-modernization) [Government Modernization](https://www.dreamfactory.com/case-studies/government-mainframe-oracle-modernization) [Government Business Intelligence](https://www.dreamfactory.com/case-studies/government-sql-server-bi-analyst-queries) [Manufacturing Modernization](https://www.dreamfactory.com/case-studies/steel-manufacturing-sap-erp-modernization) [Financial Services Investor Portal](https://www.dreamfactory.com/case-studies/financial-services-sql-server-investor-portal) [Non-Profit Partner Data Sharing](https://www.dreamfactory.com/case-studies/non-profit-sql-server-partner-data-sharing) [Professional Services Exec Dashboards](https://www.dreamfactory.com/case-studies/professional-services-erp-dashboards) [Education HR and External Data Sharing](https://www.dreamfactory.com/case-studies/education-student-hr-sql-server-mysql-external-data-sharing) Industries Industries #### [Healthcare HIPAA-grade APIs across EHR, claims, and labs.](https://www.dreamfactory.com/use-cases/healthcare) #### [Financial Services Portfolios, partners, and portals on one layer.](https://www.dreamfactory.com/use-cases/financial-services) #### [Government Modernize mainframes without re-platforming.](https://www.dreamfactory.com/use-cases/government) #### [Manufacturing SAP, MES, and shop-floor data, governed.](https://www.dreamfactory.com/use-cases/manufacturing) #### [Spotlight How enterprises run on DreamFactory From healthcare to energy to finance — governance baked into every endpoint. Browse case studies →](https://www.dreamfactory.com/case-studies) Connectors SQL Database [SQL SQL Server](https://www.dreamfactory.com/connectors/sql-server) [OR Oracle](https://www.dreamfactory.com/connectors/oracle) [PG PostgreSQL](https://www.dreamfactory.com/connectors/postgresql) [My MySQL](https://www.dreamfactory.com/connectors/mysql) NoSQL & Docs [Dy DynamoDB](https://www.dreamfactory.com/connectors/dynamodb) [Do DocumentDB](https://www.dreamfactory.com/connectors/azure-documentdb) [Mo MongoDB](https://www.dreamfactory.com/connectors/mongodb) [Cb CouchDB](https://www.dreamfactory.com/connectors/couch-db) Cloud Warehouses [S3 S3](https://www.dreamfactory.com/connectors/amazon-s3) [Ab Azureblob](https://www.dreamfactory.com/connectors/azure-blob) [FS FTP/SFTP](https://www.dreamfactory.com/connectors/ftp-sftp) [LS Local Storage](https://www.dreamfactory.com/connectors/local-storage) C & SaaS [Sf Salesforce](https://www.dreamfactory.com/connectors/salesforce) [API REST / SOAP](https://www.dreamfactory.com/connectors/soap-to-rest) [See all 30+ connectors](https://www.dreamfactory.com/connectors) [Blog](https://blog.dreamfactory.com/) [FREE 30 Minute Demo](https://www.dreamfactory.com/demo) [![DreamFactory logo](https://cdn.prod.website-files.com/64ed8da8a866be7a702fbae0/68d51994d3678214b54acb60_dreamfactory-navbar-logo.svg)](https://www.dreamfactory.com/) ![hamburger](https://blog.dreamfactory.com/hubfs/raw_assets/public/dreamfactory/images/megamenu/menu-hamburger.svg) ![close](https://blog.dreamfactory.com/hubfs/raw_assets/public/dreamfactory/images/megamenu/close-menu.svg) Back to main menu Products & Services Use Cases Industries Connectors [Blog](https://blog.dreamfactory.com/) [FREE 30 Minute Demo](https://www.dreamfactory.com/demo) [AI Data Gateway](https://www.dreamfactory.com/ai-data-gateway/overview) [Overview Why DreamFactory exists](https://www.dreamfactory.com/ai-data-gateway/overview) [Data Gov, Comp, Security Policy enforcement at the API layer](https://www.dreamfactory.com/ai-data-gateway/ai-data-governance) [Standard API Layer One contract for every backend](https://www.dreamfactory.com/ai-data-gateway/standard-api-layer) [API Gateway Functionality Routing, auth, rate limits, observability](https://www.dreamfactory.com/ai-data-gateway/api-gateway-functionality) [Deployment & Integration Self-hosted, cloud, hybrid](https://www.dreamfactory.com/ai-data-gateway/on-premise-deployment-and-integration) [Developer Productivity Auto-generated, never hand-coded](https://www.dreamfactory.com/ai-data-gateway/ai-development-accelerated) [AI App Architectures Patterns for RAG, agents, MCP](https://www.dreamfactory.com/ai-data-gateway/enterprise-ai-architectures) AI Data Models [AIOpenAI](https://www.dreamfactory.com/use-cases/openai) [GGoogle Gemini](https://www.dreamfactory.com/use-cases/google-gemini) [CAnthropic Claude](https://www.dreamfactory.com/use-cases/anthropic-claude-landing) [LMeta Llama](https://www.dreamfactory.com/use-cases/meta-llama) [MMistral AI](https://www.dreamfactory.com/use-cases/mistral) [CoCohere](https://www.dreamfactory.com/use-cases/cohere) Services and support [Quickstart Service Packages Expert-led Quickstarts to production](https://www.dreamfactory.com/services-and-support/quickstart-services-packages) AI Data Models [Generate & Manage REST APIs From any database, in seconds](https://www.dreamfactory.com/api-management/generate-rest-apis) [Features Security, scripting, self-hosted & more](https://www.dreamfactory.com/api-management/features) [API Generation The complete guide to auto-generated APIs](https://blog.dreamfactory.com/a-complete-guide-to-api-generation) [API Management Concepts, tools, and best practises](https://blog.dreamfactory.com/what-is-api-management-a-brief-overview-of-api-management-concepts-and-tools?_gl=1*jl0njh*_gcl_au*MjQzMjgwMTc3LjE3ODIzMjI3MzY) AI Use Cases [AI Data Access Secure, governed reads for your LLMs](https://www.dreamfactory.com/use-cases/ai-data-access) [MCP Server Drop-in Model Context Protocol](https://www.dreamfactory.com/use-cases/mcp-server) [Legacy Modernization Wrap mainframes with REST](https://www.dreamfactory.com/use-cases/legacy-modernization) [Data Governance Audit every call, enforce every policy](https://www.dreamfactory.com/use-cases/data-governance) [Customer Case Studies](https://www.dreamfactory.com/case-studies) [Energy Modernization](https://www.dreamfactory.com/case-studies/energy-snowflake-modernization) [Government Modernization](https://www.dreamfactory.com/case-studies/government-mainframe-oracle-modernization) [Government Business Intelligence](https://www.dreamfactory.com/case-studies/government-sql-server-bi-analyst-queries) [Manufacturing Modernization](https://www.dreamfactory.com/case-studies/steel-manufacturing-sap-erp-modernization) [Financial Services Investor Portal](https://www.dreamfactory.com/case-studies/financial-services-sql-server-investor-portal) [Non-Profit Partner Data Sharing](https://www.dreamfactory.com/case-studies/non-profit-sql-server-partner-data-sharing) [Professional Services Exec Dashboards](https://www.dreamfactory.com/case-studies/professional-services-erp-dashboards) [Education HR and External Data Sharing](https://www.dreamfactory.com/case-studies/education-student-hr-sql-server-mysql-external-data-sharing) Industries #### [Healthcare HIPAA-grade APIs across EHR, claims, and labs.](https://www.dreamfactory.com/use-cases/healthcare) #### [Financial Services Portfolios, partners, and portals on one layer.](https://www.dreamfactory.com/use-cases/financial-services) #### [Government Modernize mainframes without re-platforming.](https://www.dreamfactory.com/use-cases/government) #### [Manufacturing SAP, MES, and shop-floor data, governed.](https://www.dreamfactory.com/use-cases/manufacturing) SQL Database [SQL SQL Server](https://www.dreamfactory.com/connectors/sql-server) [OR Oracle](https://www.dreamfactory.com/connectors/oracle) [PG PostgreSQL](https://www.dreamfactory.com/connectors/postgresql) [My MySQL](https://www.dreamfactory.com/connectors/mysql) NoSQL & Docs [Dy DynamoDB](https://www.dreamfactory.com/connectors/dynamodb) [Do DocumentDB](https://www.dreamfactory.com/connectors/azure-documentdb) [Mo MongoDB](https://www.dreamfactory.com/connectors/mongodb) [Cb CouchDB](https://www.dreamfactory.com/connectors/couch-db) Cloud Warehouses [S3 S3](https://www.dreamfactory.com/connectors/amazon-s3) [Ab Azureblob](https://www.dreamfactory.com/connectors/azure-blob) [FS FTP/SFTP](https://www.dreamfactory.com/connectors/ftp-sftp) [LS Local Storage](https://www.dreamfactory.com/connectors/local-storage) C & SaaS [Sf Salesforce](https://www.dreamfactory.com/connectors/salesforce) [API REST / SOAP](https://www.dreamfactory.com/connectors/soap-to-rest) [See all 30+ connectors](https://www.dreamfactory.com/connectors) [![back arrow](https://blog.dreamfactory.com/hubfs/raw_assets/public/dreamfactory/images/orange-arrow.svg) Blog](https://blog.dreamfactory.com/) # DreamFactory 