Microsoft MCP Server for Enterprise

Microsoft MCP Server for Enterprise

Overview

Built on the open Model Context Protocol, the public preview of Microsoft MCP Server for Enterprise lets AI agents access Microsoft Entra data by converting natural language queries into Microsoft Graph API calls. Developers and IT administrators use it to query Microsoft Entra data from their AI-powered workflows.

Full Documentation: Overview of Microsoft MCP Server for Enterprise

MCP Server Provisioning (execute once per tenant)

To set up the MCP Server for your tenant:

1. Provision the MCP Server. In Graph Explorer, send: POST https://graph.microsoft.com/v1.0/servicePrincipals Body: { "appId": "e8c77dc2-69b3-43f4-bc51-3213c9d915b4" }

1. [Register a new app](https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/CreateApplicationBlade/quickStartType~/null/isMSAApp~/false), representing the MCP Client. Set the appropriate Redirect URI (also called Reply URL) depending on the client (see table below).

Redirect URI type matters in Microsoft Entra. If you add the URI under Web, Entra treats the app as a confidential client. Use that for apps that run on a server and can protect credentials (like *Copilot Studio*). At sign-in, Entra expects that app to authenticate with a client_secret or a certificate-based client_assertion.

If you add the URI under Mobile and desktop applications or another public-client platform, Entra treats the app as a public client. Use that for desktop, CLI, or device apps that cannot keep a secret (like *ChatGPT* or *Claude*). These apps usually use the authorization code flow with PKCE instead of a client secret.

1. Associate the MCP permissions (MCP. ) between the MCP Server and the MCP Client

Create a custom VS Code or GitHub Copilot CLI client with PowerShell

After provisioning the MCP Server in step 1, use Microsoft.Entra.Beta 1.3.0 or later and an appropriate administrator role to create a public client and grant the scopes you need. This example grants user read access. Set $redirectUri to http://localhost for VS Code or http://127.0.0.1:51001 for GitHub Copilot CLI:

Connect-Entra -Scopes 'Application.ReadWrite.All', 'DelegatedPermissionGrant.ReadWrite.All' -ErrorAction Stop

$redirectUri = 'http://localhost' $app = New-EntraBetaApplication -DisplayName 'Enterprise MCP Client' -SignInAudience 'AzureADMyOrg' -PublicClient @{ RedirectUris = @($redirectUri) } -ErrorAction Stop $app.AppId Grant-EntraBetaMCPServerPermission -ApplicationId $app.AppId -Scopes 'MCP.User.Read.All' -ErrorAction Stop

Use the returned app ID in the VS Code or GitHub Copilot CLI custom client configuration. The grant cmdlet provisions the client service principal if needed.

The PowerShell setup uses Application.ReadWrite.All, DelegatedPermissionGrant.ReadWrite.All, and an appropriate Entra administrator role. The MCP Client doesn't need these setup permissions at runtime: you can revoke setup-only grants and release setup-only roles after provisioning. Managing consent later requires administrator authorization again.

Info Table

VS Code's default client uses a pre-registered application with its own redirect URIs. To add an HTTP 127.0.0.1 URI to a custom app through the portal, use the application manifest.

Tools

This MCP Server uses Retrieval-Augmented Generation (RAG) and few-shot prompting to generate complete Microsoft Graph queries rather than exposing a separate tool per Graph operation. It exposes three tools:

1. `microsoft_graph_suggest_queries`: Finds relevant Microsoft Graph API calls based on user intent.
2. `microsoft_graph_get`: Executes read-only Microsoft Graph API calls, respecting User roles and MCP Client scopes.
3. `microsoft_graph_list_properties`: Retrieves properties of specific Microsoft Graph entities to help the AI model

Current scope and capabilities

For Public Preview, we support read-only enterprise IT scenarios in Microsoft Entra identity and directory operations (user, group, application, device management, and administrative actions).

The MCP Server handles queries such as:

1. Security posture: authentication methods/strengths, Conditional Access, Security Defaults.
2. Privileged access: Who has which directory roles, how assigned (direct vs group), and PIM status.
3. Application risk: Which Apps / Service Principals exist, who owns them, what permissions/SSO they use, and which are ownerless or external.
4. Access governance: Who has access to what (users, groups, packages); review decisions, automate joiner/mover/leaver.
5. Device readiness: Managed/compliant status, join state, OS/version distribution, and stale or inactive devices.
6. Provenance and investigation: End‑to‑end telemetry (sign‑in, audit, provisioning, network), health alerts, and SLA/availability.
7. Optimize spending & hygiene: License counts/usage, unused or stale apps/groups, domain configuration and contacts.

Supported Clients and Configurations

The Microsoft MCP Server for Enterprise works with any MCP-compatible client that supports the latest standard.

⚠️ Notes:

- Dynamic Client Registration (DCR) is not supported, but we are working to support OAuth Client ID Metadata Documents (CIMD) in a future release.

- ChatGPT, Claude, and other 3P Agents require a custom client Id: register your own MCP Client application in your tenant, assign the required MCP.* scopes, and configure the redirect URIs accordingly.

Microsoft Agent Platforms

• [Copilot Studio](https://learn.microsoft.com/graph/mcp-server/use-enterprise-mcp-server-copilot-studio)
• [Microsoft Foundry](https://learn.microsoft.com/graph/mcp-server/use-enterprise-mcp-server-microsoft-foundry)

Third Party MCP clients

These clients require a custom MCP Client application registered in your tenant. See Authorization and permissions to grant the required MCP.* scopes to your app.

ChatGPT

Go to Settings, Apps, **Create App*