Hosting

remote

Transport

Streamable HTTP (MCP endpoint documented; client implementation details vary)

Endpoint

https://mcp.svc.cloud.microsoft/enterprise

Authentication

Microsoft Entra interactive delegated authorization. App-only permissions and app-only workflows are not supported. Tenant provisioning and granting client scopes require Application Administrator or Cloud Application Administrator privileges; delegated scopes follow MCP.{Microsoft Graph scope name}.

Requirements

• Microsoft Entra tenant in the global service deployment; not available in US Government L4/L5 or China 21Vianet clouds per preview documentation
• Tenant administrator with Application Administrator or Cloud Application Administrator role for initial provisioning and admin consent
• MCP client application registered and granted the required delegated MCP scopes
• Access to Microsoft Graph data; some data requires separate product licenses

Setup steps

1. For the documented VS Code path, use Microsoft Learn
2. For tenant provisioning/custom client setup, run the documented Microsoft.Entra.Beta PowerShell module flow as an administrator: install module version 1.0.13 or later, connect with Application.ReadWrite.All, Directory.Read.All, and DelegatedPermissionGrant.ReadWrite.All, then grant permissions for the chosen MCP client.
3. Configure the client to connect to https://mcp.svc.cloud.microsoft/enterprise and complete interactive Microsoft Entra sign-in/consent. For a custom client, register a single-tenant Entra app, set its platform/redirect URI, add only scenario-required delegated MCP scopes, and grant administrator consent.
4. Start with a harmless read-only question such as counting tenant users; inspect the returned tool and Graph request. The server tools are documented as read-only.

Three exact tools are listed in Microsoft Learn. The server is preview, currently global-cloud only, and supports read-only queries; it respects delegated Graph scopes and has a 100-call-per-minute-per-user limit.

• microsoft_graph_suggest_queries

  Find Microsoft Graph query examples relevant to an identity or directory question.

  01
• microsoft_graph_get

  Run a read-only Microsoft Graph call under the signed-in user’s delegated permissions.

  02
• microsoft_graph_list_properties

  Retrieve property and relationship metadata for Microsoft Graph entities.

  03

• Preview; service behavior may change.
• Global cloud only; government cloud and China 21Vianet deployments are listed as unavailable.
• Read-only Graph calls only; app-only permissions are unsupported.
• 100 calls per minute per user; microsoft_graph_get calls also follow Microsoft Graph throttling.
• Some requested data requires separate Microsoft product licenses.
• Tenant-wide setup and consent require administrator privileges; this is distinct from ordinary user connection.

• official documentation

  Current Microsoft Learn documentation lists exactly three tools and describes the service as a public preview, global-cloud-only, read-only enterprise identity/directory query interface. Authorization uses delegated Microsoft Entra scopes and respects the signed-in user’s Graph permissions; calls are rate-limited.

• official tool reference

  Current Microsoft Learn documentation lists exactly three tools and describes the service as a public preview, global-cloud-only, read-only enterprise identity/directory query interface. Authorization uses delegated Microsoft Entra scopes and respects the signed-in user’s Graph permissions; calls are rate-limited.

Documentation checked 2026-10-28T13:26:33Z. Connection has not been runtime tested.