Microsoft Entra ID MCP Server

What it is

A Python FastMCP server over the Microsoft Graph API, organised as one module per resource: users, groups, applications and service principals, sign-in logs, MFA and password operations.

What you get

• search_users by name or email, get_user_by_id for one account
• get_user_groups and get_user_roles for a user's memberships and directory roles
• get_privileged_users for the members of directory roles across the tenant
• Group lifecycle and membership: create, read, update and delete, plus adding and removing members and owners
• Applications and service principals: list, create, update and delete, with app role assignments and delegated permissions for both
• Sign-in logs for a user over the last X days
• MFA status for one user or for every member of a group
• Password reset with a custom or generated password, optionally requiring a change at next sign-in
• A permissions helper that suggests the Graph permissions a task needs, so a grant can stay narrow

Requirements

Credentials for a Microsoft Graph app registration, kept in a .env file the repository excludes from version control. Which Graph permissions you must grant depends on which modules you use — the built-in permissions helper names them per task.

Setup effort

Follow the published steps — Clone the repo.

Tools you get

39 tools named in the project's documentation. Many tools write to your tenant, such as create_group, delete_group and reset_user_password_direct. All register regardless of permissions; writes fail unless the app has permissions such as Group.ReadWrite.All.

Requires

• TENANT_ID in your environment
• CLIENT_ID in your environment
• CLIENT_SECRET in your environment