Microsoft 365 Core MCP Server

Instructions

Implementation Reference

• src/handlers.ts:1121-1206 (handler)

  Core handler function implementing manage_security_groups tool logic: handles actions like get, create, update, delete, add_members, remove_members using Microsoft Graph API on /groups endpoint.
  export async function handleSecurityGroups( graphClient: Client, args: SecurityGroupArgs ): Promise<{ content: { type: string; text: string }[] }> { let apiPath = ''; let result: any; switch (args.action) { case 'get': if (!args.groupId) { throw new McpError(ErrorCode.InvalidParams, 'groupId is required for get action'); } apiPath = `/groups/${args.groupId}`; result = await graphClient.api(apiPath).get(); break; case 'create': if (!args.displayName) { throw new McpError(ErrorCode.InvalidParams, 'displayName is required for create action'); } apiPath = '/groups'; const createPayload = { displayName: args.displayName, description: args.description || '', mailNickname: args.displayName.replace(/\s+/g, '').toLowerCase(), mailEnabled: args.settings?.mailEnabled || false, securityEnabled: args.settings?.securityEnabled !== false, // Default to true groupTypes: [] }; result = await graphClient.api(apiPath).post(createPayload); break; case 'update': if (!args.groupId) { throw new McpError(ErrorCode.InvalidParams, 'groupId is required for update action'); } apiPath = `/groups/${args.groupId}`; const updatePayload: any = {}; if (args.displayName) updatePayload.displayName = args.displayName; if (args.description) updatePayload.description = args.description; result = await graphClient.api(apiPath).patch(updatePayload); break; case 'delete': if (!args.groupId) { throw new McpError(ErrorCode.InvalidParams, 'groupId is required for delete action'); } apiPath = `/groups/${args.groupId}`; await graphClient.api(apiPath).delete(); result = { message: 'Security group deleted successfully' }; break; case 'add_members': if (!args.groupId || !args.members?.length) { throw new McpError(ErrorCode.InvalidParams, 'groupId and members are required for add_members action'); } for (const member of args.members) { await graphClient .api(`/groups/${args.groupId}/members/$ref`) .post({ '@odata.id': `https://graph.microsoft.com/v1.0/users/${member}` }); } result = { message: `Added ${args.members.length} members to security group` }; break; case 'remove_members': if (!args.groupId || !args.members?.length) { throw new McpError(ErrorCode.InvalidParams, 'groupId and members are required for remove_members action'); } for (const member of args.members) { await graphClient .api(`/groups/${args.groupId}/members/${member}/$ref`) .delete(); } result = { message: `Removed ${args.members.length} members from security group` }; break; default: throw new McpError(ErrorCode.InvalidParams, `Invalid action: ${args.action}`); } return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] }; }
• src/server.ts:375-394 (registration)

  MCP server registration of the 'manage_security_groups' tool, wiring the handler function, Zod input schema, and tool annotations.
  this.server.tool( "manage_security_groups", "Manage Azure AD security groups for access control, including group creation, membership, and security settings.", securityGroupSchema.shape, {"readOnlyHint":false,"destructiveHint":true,"idempotentHint":false}, wrapToolHandler(async (args: SecurityGroupArgs) => { // Validate credentials only when tool is executed (lazy loading) this.validateCredentials(); try { return await handleSecurityGroups(this.getGraphClient(), args); } catch (error) { if (error instanceof McpError) { throw error; } throw new McpError( ErrorCode.InternalError, `Error executing tool: ${error instanceof Error ? error.message : 'Unknown error'}` ); } }) ); // M365 Groups - Lazy loading enabled for tool discovery
• src/tool-definitions.ts:54-64 (schema)

  Zod schema defining input parameters and validation for the manage_security_groups tool, used in tool registration.
  export const securityGroupSchema = z.object({ action: z.enum(['get', 'create', 'update', 'delete', 'add_members', 'remove_members']).describe('Action to perform on security group'), groupId: z.string().optional().describe('Security group ID for existing group operations'), displayName: z.string().optional().describe('Display name for the security group'), description: z.string().optional().describe('Description of the security group'), members: z.array(z.string()).optional().describe('List of member email addresses'), settings: z.object({ securityEnabled: z.boolean().optional().describe('Whether security is enabled'), mailEnabled: z.boolean().optional().describe('Whether mail is enabled'), }).optional().describe('Security group settings'), });
• src/tool-metadata.ts:26-29 (schema)

  Tool metadata including description, title, and annotations for manage_security_groups, used in capabilities and tool info.
  manage_security_groups: { description: "Manage Azure AD security groups for access control, including group creation, membership, and security settings.", title: "Security Group Manager", annotations: { title: "Security Group Manager", readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true }