Microsoft 365 Core MCP Server

Instructions

Implementation Reference

• src/handlers/purview-compliance-handler.ts:183-343 (handler)

  Primary handler function executing the core logic for the 'manage_sensitivity_labels' tool. Handles CRUD operations and publishing using Microsoft Graph /security/informationProtection/sensitivityLabels endpoints.
  export async function handleSensitivityLabels( graphClient: Client, args: SensitivityLabelArgs ): Promise<{ content: { type: string; text: string }[] }> { let apiPath = ''; let result: any; switch (args.action) { case 'list': // List all sensitivity labels apiPath = '/security/informationProtection/sensitivityLabels'; result = await graphClient.api(apiPath).get(); break; case 'get': if (!args.labelId) { throw new McpError(ErrorCode.InvalidParams, 'labelId is required for get action'); } apiPath = `/security/informationProtection/sensitivityLabels/${args.labelId}`; result = await graphClient.api(apiPath).get(); break; case 'create': if (!args.displayName) { throw new McpError(ErrorCode.InvalidParams, 'displayName is required for create action'); } const sensitivityLabelPayload: any = { displayName: args.displayName, description: args.description || '', tooltip: args.tooltip || args.description || '', priority: args.priority || 0, isEnabled: args.isEnabled !== undefined ? args.isEnabled : true, labelActions: [], applicableTo: 'EmailMessage,File' }; // Add settings if provided if (args.settings) { if (args.settings.contentMarking) { sensitivityLabelPayload.labelActions.push({ '@odata.type': 'microsoft.graph.contentMarkingLabelAction', ...args.settings.contentMarking }); } if (args.settings.encryption && args.settings.encryption.enabled) { sensitivityLabelPayload.labelActions.push({ '@odata.type': 'microsoft.graph.encryptionLabelAction', ...args.settings.encryption }); } if (args.settings.accessControl) { sensitivityLabelPayload.labelActions.push({ '@odata.type': 'microsoft.graph.accessControlLabelAction', ...args.settings.accessControl }); } if (args.settings.autoLabeling && args.settings.autoLabeling.enabled) { sensitivityLabelPayload.labelActions.push({ '@odata.type': 'microsoft.graph.autoLabelingLabelAction', ...args.settings.autoLabeling }); } } apiPath = '/security/informationProtection/sensitivityLabels'; result = await graphClient.api(apiPath).post(sensitivityLabelPayload); break; case 'update': if (!args.labelId) { throw new McpError(ErrorCode.InvalidParams, 'labelId is required for update action'); } const updatePayload: any = {}; if (args.displayName) updatePayload.displayName = args.displayName; if (args.description) updatePayload.description = args.description; if (args.tooltip) updatePayload.tooltip = args.tooltip; if (args.priority !== undefined) updatePayload.priority = args.priority; if (args.isEnabled !== undefined) updatePayload.isEnabled = args.isEnabled; // Handle settings updates if (args.settings) { updatePayload.labelActions = []; if (args.settings.contentMarking) { updatePayload.labelActions.push({ '@odata.type': 'microsoft.graph.contentMarkingLabelAction', ...args.settings.contentMarking }); } if (args.settings.encryption && args.settings.encryption.enabled) { updatePayload.labelActions.push({ '@odata.type': 'microsoft.graph.encryptionLabelAction', ...args.settings.encryption }); } if (args.settings.accessControl) { updatePayload.labelActions.push({ '@odata.type': 'microsoft.graph.accessControlLabelAction', ...args.settings.accessControl }); } if (args.settings.autoLabeling && args.settings.autoLabeling.enabled) { updatePayload.labelActions.push({ '@odata.type': 'microsoft.graph.autoLabelingLabelAction', ...args.settings.autoLabeling }); } } apiPath = `/security/informationProtection/sensitivityLabels/${args.labelId}`; result = await graphClient.api(apiPath).patch(updatePayload); break; case 'delete': if (!args.labelId) { throw new McpError(ErrorCode.InvalidParams, 'labelId is required for delete action'); } apiPath = `/security/informationProtection/sensitivityLabels/${args.labelId}`; await graphClient.api(apiPath).delete(); result = { message: `Sensitivity label ${args.labelId} deleted successfully` }; break; case 'publish': if (!args.labelId) { throw new McpError(ErrorCode.InvalidParams, 'labelId is required for publish action'); } // Create a label policy to publish the label const publishPayload = { displayName: `${args.displayName || 'Label'} Policy`, description: `Policy for publishing sensitivity label`, labels: [args.labelId], settings: { mandatory: false, requireJustification: false } }; apiPath = '/security/informationProtection/labelPolicies'; result = await graphClient.api(apiPath).post(publishPayload); break; default: throw new McpError(ErrorCode.InvalidParams, `Unknown action: ${args.action}`); } return { content: [{ type: 'text', text: `Sensitivity Label ${args.action} operation completed:\n\n${JSON.stringify(result, null, 2)}` }] }; }
• src/handlers/dlp-handler.ts:147-213 (handler)