7.4.0: MCP Server Integration, Azure AD Group Mapping, and Critical Security Enhancements by Kevin McGahey ![calendar icon](https://blog.dreamfactory.com/hubfs/raw_assets/public/dreamfactory/images/calendar-icon.svg) January 27, 2026 Table of contents RECOMMENDED ARTICLES - [A Complete Guide to API Generation](https://blog.dreamfactory.com/a-complete-guide-to-api-generation) - [10 Best API Management Tools](https://blog.dreamfactory.com/what-is-api-management-a-brief-overview-of-api-management-concepts-and-tools) - [Creating a Microsoft SQL Server API in Less Than 5 minutes with DreamFactory](https://blog.dreamfactory.com/creating-a-microsoft-sql-server-api-in-less-than-5-minutes-with-dreamfactory) - [Hasura vs. DreamFactory: A Comprehensive Comparison](https://blog.dreamfactory.com/hasura-vs-dreamfactory) - [Build A Snowflake REST API in Less Than 5 Minutes](https://blog.dreamfactory.com/generate-a-snowflake-rest-api-in-less-than-5-minutes) DreamFactory announces the general availability of version 7.4.0, a significant release that positions the platform at the forefront of AI-ready enterprise API infrastructure. This release introduces native Model Context Protocol (MCP) server capabilities, enabling seamless integration between AI applications and enterprise data sources. Additionally, v7.4.0 delivers substantial improvements to Azure AD/Entra ID authentication, critical security patches, and enhanced database connector functionality. ## Executive Summary DreamFactory 7.4.0 addresses three strategic priorities for enterprise API teams: AI readiness, identity management simplification, and security hardening. The new MCP Server package enables organizations to expose their existing DreamFactory APIs to AI agents and large language models without additional development. Enhanced Azure AD integration automates role assignment based on Entra ID group membership, reducing administrative overhead. Multiple security vulnerabilities have been patched, including SQL injection and XSS attack vectors, ensuring DreamFactory deployments meet stringent enterprise security requirements. ## What is DreamFactory? **DreamFactory is a secure, self-hosted enterprise data access platform that provides governed API access to any data source, connecting enterprise applications and on-prem LLMs with role-based access and identity passthrough.** This positions DreamFactory as the ideal solution for enterprise teams managing access to multiple data sources, from traditional databases to modern cloud systems, with built-in security, audit trails, and seamless integration with enterprise identity systems like Azure AD. ## New Feature: MCP Server Integration for AI Applications The most significant addition in DreamFactory 7.4.0 is the new `df-mcp-server` package (v1.0.0), which implements the Model Context Protocol specification. MCP has emerged as a standard interface for connecting AI applications—including large language models, AI agents, and copilot systems—to external data sources and tools. ### What This Means for Enterprise Teams Organizations running DreamFactory can now expose their existing REST APIs to AI applications without writing custom integration code. This capability enables several high-value use cases: - **Conversational data access:** Allow AI assistants to query databases, retrieve records, and perform CRUD operations through natural language interfaces - **AI-powered automation:** Enable AI agents to interact with enterprise systems through DreamFactory's unified API layer - **Custom AI tooling:** Build internal AI applications that leverage existing database connections and business logic - **Secure AI integration:** Maintain DreamFactory's role-based access controls when AI systems interact with sensitive data The MCP Server integration includes support for custom login pages, allowing organizations to maintain consistent authentication experiences across human and AI-driven access patterns. ## Azure AD / Entra ID Group-to-Role Mapping DreamFactory 7.4.0 introduces automatic mapping between Microsoft Entra ID (formerly Azure Active Directory) groups and DreamFactory roles. This feature significantly reduces