BOD-25-01-CSA-Microsoft-Policy-MCP

Instructions

Implementation Reference

• cisa-m365/src/index.ts:404-428 (handler)

  The handler function that executes the tool logic: patches the authenticationMethodsPolicy via Microsoft Graph API to block legacy authentication methods.

  private async blockLegacyAuth() {
    try {
      // Configure authentication policy using Microsoft Graph API
      await this.graphClient
        .api('/policies/authenticationMethodsPolicy')
        .patch({
          allowLegacyAuthentication: false,
          blockLegacyAuthenticationMethods: true,
        });
  
      return {
        content: [
          {
            type: 'text',
            text: 'Legacy authentication blocked successfully',
          },
        ],
      };
    } catch (error: unknown) {
      throw new McpError(
        ErrorCode.InternalError,
        `Failed to block legacy authentication: ${error instanceof Error ? error.message : 'Unknown error'}`
      );
    }
  }

• cisa-m365/src/index.ts:120-127 (registration)

  Registers the tool in the ListTools response, including name, description, and input schema (empty object).

  {
    name: 'block_legacy_auth',
    description: 'Block legacy authentication (MS.AAD.1.1v1)',
    inputSchema: {
      type: 'object',
      properties: {},
    },
  },

• cisa-m365/src/index.ts:323-324 (registration)

  Dispatches tool calls to the handler in the CallToolRequest switch statement.

  case 'block_legacy_auth':
    return await this.blockLegacyAuth();

• cisa-m365/src/index.ts:123-126 (schema)

  Defines the input schema for the tool (empty object, no parameters required).

  inputSchema: {
    type: 'object',
    properties: {},
  },