Azure AI Foundry Agent Unable to Use Credentials Stored in Key Vault Through Playwright MCP Tool

Key Vault permissions alone won’t automatically inject secrets into a Custom MCP tool. The secure pattern is still for the MCP server/tool to retrieve the secret server-side, ideally with managed identity, and perform the login without exposing credentials to the prompt or model.

For Playwright MCP specifically, I would not expect built-in Key Vault integration unless the server has been customized to do that. Also worth watching is Microsoft’s Browser Automation Tool / BAT in Foundry Agent Service, which is designed for browser-based automation using Playwright Workspaces. It may become the cleaner native option for these workflows, but the credential handling should still remain server-side and not be passed through the agent conversation.