the administrative burden of managing API access permissions in Azure-centric environments. ### Key Capabilities - **Automatic role assignment:** When users authenticate via Azure AD, DreamFactory automatically assigns roles based on their Entra ID group membership - **Permission synchronization on login:** Group membership changes are detected and applied each time a user logs in, ensuring permissions stay current without manual intervention - **Enhanced configuration UI:** The service creation and edit screens now display role-per-app settings, providing better visibility into permission configurations ### Benefits for Enterprise Identity Management Organizations using Microsoft Entra ID as their identity provider can now manage DreamFactory API permissions entirely through their existing Azure AD group structure. This eliminates the need for duplicate permission management across systems and ensures that employee role changes propagate automatically to API access controls. ## Critical Security Fixes DreamFactory 7.4.0 includes multiple security patches addressing vulnerabilities identified through internal security reviews and responsible disclosure processes. ### Patched Vulnerabilities | Vulnerability | Severity | Description | | --- | --- | --- | | PTT-2025-032 | Critical | Security vulnerability patched across df-core and df-system packages | | SQL Injection (RBAC) | High | Replaced string concatenation with parameterized queries in role-based service filtering; added input validation for service IDs | | XSS Prevention | Medium | Server-side input validation for service labels (max 80 characters) and descriptions (max 255 characters); HTML tag stripping implemented | | Private Key Validation | Medium | Added validation checks for private key files to prevent security misconfigurations | **Recommendation:** All DreamFactory users should upgrade to version 7.4.0 to receive these security patches. Organizations running DreamFactory in production environments should prioritize this update. ## [![DreamFactory_blog_CTA_163x200@2x-May-07-2024-08-15-34-3229-AM](https://no-cache.hubspot.com/cta/default/44870387/interactive-167690643360.png)](https://blog.dreamfactory.com/hs/cta/wi/redirect?encryptedPayload=AVxigLKMt4oyWSMvHfsU0tq5o3mdZLEA642mwwSpnTz3LFyZfwK%2B7NIBFwyUg1WRm4DK%2BDmmGNoJIV2UxawZd6baporZVxpX6Ju1sT5zN9jSQzz6yyUIWDUe4aRlrNw%2BL2GP3GUsqr0upKCO56fYC8HtoYQfNs%2FOwwE5DnUbVlU6CZodRTEmWg%3D%3D&webInteractiveContentId=167690643360&portalId=44870387) ## OAuth and Authentication Enhancements Beyond Azure AD group mapping, DreamFactory 7.4.0 includes several authentication improvements that expand integration options for enterprise identity scenarios. ### Active Directory / Entra Client Credentials Flow Full support for the OAuth 2.0 Client Credentials grant type with Microsoft Entra ID enables machine-to-machine authentication scenarios. This is essential for: - Backend services that need to access DreamFactory APIs without user context - Scheduled jobs and automation workflows - Service account authentication patterns - Microservices architectures where services authenticate to each other ### Session Token Support Client credentials authentication now supports session tokens, providing more flexible token management for service accounts and automated systems. ### User Creation Control A new toggle in OAuth configuration allows administrators to control whether new user accounts are automatically created during SSO login. This provides finer control over user provisioning workflows and prevents unauthorized account creation in environments with strict user management policies. ### PostgreSQL System Database Compatibility Improved handling of NOT NULL constraints ensures reliable operation when using PostgreSQL as the DreamFactory system database, expanding deployment options for organizations standardized on PostgreSQL. ## Database Connector Improvements ### Oracle Database: Decimal Type Handling A new toggle in Oracle database service configuration allows full decimal type support for null or unassigned integer types. This aligns DreamFactory's behavior with Oracle's native defaults, improving compatibility for applications that depend on Oracle's specific numeric