ChatGPT

\n\nGo to **Settings**, **Apps**, **Create App**, and fill the dialog:\n\n![ChatGPT Configuration](https://raw.githubusercontent.com/microsoft/EnterpriseMCP/main/assets/chatgpt_config.png)\n\nPut the App ID of the Registered app in the red box.\n\n

\n\n

Claude

\n\nGo to **Customize**, **Connectors**, click \"**+**\", **Add Custom Connector**, and fill the dialog:\n\n![Claude Configuration](https://raw.githubusercontent.com/microsoft/EnterpriseMCP/main/assets/claude_config.png)\n\nPut the App ID of the Registered app in the red box.\n\n

\n\n### Visual Studio Code and GitHub Copilot CLI\n\nVisual Studio Code and GitHub Copilot CLI share the same Visual Studio Code MCP Client app Id, so they use the same setup. \nGitHub Copilot CLI can also use a custom client Id (see Option 2).\n\n#### Prerequisites\n\nThese steps provision the Visual Studio Code MCP Client application in your tenant and grant it the MCP permissions. \nThey're required for **Visual Studio Code** and for **GitHub Copilot CLI when it uses the default application Id** (Option 1 below). Skip them if you're configuring GitHub Copilot CLI with a custom `oauthClientId` instead (Option 2 below).\n\n1. Install Microsoft.Entra.Beta PowerShell module (version 1.0.13 or later, *requires [PowerShell 7](https://learn.microsoft.com/powershell/scripting/install/install-powershell?view=powershell-7.6))*:\n\n ```powershell\n Install-Module Microsoft.Entra.Beta -Force -AllowClobber\n ```\n\n1. Connect Microsoft Entra ID to your tenant:\n\n ```powershell\n Connect-Entra -Scopes 'Application.ReadWrite.All', 'DelegatedPermissionGrant.ReadWrite.All'\n ```\n\n1. Grant all MCP permissions to the Visual Studio Code MCP Client app (also used by GitHub Copilot CLI when configured with the default application Id):\n\n ```powershell\n Grant-EntraBetaMCPServerPermission -ApplicationName VisualStudioCode\n ```\n\n[Learn more](https://learn.microsoft.com/powershell/module/microsoft.entra.beta.applications/grant-entrabetamcpserverpermission?view=entra-powershell-beta) about `Grant-EntraBetaMCPServerPermission`. For detailed installation help, see the [installation instructions](https://learn.microsoft.com/powershell/entra-powershell/installation?view=entra-powershell-beta).\n\nIf the Microsoft Graph PowerShell SDK modules conflict with **Microsoft.Entra.Beta**, run the following and retry from step 1:\n\n```powershell\nInstall-Module Uninstall-Graph\nUninstall-Graph -All\n```\n\n

Visual Studio Code

\n\n1. Click [Install Microsoft MCP Server for Enterprise](https://vscode.dev/redirect/mcp/install?name=Microsoft%20MCP%20Server%20for%20Enterprise&config=%7b%22name%22:%22Microsoft%20MCP%20Server%20for%20Enterprise%22%2c%22type%22:%22http%22%2c%22url%22:%22https://mcp.svc.cloud.microsoft/enterprise%22%7d) to launch the MCP install page.\n1. Click the Install button in VS Code and sign in with your account from the tenant above.\n1. If Visual Studio Code displays the error `Error getting token from server metadata: Error: Cannot force new registration for a non-dynamic authentication provider.`, change `\"microsoft-authentication.implementation\"` from `\"msal\"` to `\"msal-no-broker\"` in your Settings:\n![alt text](https://raw.githubusercontent.com/microsoft/EnterpriseMCP/main/assets/msal_no_broker.png)\n\n

\n\n

GitHub Copilot CLI

\n\nGitHub Copilot CLI can connect using either the default Visual Studio Code MCP Client app Id or a custom MCP Client app Id you register in your tenant.\n\n**Option 1. Default (uses the Visual Studio Code app Id)**\n\n1. Complete the [Prerequisites](#prerequisites) above.\n2. Add the MCP server to Copilot CLI. You can do this interactively with `/mcp add`:\n\n ```bash\n /mcp add\n ```\n\n ![GitHub Copilot CLI Configuration](https://raw.githubusercontent.com/microsoft/EnterpriseMCP/main/assets/ghcp_mcp_config.png)\n\n**Option 2. Custom MCP Client app Id**\n\n1. Register your own MCP Client application in your tenant and grant it the required `MCP.*` scopes (see [Authorization and permissions](#authorization-and-permissions)).\n1. Set `http://127.0.0.1:51001` as Redirect URI for \"Mobile and desktop applications\"\n1. Specify your app Id via `oauthClientId` and `oauthPublicClient` to `true` in `~/.copilot/mcp-config.json`:\n\n ```json\n \"mcp-enterprise\": {\n \"type\": \"http\",\n \"url\": \"https://mcp.svc.cloud.microsoft/enterprise\",\n \"headers\": {},\n \"tools\": [ \"*\" ],\n \"oauthClientId\": \"\",\n \"oauthPublicClient\": true\n }\n ```\n\nIn either case, sign in with your account from the provisioned tenant when prompted.\n\nFor more information, see the [GitHub Copilot CLI documentation](https://docs.github.com/en/copilot/concepts/agents/about-copilot-cli).\n\n

