Google Cloud and Gemini Enterprise administrators in your organization can work with Tamr to connect the Tamr MCP server to Gemini Enterprise. Setup takes about 30 minutes once you have your connection details from Tamr.

Gemini connects to the Tamr MCP server as a custom MCP connector and signs each user in with their Tamr account.

Before you begin

You need the following before you start:

A Gemini Enterprise subscription and an app in your Google Cloud project.
The Organization Policy Administrator role (roles/orgpolicy.policyAdmin) in your Google Cloud organization, or someone who has it.
Admin access to your Gemini Enterprise app, so you can create and bind data stores.
A Tamr user account in your organization, to test the connection.

Request Your Connection Details from Tamr

Contact Tamr Support ([email protected]) and ask for a Gemini Enterprise connection. Indicate in the request whether your users sign into Tamr with Single Sign-On (SSO).

Tamr creates a client for your organization and sends you the following:

Detail	Example or Description
Your Tamr tenant name	`acme`
Client ID	A public identifier for your organization's client
Client secret	Sent through a secure channel. Store it in your secrets manager and do not share it.

The client secret is unique to your organization. If you think the secret may have been exposed, contact Tamr Support to rotate it ([email protected]).

The rest of these instructions use <tenant> in place of your Tamr tenant name.

Set Up the Connection

Setup has three steps that must be completed in this order:

Update your organizations policies to allow custom MCP connectors.
Create the Tamr data store.
Bind and authorize the Tamr data store.

Step 1: Update your organization policies

Google Cloud blocks custom MCP connectors by default.

To allow the Tamr connector:

In the Google Cloud console, go to IAM & Admin > Organization Policies.
For each policy in the table below, filter by its name and select Manage policy > Override parent's policy.
Apply the setting and save.

Important: You can skip the Cloud Run Invoker step in Google's custom MCP server instructions. The Tamr MCP server handles its own sign-in.

Policy	Setting	When to change it
Disable custom MCP server connector for Gemini Enterprise	Add a rule with Enforcement: Off	Always
`discoveryengine.managed.allowedEgressFqdns`	Keep Enforcement: On. Add `<tenant>.tamr.cloud` and `auth.tamr.cloud` as custom values. Enter the bare domains, without `https://`.	If this policy is enforced in your organization
`discoveryengine.managed.allowedDataSources`	Add `custom_mcp`. Keep your existing values.	If this policy is enforced on the project, or the project uses VPC Service Controls

Step 2: Create the Tamr data store

In Gemini Enterprise, go to Data stores and create a new data store.
Select Custom MCP server as the source.
Enter the following values and then save the data store:

Field	Value
MCP server URL	`https://<tenant>/tamr.cloud/mcp`
Authorization URL	`https://auth.tamr.cloud/authorize`
Token URL	`https://auth.tamr.cloud/oauth/token`
Client ID	The client ID from Tamr
Client secret	The client secret from Tamr
Scopes	`openid profile email offline_access`
Authorization URL parameters	`&audience=https://mcp.tamr.cloud&organization=<tenant>`
PKCE	Enabled

For example, if your tenant name is acme, the MCP server URL is https://acme.tamr.cloud/mcp, and the authorization URL parameters are &audience=https://mcp.tamr.cloud&organization=acme.

Step 3: Bind, authorize, and enable actions

The data store is not usable until you complete all three of these steps:

Bind the data store to your app. In your Gemini Enterprise app, open its connected data stores and add the Tamr data store.
Authorize the connector. Sign in to your Gemini Enterprise app. When prompted, authorize the Tamr connector. You are redirected to the Tamr sign-in page. Sign in with your Tamr account.
Enable the actions. Return to the Tamr data store's configuration and turn on its actions, such as tamr_list_projects. Gemini finds the actions only after you authorize, and they are turned off by default. Gemini can not use Tamr until you turn them on.

Verify the connection

The connection works when Gemini returns your Tamr projects.

To verify the connection:

Confirm that the Tamr sign-in in Step 3 finished without an error.
In your Gemini Enterprise app, ask: "List my Tamr projects."
Confirm that Gemini returns the projects in your Tamr organization.

Other users in your organization can now use the connector. Each user signs in with their own Tamr account the first time they use it, and sees only the data their Tamr account can access.

Troubleshooting the connection

Most setup problems come from a missed policy or a mistyped URL parameter. Check the table for likely causes and resolutions for common problems.

Problem	Likely Cause and Resolution
"Operation denied by org policy" when you create the data store.	An organization policy still blocks the connector. Find the policy named in the error and update it as described in Step 1.
Sign-in or the connection check fails before the Tamr sign-in page loads.	`<tenant>.tamr.cloud`or `auth.tamr.cloud` is missing from `allowedEgressFqdns`. Add both domains; do not include `https://`.
The Tamr sign-in page shows an organization error.	`organization=<tenant>` is missing or misspelled. Correct the authorization URL parameters.
Sign-in fails with "no connections enabled", or SSO users can't sign in.	Your SSO connection is not enabled on your Tamr tenant. Contact Tamr Support ([email protected]) to configure SSO.
Sign-in works, but Gemini reports an access or permission error.	The organization parameter and the MCP server URL name different tenants. Make sure both use the same tenant name.
Sign-in works, but Gemini reports an invalid token.	`audience=https://mcp.tamr.cloud` is missing from the parameters. Add it to the authorization URL parameters.
Gemini says it has no Tamr tools, or never uses them.	The data store is not bound to the app, or its actions are off. Complete Step 3: Bind the data store, then turn on its actions
Sign-in works, but every Tamr request fails.	Your client is not fully set up on the Tamr side. Contact Tamr Support ([email protected])

Contact Tamr Support

If the problem continues, contact Tamr Support ([email protected]) with:

Your Tamr tenant name.
Your client ID. Do not send the client secret.
The exact error message, and the time it happened, including your time zone.

To remove Gemini's access to Tamr, or to get a new client secret, contact Tamr Support. A new secret keeps the same client ID, so you only update the secret in your data store. Removing access and setting it up again gives you a new client ID and secret; repeat step 2 with these new values.