handling. ### AWS: Virtual Relationships The AWS connector (covering DynamoDB and S3) now supports virtual relationships. This feature enables developers to define cross-table relationships without requiring foreign keys in the underlying data store—particularly valuable for NoSQL databases where traditional relational constraints don't exist. ### Schema Management Fix Resolved an issue where the virtual foreign key slider in the schema tab was not functioning correctly when creating new virtual fields. This fix ensures consistent behavior in the database schema management interface. ## API Documentation and Developer Experience ### Role-Based API Docs Filtering The API documentation interface now filters visible services based on the authenticated user's roles and permissions. Users see only the APIs they have access to, reducing confusion and improving the developer experience in multi-tenant or role-restricted environments. ### IIS Compatibility Fixed parameter handling in IIS deployments where the parameters key was incorrectly interpreted as an HTTP verb. This resolves issues for organizations running DreamFactory on Windows Server with Internet Information Services. ## Infrastructure and Logging ### HTTP/RWS Connector Improvements The HTTP and Remote Web Service connectors have been refactored with improved curl support, providing better error handling and connection management for external API integrations. ### GelfLogger Modernization The GelfLogger class has been refactored to support PHP's `Stringable` interface, ensuring compatibility with modern PHP logging patterns and frameworks. ## Package Version Summary | Package | Previous Version | New Version | | --- | --- | --- | | df-admin-interface | 1.5.x | 1.6.0 | | df-apidoc | 0.8.0 | 0.8.3 | | df-aws | 0.19.x | 0.20.0 | | df-core | 1.0.9 | 1.0.12 | | df-mcp-server | — | 1.0.0 (new) | | df-oauth | 0.18.x | 0.19.0 | | df-rws | 0.18.1 | 0.18.2 | | df-system | 0.6.2 | 0.6.3 | ## Upgrade Path DreamFactory 7.4.0 is a non-breaking upgrade from previous 7.x versions. Standard upgrade procedures apply: 1. Back up your existing DreamFactory system database 2. Update to the latest version using your preferred deployment method (Docker, installer, or Composer) 3. Run database migrations if prompted 4. Clear application caches Organizations using Azure AD authentication should review the new group-to-role mapping feature to determine if it can simplify their current permission management workflows. --- ## Frequently Asked Questions ### How does the new MCP Server integration in 7.4.0 enhance data access for AI applications? DreamFactory is a secure, self-hosted enterprise data access platform that provides governed API access to any data source, connecting enterprise applications and on-prem LLMs with role-based access and identity passthrough. With the new MCP Server support (v1.0.0), AI applications and agents can now securely access your enterprise data through DreamFactory's existing REST APIs. This means conversational AI, LLM-powered automation, and custom AI tooling can all leverage your data sources while respecting role-based access controls and maintaining complete audit trails. ### Does DreamFactory work with Azure AD for automated permission management? Yes. Version 7.4.0 introduces automatic group-to-role mapping for Microsoft Entra ID (Azure AD). When users authenticate via Entra ID, DreamFactory automatically assigns roles based on their group memberships. Permission changes sync at login, eliminating manual administration and keeping data access aligned with your identity management practices. ### What security improvements should prompt an immediate upgrade to 7.4.0? DreamFactory 7.4.0 patches four critical security issues: PTT-2025-032 (critical vulnerability), SQL injection mitigations through parameterized queries in RBAC filters, XSS prevention with server-side validation, and private key validation to prevent misconfigurations. All production deployments should prioritize this upgrade. ## Why Choose DreamFactory for Governed Data Access? DreamFactory 7.4.0 reinforces the platform's position as an enterprise-grade data access platform. Key differentiators include: - **Automatic data