mcp-server-microsoft365
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| MS_CLIENT_ID | No | Your application (client) ID | |
| MS_TENANT_ID | No | Your Microsoft Entra tenant ID (e.g., contoso.onmicrosoft.com or GUID) | |
| MS_TIMEOUT_MS | No | Timeout in milliseconds for HTTP requests | 30000 |
| MCP_HTTP_TOKEN | No | Bearer token for HTTP transport authentication | |
| MS_ACCESS_TOKEN | No | A pre-fetched access token to short-circuit grants | |
| MS_CLIENT_SECRET | No | Your client secret | |
| MS_REFRESH_TOKEN | No | A refresh token for delegated authentication | |
| MS_AUTHORITY_HOST | No | Authority host for token requests | https://login.microsoftonline.com |
| MS_GRAPH_BASE_URL | No | Base URL for Microsoft Graph API | https://graph.microsoft.com/v1.0 |
| MCP_MAX_BODY_BYTES | No | Maximum body size for HTTP transport (in bytes) | 10485760 |
| MCP_ALLOWED_ORIGINS | No | Allowed origins for HTTP transport |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| get_userA | Fetch one user by object id or userPrincipalName. |
| list_usersA | List users with optional $top, $filter, $select, and $orderby. |
| list_subscribed_skusA | List tenant subscribed SKUs for license lookup and seat availability. |
| list_groupsC | List groups with optional $top, $filter, $select, and $orderby. |
| get_groupA | Fetch one group by object id. |
| list_group_membersC | List the members of a group. |
| get_user_license_detailsA | List the licenses currently assigned to a user. |
| create_userB | Create a user with a generated temporary password. Returns the temporary password; store it securely and share out-of-band. |
| assign_licenseA | Assign a license to a user. Sets usageLocation first when provided; fails clearly if the user has no usageLocation. |
| remove_licenseC | Remove a license from a user. |
| add_group_memberA | Add a user to a group. Idempotent when the user is already a member. |
| remove_group_memberA | Remove a user from a group. Idempotent when the user is not a member. |
| set_usage_locationA | Set a user usageLocation (required before license assignment). |
| update_userA | Update attributes on an existing user (PATCH). Use accountEnabled to enable/disable an existing account (e.g. activate a pre-created hire or disable a leaver). Only provided fields are changed. |
| set_managerB | Set a user's manager. Provide the manager's object id or userPrincipalName. |
| create_temporary_access_passA | Create a Temporary Access Pass (TAP) for passwordless first sign-in / MFA setup. Multi-use by default; regenerated until the passcode is alphanumeric so it is easy to relay. lifetimeInMinutes is bounded by the tenant TAP policy. Returns the passcode; deliver it out-of-band. |
| delete_temporary_access_passA | Delete a user's Temporary Access Pass. With methodId deletes that pass; otherwise deletes every TAP on the user. |
| activate_pim_roleA | Just-in-time PIM elevation: the delegated caller self-activates one of their own ELIGIBLE directory roles (e.g. Authentication Administrator, needed for Temporary Access Pass) for a bounded window. Requires a delegated token; fails if the caller is not eligible. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 18 tools
Each tool targets a specific resource and action, such as get_user vs list_users, assign_license vs remove_license, and create_temporary_access_pass vs delete_temporary_access_pass. There is no meaningful overlap that would cause an agent to select the wrong tool.
All tool names follow a consistent verb_noun snake_case pattern (e.g., get_user, list_groups, assign_license, create_temporary_access_pass). No mixing of conventions or vague verbs.
With 18 tools, the server is slightly above the typical 3-15 range but justifiably so, as it covers user/group management, licensing, temporary access passes, and PIM roles. The count feels appropriate for the broad Microsoft 365 domain without being bloated.
The tool surface covers core user lifecycle (create/get/update/list), license management, group membership, and authentication flows. The main gap is lack of user deletion, but this is workable via update_user disable, and group creation/deletion appears out of scope, making these minor gaps.