Microsoft Entra ID and AI: Is there an MCP server for Entra ID?

Microsoft Entra ID is, according to Microsoft, an identity and access solution for on-premises and cloud environments. If you want an AI assistant to answer questions about the directory, such as “Who has no MFA?”, the question is: is there an MCP server for it?

In short

Yes. Microsoft offers the Microsoft MCP Server for Enterprise. According to Microsoft, it is in preview and read-only. Claude and ChatGPT need their own app registration in your tenant. The server does not cover on-premises Active Directory.

What Microsoft offers itself

The MCP server. According to Microsoft, https://mcp.svc.cloud.microsoft/enterprise is an interface through which AI agents query data in the Entra tenant in natural language. The server translates the requests into Microsoft Graph calls. It has three tools: microsoft_graph_suggest_queries finds matching Graph queries, microsoft_graph_get runs read-only Graph calls, and microsoft_graph_list_properties returns the schema of Graph objects. Microsoft names user, group, application and device insights and reporting as use cases. The documentation states the preview status explicitly: according to Microsoft, the prerelease product may still change substantially. According to Microsoft, the server is available only in the global cloud, not in the US Government clouds and not in the cloud operated by 21Vianet in China.

Read-only, not changing. According to Microsoft, the preview covers only read-only scenarios. According to the README, write support is planned for a later release.

Permissions. According to Microsoft, the server supports only delegated permissions, no app-only access. The scopes are named MCP.<Graph scope>, for example MCP.User.Read.All. All scopes listed in the documentation are read scopes. What counts is what the client scope and the signed-in user’s rights allow together. Administrators grant scopes through Entra PowerShell or the Entra admin center. For provisioning, Microsoft names the roles Application Administrator or Cloud Application Administrator. For permission management with PowerShell, the documentation also names Privileged Role Administrator. The server must be provisioned once per tenant.

Licence and limits. According to Microsoft, the server needs no extra licence. You need the right licence for the data you query, for example Entra ID Governance or Entra ID P2 for Privileged Identity Management content. Requests are limited to 100 calls per minute per user. For microsoft_graph_get, the Microsoft Graph throttling limits apply on top. According to Microsoft, the Microsoft Graph activity log records every request of the server if you switch it on in the tenant.

Which clients work. According to the README, the server works with any MCP client that supports the current standard. It does not support Dynamic Client Registration. Microsoft names Copilot Studio and Microsoft Foundry as its own platforms, plus Visual Studio Code and GitHub Copilot CLI. For ChatGPT, Claude and other third-party agents, the README requires your own client app in the tenant, with the needed MCP.* scopes and the right redirect URIs. For Claude, the README describes the path “Customize, Connectors, Add Custom Connector”, and for ChatGPT “Settings, Apps, Create App”. The PowerShell documentation instead lists ChatGPT and Claude as predefined clients that the Grant-EntraBetaMCPServerPermission command creates itself. Both statements come from Microsoft, and we did not check which one is correct. We did not check which Claude and ChatGPT plans allow custom connectors.

Data location. According to the README, the server runs in the same regions as Microsoft Graph. None of the pages we read names a location for processing inside the MCP server. According to the README, the server does not log request payloads. What the AI client does with prompts and answers falls under its own terms.

Microsoft Graph. According to Microsoft, Graph is the gateway to data in Microsoft cloud services such as Microsoft Entra and Microsoft 365. According to the README, Microsoft 365 interfaces are to be covered by Agent 365 in future. Microsoft 365 itself has its own page: Microsoft 365.

On-premises Active Directory. On-premises Active Directory (Windows Server) is a different product. The Microsoft server queries the Entra tenant, not the domain controllers. For hybrid environments, Microsoft documents Microsoft Entra Connect and Cloud Sync. These are sync tools, not MCP servers. We found no official Microsoft MCP server for on-premises Active Directory.

AI in the product. According to Microsoft, Security Copilot can be integrated with Microsoft Entra, among other products. We read no separate statement on data processing or training for Entra.

What the community offers

There are several open-source servers. shigechika/entraadm-mcp (MIT) evaluates sign-in and audit logs. According to the README, it only reads, with one exception: an optional tool signs an account out everywhere if you switch it on. msetsma/entra-mcp (Apache-2.0) reads organisation structure and group membership through the Azure CLI, also read-only. According to its README, hieuttmmo/entraid-mcp-server has tools to create and delete groups and applications and to reset passwords. Its README names MIT, but the repository has no licence file, and the last commit dates from 2 May 2025. For on-premises Active Directory there is, for example, alpadalar/ActiveDirectoryMCP (MIT, over LDAP). According to its README, it is read-only by default. Its tests ran against a mock and an OpenLDAP lab, not against a real Active Directory. There is also kirune/entra-mcp (AGPL-3.0). According to its README, it reads as the asking user only, across Entra ID, Intune, Exchange Online and Teams, with 19 GET-only tools. We did not try any of these servers.

Hosting platforms and connectors also offer Entra ID tools. According to Pipedream, every Entra ID action is an MCP tool on its server, for example “Add Member To Group”. Zapier names, on its own page, an MCP connection for Entra ID actions such as “Create Group”. According to its README, CData offers a read-only MCP server (MIT) that needs the licensed CData JDBC driver. According to meinGPT, the meinGPT connector is permanently read-only. All four are commercial offerings, not community servers. The pages do not prove how the data is processed. We could not read the CData page on Entra ID and ChatGPT because CData blocks automated access.

What this means for your company

• The Microsoft server is a preview. Do not plan production use on it.
• Grant only the MCP.* scopes your questions need. Directory data is sensitive.
• For Claude or ChatGPT, your administrator creates an own app in the tenant. This is a setup step, not a button.
• If you want to query on-premises Active Directory, you need a different route than the Microsoft server.
• What reaches the AI assistant falls under its terms, no longer under those of Microsoft.