Skip to main content
Glama
Sultan-zd

Entra ID SecOps MCP Server

by Sultan-zd
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

Related Servers

Alternatives to Entra ID SecOps MCP Server

No user-submitted related servers found.

    Related Servers

    • entraadm-mcp

      shigechika
      A
      license
      A
      quality
      B
      maintenance
      Enables read-only triage of Microsoft Entra ID sign-in and audit logs through fixed tools for sign-in failure analysis, user lookup, directory audits, and daily briefs.
      7
      21 PyPI
      MIT

    • azure-mcp-pilot

      josimarh
      A
      license
      C
      quality
      A
      maintenance
      Enables read-only auditing of Microsoft Entra ID and Azure RBAC through natural-language questions in VS Code Copilot Chat, returning real tenant data on identities, roles, MFA, app secrets, PIM, conditional access, and privilege changes.
      4
      66
      3
      MIT

    • MCP Microsoft Graph Server

      tcpatter
      -
      license
      Not graded
      quality
      Not graded
      maintenance
      Provides secure access to Microsoft Entra ID (Azure AD) resources including users, devices, and applications through Microsoft Graph API. Enables querying organizational data with comprehensive audit logging to Azure Blob Storage.
      -

    • Defender Hunt MCP

      Soucheff
      A
      license
      Not graded
      quality
      B
      maintenance
      Enables security investigation and threat hunting through Microsoft Defender and Entra ID, with 31 tools for KQL queries, alerts, threat intelligence, identity investigation, and advanced threat hunting.
      MIT
    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    A4.4/5.0

    Scored across 6 tools

    Disambiguation5/5

    Each tool targets a distinct data source: user identity context, sign-in events, risky user aggregates, individual risk detections, directory audit logs, and conditional access policies. The closely related risky-user and risk-detection tools are explicitly differentiated by scope, so an agent can reliably pick the right one.

    Naming Consistency5/5

    All tool names follow a consistent get_<resource> pattern using snake_case: get_user_context, get_user_signins, get_risky_users, get_risk_detections, get_directory_audits, get_conditional_access_policies. The naming convention is uniform and predictable.

    Tool Count5/5

    Six tools is a tightly scoped set for an Entra ID SecOps investigation server. Each tool covers a necessary aspect of incident investigation without redundancy or bloat.

    Completeness5/5

    The tool surface covers the main investigative workflow: identify the user's privilege level, inspect sign-ins, review identity risk, understand specific risk detections, check for malicious directory changes, and evaluate conditional access impacts. No significant operational gap is apparent for the stated SecOps purpose.

    Maintenance

    ActivityMaintained
    ResponsivenessNo issues

    Resources