Entraid MCP Server

This project is a modular FastMCP server based on the Microsoft Graph API, providing enterprise - level identity management functions such as user management, login log query, and MFA status checking, with high scalability and security.

Security Developer tools #Identity management #Enterprise security #Microsoft integration .Python

rating : 2 points

downloads : 11

update time : 2025-04-28

What is EntraID MCP Server?

EntraID MCP Server is a management tool built on the Microsoft Graph API, specifically designed to simplify the management of Microsoft Entra ID (formerly Azure AD). It provides a complete set of user management, security auditing, and permission management functions, allowing administrators to easily complete daily identity management tasks through standardized interfaces.

How to use EntraID MCP Server?

To use this service, you need to configure Azure AD application permissions first, and then perform various management operations through simple REST API calls or by using the provided command-line tools. The system supports both interactive development and batch automation operation modes.

Use cases

It is particularly suitable for enterprise IT administrators who need to centrally manage Microsoft 365 user identities, security auditors, and developers who need to integrate the Microsoft Graph API into existing systems. Typical scenarios include: user lifecycle management, security compliance auditing, privileged account monitoring, etc.

Main features

User managementProvides complete user CRUD operations, including functions such as searching, viewing details, and resetting passwords. Supports querying users by multiple conditions such as name and email.

Security auditingCan query user login logs, obtain MFA status, check security-related information such as privileged users, and help administrators monitor account security.

Permission helperIntelligently recommends the minimum Graph API permissions required to complete specific tasks, helping to implement the principle of least privilege.

Group managementProvides group query and member management functions, and can obtain all members of a group and their MFA status.

Device managementQueries information about enterprise-managed devices and can filter devices by user or operating system.

Advantages and limitations

Advantages

Modular design, easy to expand new functions

Follows Microsoft security best practices

Provides detailed permission suggestions to help implement the principle of least privilege

Unified error handling and logging mechanism

Limitations

Requires pre - configuration of Azure AD application permissions

Some advanced functions require specific license support

The performance of batch operations is limited by the Microsoft Graph API

How to use

Environment preparation

Register an application in the Azure portal and configure the required API permissions. Create an.env configuration file containing the tenant ID, client ID, and secret key.

Install dependencies

Use pip to install the necessary Python dependency packages, including msgraph-sdk and azure-identity, etc.

Start the service

Use the fastmcp command to start the development server or perform a production deployment.

Usage examples

Security check auditRegularly check the MFA status and recent login information of all privileged users

New employee onboardingAutomate the process of creating new users and assigning permissions

Handling of departing employeesQuickly disable the accounts of departing employees and check their permissions

Frequently Asked Questions

What Microsoft Graph API permissions are required?

How to ensure the security of sensitive information (such as passwords)?

Can custom functions be extended?

What is the performance when querying a large amount of data?

Related resources

Microsoft Graph API documentation

Official Microsoft Graph API reference documentation

FastMCP GitHub repository

Source code and documentation of the FastMCP framework

Azure AD identity best practices

Microsoft Azure AD identity management best practices guide

Example configuration repository

Contains example configurations and scripts for various use cases

🚀 EntraID MCP Server

EntraID MCP Server is a Python-based tool for in-depth analysis of Azure AD and Microsoft Entra authentication environments via the Microsoft Graph API. It offers various functions, including directory access, group management, policy reading, role management, and user password reset.

🚀 Quick Start

EntraID MCP Server is a Python-based tool that allows you to perform in-depth analysis of Azure AD and Microsoft Entra authentication environments using the Microsoft Graph API.

✨ Features

Comprehensive Directory Access: Read the full profiles of all users.
Group and Member Management: Read all groups and their member relationships.
Policy Reading: View all policy information in the organization.
Role Management: Read directory role-based access control (RBAC) settings.
User Authentication Methods: Read the authentication methods of all users.
Audit Logs: Access all audit log data.
Security Measures: Adopt the principle of least privilege, granting only the necessary Microsoft Graph permissions.

📦 Installation

Configure Environment Variables

Create a .env file and add the following content:

TENANT_ID=your_tenant_id
CLIENT_ID=your_client_id
CLIENT_SECRET=your_client_secret

Basic Usage

Run the following command in the terminal to start the server:

python -m server

📚 Documentation

Project Structure

environ.py: Contains environment variables and configuration information.
server.py: The main server file responsible for handling various requests.
tools/: Contains specific functional modules, such as user management and group management.

Functional Modules

User Management

User Query

from user_management import UserManagementTool

tool = UserManagementTool()
users = tool.list_all_users()
print(users)

Password Reset

from user_management import reset_password

result = reset_user_password_direct(user_id="12345", require_change=True, generate_password=True)
print(result)

Audit Logs

Log Query

from audit_logs import get_audit_logs

logs = get_user_audit_logs(user_id="67890", days=30)
print(logs)

Permission Requirements

The following lists all the required Microsoft Graph permissions and their functions:

API/Permission	Type	Description
AuditLog.Read.All	Application	Read all audit log data
AuthenticationContext.Read.All	Application	Read all authentication context information
DeviceManagementManagedDevices.Read.All	Application	Read Microsoft Intune devices
Directory.Read.All	Application	Read directory data
Group.Read.All	Application	Read all groups
GroupMember.Read.All	Application	Read all group member relationships
Policy.Read.All	Application	Read all policies in the organization
RoleManagement.Read.Directory	Application	Read directory role-based access control settings
User.Read.All	Application	Read the full profiles of all users
User-PasswordProfile.ReadWrite.All	Application	Least privilege principle for updating password configuration
UserAuthenticationMethod.Read.All	Application	Read the authentication methods of all users

Extension Instructions

To add a new functional module, follow these steps:

Create a new Python class in the tools/ folder.
Register the new tool using the @mcp.tool() decorator.
Import and register the new tool in server.py.

Security Precautions

Avoid Submitting Sensitive Information: Ensure that .env and other sensitive files are not included in the version control system.
Principle of Least Privilege: Only grant the necessary Microsoft Graph permissions to reduce potential risks.
Audit and Monitoring: Use log output for troubleshooting and monitoring.