  Alternative handler for sensitivity labels in DLP context using /informationProtection/policy/labels endpoints.
  // DLP Sensitivity Labels Handler export async function handleDLPSensitivityLabels( graphClient: Client, args: DLPSensitivityLabelArgs ): Promise<{ content: { type: string; text: string }[] }> { let apiPath = ''; let result: any; switch (args.action) { case 'list': apiPath = '/informationProtection/policy/labels'; result = await graphClient.api(apiPath).get(); break; case 'get': if (!args.labelId) { throw new McpError(ErrorCode.InvalidParams, 'labelId is required for get action'); } apiPath = `/informationProtection/policy/labels/${args.labelId}`; result = await graphClient.api(apiPath).get(); break; case 'create': if (!args.name) { throw new McpError(ErrorCode.InvalidParams, 'name is required for create action'); } apiPath = '/informationProtection/policy/labels'; const labelPayload = { name: args.name, description: args.description || '', color: args.settings?.color || 'blue', sensitivity: args.settings?.sensitivity || 0, tooltip: args.description || args.name, isActive: true }; result = await graphClient.api(apiPath).post(labelPayload); break; case 'update': if (!args.labelId) { throw new McpError(ErrorCode.InvalidParams, 'labelId is required for update action'); } apiPath = `/informationProtection/policy/labels/${args.labelId}`; const updateLabelPayload = { name: args.name, description: args.description, color: args.settings?.color, sensitivity: args.settings?.sensitivity }; result = await graphClient.api(apiPath).patch(updateLabelPayload); break; case 'delete': if (!args.labelId) { throw new McpError(ErrorCode.InvalidParams, 'labelId is required for delete action'); } apiPath = `/informationProtection/policy/labels/${args.labelId}`; await graphClient.api(apiPath).delete(); result = { message: 'Sensitivity label deleted successfully' }; break; default: throw new McpError(ErrorCode.InvalidParams, `Invalid action: ${args.action}`); } return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] }; }
• src/tool-definitions.ts:254-262 (schema)

  Zod schema defining input parameters and validation for the manage_sensitivity_labels tool.
  // Sensitivity Label Management export const sensitivityLabelSchema = z.object({ action: z.enum(['list', 'get', 'create', 'update', 'delete', 'apply']).describe('Sensitivity label action'), labelId: z.string().optional().describe('Sensitivity label ID'), name: z.string().optional().describe('Label name'), description: z.string().optional().describe('Label description'), targetId: z.string().optional().describe('Target resource ID for label application'), settings: z.record(z.string(), z.any()).optional().describe('Label settings and policies'), });
• src/server.ts:1076-1096 (registration)

  MCP server tool registration for 'manage_sensitivity_labels' with schema, metadata annotations, and handler binding.
  const sensitivityLabelsMeta = getToolMetadata("manage_sensitivity_labels")!; this.server.tool( "manage_sensitivity_labels", sensitivityLabelsMeta.description, sensitivityLabelArgsSchema.shape, sensitivityLabelsMeta.annotations || {}, wrapToolHandler(async (args: SensitivityLabelArgs) => { this.validateCredentials(); try { return await handleSensitivityLabels(this.getGraphClient(), args); } catch (error) { if (error instanceof McpError) { throw error; } throw new McpError( ErrorCode.InternalError, `Error executing tool: ${error instanceof Error ? error.message : 'Unknown error'}` ); } }) );
• src/tool-metadata.ts:120-123 (schema)

  Tool metadata including description, title, and annotations (readOnlyHint, destructiveHint, etc.) used during registration.
  manage_sensitivity_labels: { description: "Manage sensitivity labels for information protection including encryption, content marking, and classification policies.", title: "Sensitivity Label Manager", annotations: { title: "Sensitivity Label Manager", readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true }