Entra Identity Posture MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| ENTRA_CLIENT_ID | Yes | Application (client) ID of your app registration | |
| ENTRA_TENANT_ID | Yes | Your Microsoft Entra tenant ID | |
| ENTRA_CLIENT_SECRET | Yes | Client secret for the app registration |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| audit_app_registrationsA | Scans Entra ID app registrations for expiring secrets, excessive lifespans, risky permissions, and insecure redirect URIs. Returns structured findings (metadata + issues) alongside a human-readable summary. |
| scan_conditional_access_gapsA | Scans Entra Conditional Access policies for admin MFA exclusions and policies stuck in report-only mode. Returns structured findings alongside a human-readable summary. |
| run_posture_scanB | Runs the app registration and Conditional Access scans concurrently and returns one combined, optionally filtered PostureScanResult. Updates the shared entra://posture/latest resource cache with both scan categories. |
| generate_remediation_planA | Generates a Zero-Trust Markdown security report and dry-run CLI remediation commands from findings. |
| revoke_or_disable_app_registrationC | Generates dry-run Azure CLI or PowerShell commands to disable sign-in or revoke credentials. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| security_triage_prompt | Returns predefined Zero-Trust triage prompt template for natural-language agent orchestration. |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| get_latest_posture_resource | Provides access to cached JSON results from the most recent identity posture scan. |
TDQS
Scored across 5 tools
Each tool has a distinct purpose: two separate scans, a combined scan, a report generator, and a remediation command generator. There is no functional overlap.
All tool names use a consistent verb_noun pattern in snake_case (e.g., audit_app_registrations, generate_remediation_plan), making them predictable and readable.
With 5 tools, the server is well-scoped for its purpose of assessing and remediating Entra ID posture without being too sparse or bloated.
The tools cover auditing, combined scanning, remediation planning, and disabling/revoking registrations. Missing a tool to execute remediation commands directly is a minor gap, but the set is largely complete.