# microsoft-sentinel
> A Microsoft-hosted MCP tool collection for querying Sentinel data-lake workspaces, discovering tables, analyzing users and URLs, and exploring Sentinel security graphs. Microsoft offers other separate collections; this record covers the documented data-exploration collection.
Canonical: https://www.mcpfolio.com/servers/microsoft-sentinel
Last updated: 2026-10-28
## Catalog record

- Publisher: Microsoft
- Categories: search

## Website

https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-overview

## Transports

HTTP; Microsoft client guide describes adding an HTTP server and does not specify a more precise transport subtype.

## Authentication

Microsoft Entra interactive authentication. The general setup guide requires at least Security Reader for listing/invoking tools. Entity analysis additionally requires Security Copilot Contributor and consumes Security Compute Units; graph access requires read-only Microsoft Security Exposure Management access.

## Tools

- **search_tables**: Search connected workspace table catalogs by natural-language query and return relevant schemas.
- **query_lake**: Execute one KQL query against a Microsoft Sentinel data-lake workspace; intended for focused retrieval, not bulk export.
- **list_sentinel_workspaces**: List accessible Sentinel data-lake workspace names and IDs; run before other tools that require a workspace ID.
- **analyze_user_entity**: Start AI-supported analysis of a Microsoft Entra user entity over a time window.
- **analyze_url_entity**: Start AI-supported analysis of a URL using organization and Microsoft threat-intelligence data.
- **get_entity_analysis**: Retrieve/poll a previously started entity-analysis job.
- **find_blastradius**: Analyze graph propagation paths from an entity toward critical assets.
- **find_walkable_paths**: Find traversable connections between graph source and target entities.
- **find_exposure_perimeter**: List incoming graph connections and exposure paths for a target entity.
- **find_connected_nodes**: Find graph paths between entities matching source and target criteria.
- **find_nodes**: Find graph nodes matching label/property criteria.
- **get_graph_context**: Return graph context, supported functionality, labels, and parameter guidance.

## Sources

- [publisher_documentation](https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-data-exploration-tool)
- [publisher_client_setup](https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-use-tool-visual-studio-code)
- [publisher_overview](https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-get-started)
- [publisher_limits_and_pricing](https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-billing)

## Setup

Use the interactive setup panel on [the detail page](https://www.mcpfolio.com/servers/microsoft-sentinel) to view instructions for each supported client.