Skip to main content
Glama
Sign In
m365-evidence-mcp

m365-evidence-mcp

by aminafara123
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

m365-evidence-mcp

An MCP server that turns the Microsoft Graph reads an IT auditor keeps repeating into tools any MCP-capable AI client can call. Point it at a tenant with a read-only token and ask for the evidence in plain language instead of clicking through four admin portals.

The four tools cover ITGC classics: security posture, MFA coverage, dormant accounts and privileged access. The model fetches, the auditor concludes.

Tools

Tool

What it does

secure_score()

Current Secure Score plus the five weakest controls

mfa_coverage()

How many users are MFA registered, and who is not

stale_accounts(days)

Enabled accounts with no sign-in in the last N days

privileged_roles()

Activated directory roles and who holds them

Related MCP server: entraid-mcp

Setup

pipx install m365-evidence-mcp

uvx m365-evidence-mcp works too if you prefer no install. Hacking on a clone instead:

python3 -m venv .venv
.venv/bin/pip install mcp

Get a Graph token. The Azure CLI is the quickest way:

export GRAPH_TOKEN=$(az account get-access-token --resource https://graph.microsoft.com --query accessToken -o tsv)

The Access token tab in Graph Explorer works too. Scopes: SecurityEvents.Read.All for the score, Reports.Read.All for MFA coverage, User.Read.All plus AuditLog.Read.All for stale accounts, Directory.Read.All for roles. All of them are read scopes and most need admin consent.

Wire it into Claude Code:

claude mcp add m365evidence -- m365-evidence-mcp

Running from a clone, point it at the venv instead:

claude mcp add m365evidence -- /path/to/m365-evidence-mcp/.venv/bin/python /path/to/m365-evidence-mcp/m365_evidence_mcp.py

Demo

What it looks like from Claude Code:

> pull the access review evidence for the quarter

⏺ m365evidence · privileged_roles()

  Global Administrator (2):
    - amir.admin@demo.example
    - breakglass@demo.example
  Helpdesk Administrator (1):
    - sara.support@demo.example

⏺ Two global admins and one of them is the break glass account.
  Helpdesk Administrator has a single holder. MFA coverage next?

The accounts above are demo data. The format is exactly what the server returns.

Design notes

  • Read-only by construction. Every tool is a single Graph GET, the annotations declare it, and a token with read scopes could not write anyway. Two layers, both structural.

  • Evidence, not judgement. Tools return counts with capped name lists, the kind of thing that goes straight into a workpaper. The conclusion stays with whoever reads it.

  • Nothing touches disk. The token lives in an environment variable and reports are never cached or logged.

Honest notes

  • Sign-in activity needs Entra ID P1 or better, so stale_accounts comes back empty on a bare Business Standard tenant.

  • Pagination is capped at ten pages of 999 objects. Fine for a small or midsize tenant, raise the cap in _get_all for bigger ones.

  • The logic is tested against canned Graph responses in test_server.py. Run python test_server.py.

About

Al Amin Bashir Afara, Dubai · github.com/aminafara123 · linkedin.com/in/aminafara

Available Tools

4 tools
mfa_coverageA
Read-onlyIdempotent

Share of users registered for MFA, with up to ten who are not. Needs Reports.Read.All.

Inputs: no named parameters. Returns: result

privileged_rolesA
Read-onlyIdempotent

Activated directory roles and who holds them, ten members shown per role. The access review starting point. Needs Directory.Read.All.

Inputs: no named parameters. Returns: result

secure_scoreA
Read-onlyIdempotent

Current Microsoft Secure Score with the five weakest controls. Needs SecurityEvents.Read.All.

Inputs: no named parameters. Returns: result

stale_accountsA
Read-onlyIdempotent

Enabled accounts with no successful sign-in in the last N days, never-signed-in included. Needs User.Read.All and AuditLog.Read.All.

Inputs: days. Returns: result

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    A4/5.0

    Scored across 4 tools

    Disambiguation5/5

    Each tool targets a distinct security evidence area: secure_score, mfa_coverage, stale_accounts, and privileged_roles. There is no overlap in purpose, and an agent can easily select the right tool for each data need.

    Naming Consistency5/5

    All tool names follow a clear snake_case noun-phrase convention (e.g., secure_score, mfa_coverage, stale_accounts, privileged_roles). The pattern is predictable and consistent across the set.

    Tool Count5/5

    Four tools is well-scoped for a focused M365 evidence-gathering server. Each tool earns its place and covers a key security posture check without redundancy.

    Completeness4/5

    The surface covers core identity and security evidence: overall score, MFA, stale accounts, and privileged roles. Minor gaps exist, such as conditional access or risky sign-in checks, but the core access review starting points are present.

    Maintenance

    ActivitySlowing
    ResponsivenessOutdated data

    Resources

    Related MCP Connectors

    Related MCP Servers

    • entraid-mcp

      sedattavukcu
      F
      license
      Not graded
      quality
      C
      maintenance
      Read-only MCP server for Microsoft Entra ID (Azure AD) that enables querying user sign-in logs, group memberships, and assigned Microsoft 365 licenses via Microsoft Graph API. Provides security and audit visibility without any write operations.
      -

    • m365-reporting-mcp

      kharonx
      F
      license
      B
      quality
      B
      maintenance
      Enables MCP-compatible AI clients to securely read a user's Microsoft 365 data across Outlook, Calendar, Teams, meetings, OneNote, SharePoint, OneDrive, Loop, and Search, and to send Outlook email only after explicit user confirmation.
      103
      -

    • emo-cyber-agent

      SE-Emam
      A
      license
      Not graded
      quality
      B
      maintenance
      Enables MCP-compatible agent hosts to delegate governed, read-only security audits and reviews of code, applications, agents, prompts, MCP configurations, and cloud environments through evidence-first findings and stable schemas.
      2
      Apache 2.0