access:** Connect databases and instantly provide secure API access with full CRUD operations, eliminating weeks of manual API development - **AI-ready infrastructure:** The new MCP Server integration positions DreamFactory as a bridge between enterprise data and the rapidly evolving AI application ecosystem - **Enterprise identity integration:** Deep integration with Azure AD/Entra ID, LDAP, SAML, and OAuth providers ensures DreamFactory fits into existing enterprise identity architectures - **Security-first design:** Role-based access controls, API rate limiting, and continuous security updates protect sensitive enterprise data - **Multi-database support:** Connect to MySQL, PostgreSQL, SQL Server, Oracle, MongoDB, DynamoDB, Snowflake, and dozens of other data sources through a unified API layer TAGS: [API Gateways,](https://blog.dreamfactory.com/tag/api-gateways) [API Management,](https://blog.dreamfactory.com/tag/api-management-2) [DreamFactory,](https://blog.dreamfactory.com/tag/dreamfactory) [API Development,](https://blog.dreamfactory.com/tag/api-development) [AI Gateway,](https://blog.dreamfactory.com/tag/ai-gateway) [AI Data Gateway,](https://blog.dreamfactory.com/tag/ai-data-gateway) [AI in API Management](https://blog.dreamfactory.com/tag/ai-in-api-management) ![Kevin McGahey](https://blog.dreamfactory.com/hs-fs/hubfs/KevinMcGahey.jpg?width=100&height=100&name=KevinMcGahey.jpg) Kevin McGahey Kevin McGahey is an accomplished solutions engineer and product lead with expertise in API generation, microservices, and legacy system modernization, as demonstrated by his successful track record of facilitating the modernization of legacy databases for numerous public sector organizations. Stay Connected with The Connector Newsletter! Subscribe to stay up-to-date with DreamFactory's latest product updates, API best practices, and tech humor in your inbox. [![Dreamfactory Logo](https://blog.dreamfactory.com/hubfs/raw_assets/public/dreamfactory/images/megamenu/Megamenu-logo.svg)](https://www.dreamfactory.com/) [Call Sales +1 (415) 993-5877](tel:+14159935877) Open – Mon–Fri 9–5 PT [FREE 30 Minute Demo](https://www.dreamfactory.com/demo) #### Follow us - [GitHub](https://github.com/dreamfactorysoftware/dreamfactory) - [Facebook](https://www.facebook.com/dfsoftwareinc/) - [X (Twitter)](https://twitter.com/dfsoftwareinc) - [LinkedIn](https://www.linkedin.com/company/dreamfactory-software) - [YouTube](https://www.youtube.com/c/dreamfactorysoftware) ### Features [Features](https://www.dreamfactory.com/features) [Self hosted](https://www.dreamfactory.com/features#self) [API Generation](https://www.dreamfactory.com/features#api) [Security](https://www.dreamfactory.com/features#secure) [Customization](https://www.dreamfactory.com/features#custom) [Pricing](https://www.dreamfactory.com/pricing) ### Installers [Linux](https://www.dreamfactory.com/features#installer) [Docker](https://www.dreamfactory.com/features#installer) [Kubernetes](https://www.dreamfactory.com/features#installer) ### API Resources [Documentation](https://docs.dreamfactory.com/) [Case Studies](https://www.dreamfactory.com/stories) [White Papers](https://www.dreamfactory.com/resources/whitepapers) [Academy](https://www.dreamfactory.com/academy) [API Calculator](https://calculator.dreamfactory.com) [Open Source](https://github.com/dreamfactorysoftware) ### Company [Blog](https://blog.dreamfactory.com/) [Hub](https://www.dreamfactory.com/hub) [About us](https://www.dreamfactory.com/about) [Partners](https://www.dreamfactory.com/partners) [Support](https://www.dreamfactory.com/support) [Connectors](https://www.dreamfactory.com/connectors) [Contact Us](https://www.dreamfactory.com/demo) © 2025 DreamFactory. All rights reserved. [Terms of Use](https://www.dreamfactory.com/terms-of-use) [Privacy Policy](https://www.dreamfactory.com/privacy-policy) [LLMs](https://www.dreamfactory.com/llms.txt) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Kevin McGahey", "url" : "https://blog.dreamfactory.com/author/kevin-mcgahey" }, "dateModified" : "2026-01-27T21:38:38.457Z", "datePublished" : "2026-01-27T18:00:00.000Z", "headline" : "DreamFactory 7.4.0: MCP Server Integration, Azure AD Group Mapping, and Critical Security