Microsoft Entra ID MCP Server

Microsoft Entra ID MCP Server is an MCP server that connects LLM clients to Microsoft Graph API to manage identity, security, and directory services within Microsoft Entra ID. Designed for system administrators, security engineers, and DevOps teams, it enables automated exploration and execution of identity management tasks through a modular FastMCP implementation. The server provides tools to query and manage users, list privileged account roles, evaluate group memberships, and inspect managed Intune devices. It also supports application registration and service principal management, Conditional Access policy inspection, directory audit log retrieval, and user sign-in analysis. Additionally, it features password reset capabilities with options to enforce changes on sign-in, MFA status verification across users and groups, and built-in permission helpers that recommend minimal Microsoft Graph permissions for specific operational tasks.

Category: Cloud & Infrastructure

Tags: azure-ad, iam, identity-management, microsoft-entra-id, microsoft-graph

Visit Microsoft Entra ID MCP Server

How to install and configure Microsoft Entra ID MCP Server

1. Clone the repository locally: bash git clone https://github.com/hieuttmmo/entraid-mcp-server 2. Create a config/.env file with your Azure AD credentials: env TENANT_ID=your-tenant-id CLIENT_ID=your-client-id CLIENT_SECRET=your-client-secret 3. Run or test the server using the FastMCP command-line tool: bash fastmcp dev 'path/to/src/msgraph_mcp_server/server.py' 4. To connect to an MCP client like Claude Desktop, add an entry under mcpServers pointing to your Python environment executing src/msgraph_mcp_server/server.py or refer to the repository README at https://github.com/hieuttmmo/entraid-mcp-server for client-specific configuration details.

What you can do with Microsoft Entra ID MCP Server

• Inspecting privileged directory roles to audit which administrative accounts have high-level security permissions. * Auditing recent sign-in history and multi-factor authentication (MFA) status for users and security groups. * Managing user password resets directly while enforcing password changes during the next sign-in attempt. * Creating, updating, or deleting Microsoft Entra ID groups and modifying member and ownership assignments. * Querying Conditional Access policies, directory audit logs, and managed Intune devices for compliance checks. * Managing app registrations and service principals, including reviewing assigned app roles and delegated permissions.

Key facts

• Open Source
• https://github.com/hieuttmmo/entraid-mcp-server
• Cloud & Infrastructure, Security & Compliance
• azure-ad, iam, identity-management, microsoft-entra-id, microsoft-graph

Part of MCP Servers

How do I install Microsoft Entra ID MCP Server?

You install the server by cloning the GitHub repository and configuring your Microsoft Entra ID credentials in a config/.env file with TENANT_ID, CLIENT_ID, and CLIENT_SECRET. You can run and test the server using the FastMCP command-line tool by launching fastmcp dev against the server.py entry point, or configure it as a local Python MCP server in your preferred MCP client configuration file.

What can Microsoft Entra ID MCP Server do?

The server enables LLMs to query users, manage groups, inspect app registrations, review service principals, and check Intune managed devices. It also performs security operations such as querying Conditional Access policies, retrieving directory audit and sign-in logs, reporting MFA status, resetting user passwords, and suggesting required Microsoft Graph API permissions.

Which MCP clients work with Microsoft Entra ID MCP Server?

Because it is built using FastMCP, the server supports standard Model Context Protocol clients including Claude Desktop, Cursor, and the FastMCP interactive development environment and Inspector. Any client that can run a Python script or command via the standard MCP protocol is supported.

What Microsoft Graph permissions are required?

The permissions required depend on the tools you execute. Common application permissions include AuditLog.Read.All, Directory.Read.All, Group.ReadWrite.All, User.Read.All, User-PasswordProfile.ReadWrite.All, Policy.Read.All, RoleManagement.Read.Directory, and Application.ReadWrite.All. The server also includes a permissions helper tool to recommend minimal permissions for specific tasks.

Is Microsoft Entra ID MCP Server open source?

Yes, Microsoft Entra ID MCP Server is an open-source project hosted on GitHub under the repository hieuttmmo/entraid-mcp-server. You can review the code, clone it, submit issues, or extend resource modules directly through GitHub.