---
schema_version: "1"
id: 09a015875bc1c0e1bbfc1f8911dfcf3a8cf80d2559951dd8822780358f5146da
title: Authenticate to External MCP Servers with Per-User Credentials
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/264-0-0/rn_agentforce_mcp_per_user_auth.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_agentforce_mcp_per_user_auth.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 9153e442a6af89559fa9fc8168fc35c53728733c2572dc34cc3707d968805aee
description: Allow Agentforce Employee agents (AEA) to act on behalf of individual users with user-based Model Context Protocol (MCP) servers. With per-user authentication, your users can access an external MCP server with their own credentials instead of a shared system-to-system connection. Eliminate shared service-user tokens and ensure a clear per-user audit trail.
products:
  - Cross Cloud
release: "264"
---
# Authenticate to External MCP Servers with Per-User Credentials

Allow Agentforce Employee agents (AEA) to act on behalf of individual users with user-based Model Context Protocol (MCP) servers. With per-user authentication, your users can access an external MCP server with their own credentials instead of a shared system-to-system connection. Eliminate shared service-user tokens and ensure a clear per-user audit trail.

**Where:** This change applies to Lightning Experience in Enterprise, Performance, Unlimited, and Developer editions.

**When:** Agentforce client per-user authentication for external MCP servers is Generally Available on a rolling basis in Salesforce orgs upgraded to Winter '27 starting the week of October 5, 2026. Go to [trust.salesforce.com](http://trust.salesforce.com) for exact dates.

**How:** Per-user authentication uses an external credential to connect to the MCP server. A Salesforce admin creates the external credential. Then, add a principal with the per-user identity type, either during the MCP server registration flow or by using Named Credentials in Setup.

When registering an MCP server, for Authentication Method, select **External Credential**, select an available external credential that’s in a **Configured status**, then select **Create and Continue**.

![Select an external credential in the Configured state only.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-release-notes-salesforce_release_notes-264-0-0-production-enus/550ba85b-db1a-4608-9cd4-9a65ec96e1fa/salesforce_release_notes/images/rn_agentforce_mcp_per_user_auth_select.png)

Allowlist the MCP server tools that you want, then grant user access by assigning to them the permission set associated with the external credential.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-release-notes-salesforce_release_notes-264-0-0-production-enus/550ba85b-db1a-4608-9cd4-9a65ec96e1fa/images/icon_note.png)

Note Only Salesforce-authenticated users with this permission set can access a tool.

The first time a user attempts to access a tool on the MCP server, they’re prompted to provide their user credentials. Then, they're prompted to allow Salesforce to access the tool using their credentials.

![Click Manage User Assignments to grant access to users for this external credential.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-release-notes-salesforce_release_notes-264-0-0-production-enus/550ba85b-db1a-4608-9cd4-9a65ec96e1fa/salesforce_release_notes/images/rn_agentforce_mcp_per_user_auth_assign.png)

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-release-notes-salesforce_release_notes-264-0-0-production-enus/550ba85b-db1a-4608-9cd4-9a65ec96e1fa/images/icon_note.png)

Note If a user provides their credentials and allows access while in preview mode in Agentforce Builder, they're required to indicate in the conversation (for example, by typing Done) that they’ve completed these authentication steps.

- If a user’s OAuth credentials expire, they’re prompted to resubmit their credentials.
- Users can manually allow or revoke per-user external credential authorization under their My Personal Information section.

#### See Also

- [_Salesforce Help_: Register an MCP Server in Agentforce Registry](https://help.salesforce.com/s/articleView?id=ai.agent_mcp_connect_register.htm&language=en_US)