Enhancements", "image" : [ "https://blog.dreamfactory.com/hubfs/Gemini_Generated_Image_dgj6ijdgj6ijdgj6-1.png" ], "mainEntityOfPage" : { "@id" : "https://blog.dreamfactory.com/dreamfactory-7.4.0-mcp-server-integration-azure-ad-group-mapping-and-critical-security-enhancements", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.dreamfactory.com/hubfs/DreamFactory%20-%20Orange%20-%20Transparent-1.png" } } } ``` ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "about" : [ { "@type" : "Thing", "name" : "Model Context Protocol (MCP)" }, { "@type" : "Thing", "name" : "Azure AD / Microsoft Entra ID" }, { "@type" : "Thing", "name" : "API Security" }, { "@type" : "Thing", "name" : "OAuth 2.0" }, { "@type" : "Thing", "name" : "Database Connectors" } ], "articleSection" : [ "Executive Summary", "New: MCP Server Integration for AI Applications", "Azure AD / Entra ID Group-to-Role Mapping", "Critical Security Fixes", "OAuth & Authentication Enhancements", "PostgreSQL System DB Compatibility", "Database Connector Improvements (Oracle, AWS, Schema UI)", "API Docs & Developer Experience", "Infrastructure & Logging Updates", "Package Version Summary", "Upgrade Path", "Why DreamFactory for Enterprise API Management" ], "audience" : { "@type" : "Audience", "audienceType" : "Enterprise API teams, platform engineers, security & identity teams" }, "description" : "DreamFactory 7.4.0 introduces native Model Context Protocol (MCP) server support for AI integrations, Azure AD/Entra ID group-to-role mapping, critical security patches, OAuth improvements, connector upgrades, and a non-breaking upgrade path.", "headline" : "DreamFactory 7.4.0: MCP Server Integration, Azure AD Group Mapping, and Critical Security Enhancements", "inLanguage" : "en", "isPartOf" : { "@type" : "Blog", "name" : "Blog", "url" : "https://blog.dreamfactory.com/" }, "keywords" : "DreamFactory 7.4.0, MCP server, Model Context Protocol, Azure AD, Entra ID, group-to-role mapping, security patches, OAuth client credentials, PostgreSQL system DB, Oracle decimals, AWS virtual relationships, GELF logging, HTTP connector", "learningResourceType" : "Release notes", "mainEntityOfPage" : { "@id" : "https://blog.dreamfactory.com/dreamfactory-7.4.0-mcp-server-integration-azure-ad-group-mapping-and-critical-security-enhancements" }, "url" : "https://blog.dreamfactory.com/dreamfactory-7.4.0-mcp-server-integration-azure-ad-group-mapping-and-critical-security-enhancements" } ``` ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "The df-mcp-server (v1.0.0) implements the Model Context Protocol so AI apps and agents can securely access existing DreamFactory REST APIs—supporting conversational data access, AI-driven automation, and custom AI tooling while honoring role-based access controls." }, "name" : "What does the new MCP Server integration enable in DreamFactory 7.4.0?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "When users authenticate via Entra ID, DreamFactory automatically maps their group memberships to platform roles. Permissions sync at login, reducing manual administration and keeping API access aligned with identity changes." }, "name" : "How does Azure AD/Entra ID group-to-role mapping help?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Patches include a critical fix (PTT-2025-032), SQL injection mitigations in RBAC filters via parameterized queries and validation, XSS prevention on service labels/descriptions, and private key validation to prevent misconfiguration." }, "name" : "Which security issues were addressed in 7.4.0?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Full OAuth 2.0 Client Credentials support for Entra ID enables service-to-service auth; session tokens are supported for client-credentials flows; and admins can toggle auto user-creation on SSO to match provisioning policies." }, "name" : "What authentication enhancements are included?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "No. 7.4.0 is a non-breaking upgrade for 7.x. Back up the system database, update via your deployment method (Docker/installer/Composer), run migrations if prompted, and clear caches. Production users should prioritize the security fixes." }, "name" : "Is upgrading to 7.4.0 breaking?" } ] } ```