\n\n## Authorization and permissions\n\nThe MCP Server for Enterprise uses Microsoft Graph API to access data in your Microsoft Entra tenant using **delegated permissions** only, and provides a reduced set of permissions exposed by Microsoft Graph. \nUse the following cmdlet to list the permissions provided by the MCP Server for Enterprise:\n\n```powershell\n(Get-EntraBetaServicePrincipal -Property \"PublishedPermissionScopes\" -Filter \"AppId eq 'e8c77dc2-69b3-43f4-bc51-3213c9d915b4'\").PublishedPermissionScopes | Where-Object { $_.IsEnabled -eq $true -and $_.AdditionalProperties[\"isPrivate\"] -ne $true } | Select-Object Value, AdminConsentDisplayName | Sort-Object\n```\n\nIf you'd like to use your own Registered Application, use the following cmdlets to to manage scopes granted to your MCP Client Application:\n\n```powershell\nGrant-EntraBetaMCPServerPermission -ApplicationId \"\" -Scopes \"\", \"\", \"<...>\"\nRevoke-EntraBetaMCPServerPermission -ApplicationId \"\" -Scopes \"\", \"\", \"<...>\"\n```\n\nLearn more: [Manage MCP Server for Enterprise permissions](https://learn.microsoft.com/powershell/entra-powershell/how-to-manage-mcp-server-permissions)\n\n## Advantages\n\n1. **Remote MCP Server**: easy to configure and standards-compliant, deployed in the same regions as Microsoft Graph.\n1. **IT Admins in control**: MCP clients need specific MCP.* scopes (mirroring Microsoft Graph scopes) to access your tenant data.\n1. **Simplified architecture**: 3 tools cover the workflow instead of one tool per API operation.\n1. **High-quality query generation**: generates accurate queries from over 500 real-world examples via RAG (Retrieval-Augmented Generation).\n1. **Full auditability**: all MCP operations run under the same App ID with a specific user agent.\n1. **No extra license required**: your existing Microsoft Entra and Microsoft Graph API licenses apply.\n\n## Availability, Roadmap and feedback\n\nThe Microsoft MCP Server for Enterprise is available only in the public cloud (global service), with support for sovereign clouds planned for a future release. \nWe will continue expanding beyond the current Microsoft Entra scenarios, but M365 APIs [will be covered by **Agent 365**](https://learn.microsoft.com/microsoft-agent-365/tooling-servers-overview). \nSupport for write operations is planned for a future release. \nPlease share suggestions or issues through our feedback form: [Submit feedback](https://aka.ms/MCPServerForEnterpriseSurvey).\n\n## Licensing and usage\n\n- The MCP Server for Enterprise **doesn't require extra cost or separate license**.\n- You need the right licenses for the data you access (for example, Microsoft Entra ID Governance or Microsoft Entra ID P2 license for Privileged Identity Management (PIM) data).\n- Any request to this MCP server is limited to **100 requests per minute per user**. Requests to `microsoft_graph_get` are also subject to [Microsoft Graph Throttling limits](https://learn.microsoft.com/graph/throttling-limits#identity-and-access-service-limits).\n\n## Logs\n\nTo monitor usage, enable [Microsoft Graph activity logs](https://github.com/microsoft/EnterpriseMCP/blob/main/../microsoft-graph-activity-logs-overview.md) in your tenant. The system logs all API calls made through the MCP server.\n\n**Filter for MCP Server usage:**\n\nUse the Application (Client ID) of the Microsoft MCP Server for Enterprise: `e8c77dc2-69b3-43f4-bc51-3213c9d915b4`.\n\nThe following Kusto query retrieves these logs:\n\n```kusto\nMicrosoftGraphActivityLogs\n| where TimeGenerated >= ago(30d)\n| where AppId == \"e8c77dc2-69b3-43f4-bc51-3213c9d915b4\"\n| project RequestId, TimeGenerated, UserId, RequestMethod, RequestUri, ResponseStatusCode\n```\n\n## Support and reference\n\nFor documentation, troubleshooting, and feedback, refer to the official [Microsoft Learn documentation](https://learn.microsoft.com/graph/mcp-server/overview) and support channels.\n\n## Security and compliance\n\nAll operations respect Microsoft Graph permissions and security policies.\nEnsure compliance with your organizational, regulatory, and contractual requirements when integrating the MCP Server.\n\n## No warranty/limitation of liability\n\nThis software is provided \"as is\" without warranties or conditions of any kind, either express or implied. Microsoft isn't liable for any damages that result from use, misuse, or misconfiguration of this software.\n","changelogMarkdown","videoKey","requiredSecretsJson","publishedAt","priceCents","trialDays",0,"upstream",{"_99":100,"_101":102,"_103":-5,"_104":105,"_106":-5,"_107":108},"requiredSecrets",[],"tags",[],"assets",[],"stats",{"_97":86,"_98":86},"ratingAvg","reviewCount","topics",[],"license","CC-BY-4.0","language","registryName","io.github.microsoft/EnterpriseMCP","homepage","packages",[],"ENV",{"_111":112,"_113":114,"_115":116},"ENVIRONMENT","production","TURNSTILE_SITE_KEY","0x4AAAAAAB8-rEI2gNDf_QhU","SENTRY_DSN","https://45fd1229f78089d5c3ee78be128030e1@o4510583261757440.ingest.de.sentry.io/4510584253448272"]