Authenticate the MCP session using the configured .env sign-in flow.

Test the connection to Microsoft Graph API and return tenant information.

Get current authentication mode and sign-in/cache status.

Start user sign-in flow (device code) and return sign-in instructions.

Complete user sign-in flow after user enters device code.

Compatibility wrapper that completes the interactive sign-in flow for the MCP session.

One-step connection flow: trigger sign-in if needed, then verify Graph connectivity.

Return device counts, compliance distribution and OS breakdown for the tenant.

Manage Intune managed devices. All device lifecycle and action operations.

action values: list — List all managed devices (supports filter_query, top) get — Get full device details (requires device_id) search — Search by deviceName/userPrincipalName/serialNumber (search_term, search_by) get_noncompliant— List non-compliant devices get_stale — Devices inactive for N days (days_inactive) get_hardware — Hardware inventory for a device (device_id) get_network — Network info (MAC, subnet) for a device (device_id) get_installed_apps — Apps detected on a device (device_id) get_compliance_states — Compliance policy states for a device (device_id) get_log_requests — Diagnostic log collection requests for a device (device_id) sync — Trigger sync on a device (device_id) bulk_sync — Sync a list of devices (body: {device_ids: [...]}) restart — Restart a device remotely (device_id) lock — Remote lock a device (device_id) rename — Rename a device (device_id, body: {deviceName: "..."}) locate — Trigger GPS location on a device (device_id) reset_passcode — Reset passcode on iOS/Android (device_id) bypass_activation_lock — Bypass iOS Activation Lock (device_id) enable_lost_mode — Enable iOS Lost Mode (device_id, body: {message,phoneNumber,footer}) disable_lost_mode — Disable iOS Lost Mode (device_id) collect_diagnostics— Collect device diagnostics/logs (device_id) defender_scan — Trigger Windows Defender scan (device_id, body: {quickScan: true/false}) defender_update_signatures — Update Defender signatures (device_id) clean_device — Clean Windows device; body: {keepUserData: bool} (device_id, confirm=True) delete — Delete device from Intune (device_id, confirm=True) wipe — Factory reset / wipe device (device_id, confirm=True) retire — Retire device / remove company data (device_id, confirm=True)

Manage device encryption keys and reports.

action values: list_bitlocker_keys — List all BitLocker recovery keys for the tenant get_bitlocker_key — Get a specific BitLocker recovery key with value (key_id) get_filevault_key — Get macOS FileVault recovery key (device_id) get_encryption_report — Export device encryption status report

Manage Intune mobile apps — full CRUD, search, assignments and install status.

action values: list — List all mobile apps (top) get — Get app details + assignments (app_id) search — Search apps by display name (search_term) create — Raw Graph app registration (body); for complete EAM acquisition/ Win32 packaging use plan_lifecycle, not metadata-only creation. update — Update app metadata (app_id, body) delete — Delete an app (app_id, confirm=True) assign — Assign app to groups (app_id, body: {assignments:[...]}) remove_assignment — Remove one assignment (app_id, assignment_id, confirm=True) get_install_status — Get app install summary (app_id) list_discovered — List all apps discovered across managed devices get_mam_registrations — List managed app registrations (MAM enrollment) plan_lifecycle — Stage EAM-first acquisition/Win32 packaging (body). Required: app_name, publisher, version. No groups means CREATE ONLY. Optional: catalog_package_id; source {artifacts:[{filename,url,sha256}], scripts:[{filename,content}],setup_file}; win32 {description, install_command,uninstall_command,detection_path,detection_file, detection_version,architecture,minimum_windows_release,install_context}; evidence_urls. Use group_ids/group_names OR reuse_scope_from_app_id to propose assignments. Research official install instructions first. Never guess switches, versions or hashes. No tenant writes in planning. discover_deployment_scope — Read existing group assignments/filters/settings (app_id). Never invent a target or create groups without user confirmation. get_lifecycle_plan — Review immutable plan (plan_id); operator CLI approves exact digest. queue_lifecycle — Queue operator-approved plan (plan_id, plan_digest, confirm=True). Separate Windows worker performs writes. No inline packaging. get_lifecycle_job — Read durable worker result and partial-resource IDs (job_id).

Manage app configuration policies and MAM (app protection) policies.

action values: list_config_policies — List all managed app config policies (targeted) get_config_policy — Get a specific app config policy (policy_id) create_config_policy — Create an app config policy (body) update_config_policy — Update an app config policy (policy_id, body) delete_config_policy — Delete an app config policy (policy_id, confirm=True) list_protection_policies — List MAM/app protection policies create_protection_policy — Create an app protection policy (platform: ios|android, body) update_protection_policy — Update an app protection policy (policy_id, platform, body) delete_protection_policy — Delete an app protection policy (policy_id, platform, confirm=True)

Manage Intune device compliance policies — CRUD, assignment and status.

action values: list — List all compliance policies get — Get compliance policy details (policy_id) create — Create a new compliance policy (body) update — Update a compliance policy (policy_id, body) delete — Delete a compliance policy (policy_id, confirm=True) assign — Assign policy to groups (policy_id, body: {assignments:[...]}) get_status — Get device deployment status for a policy (policy_id) list_assignments — List assignments for a policy (policy_id)

Manage Intune device configuration profiles — CRUD, assignment and status.

action values: list — List all configuration profiles get — Get profile details (profile_id) create — Create a new profile (body) update — Update a profile (profile_id, body) delete — Delete a profile (profile_id, confirm=True) assign — Assign profile to groups (profile_id, body: {assignments:[...]}) get_status — Get device deployment status (profile_id) list_assignments — List assignments (profile_id)

Manage Intune settings catalog configuration policies.

action values: list — List all settings catalog policies get — Get policy details (policy_id) create — Create a settings catalog policy (body) update — Update a settings catalog policy (policy_id, body) delete — Delete a policy (policy_id, confirm=True) assign — Assign policy to groups (policy_id, body: {assignments:[...]})

Manage Intune ADMX (Administrative Templates / Group Policy) configurations.

action values: list — List all ADMX configurations get — Get ADMX config details (config_id) create — Create an ADMX configuration (body) delete — Delete an ADMX configuration (config_id, confirm=True)

Manage Intune endpoint security policies (Antivirus, Firewall, EDR, etc.).

action values: list_policies — List all endpoint security policies get_policy — Get policy details (policy_id) create_policy — Create from a template (template_id, body) update_policy — Update an endpoint security policy (policy_id, body) delete_policy — Delete a policy (policy_id, confirm=True) assign_policy — Assign to groups (policy_id, body: {assignments:[...]}) get_policy_status — Device state summary for a policy (policy_id) list_templates — List all security templates

View Intune security baseline templates and deployed profiles.

action values: list_templates — List all security baseline templates list_profiles — List deployed security baseline profiles get_status — Get device deployment status for a profile (profile_id)

Manage Windows Update rings and feature/quality/driver update profiles.

action values: list_update_rings — List all Windows update rings get_update_ring — Get update ring details (policy_id) create_update_ring — Create an update ring (body) update_update_ring — Modify an update ring (policy_id, body) delete_update_ring — Delete an update ring (policy_id, confirm=True) list_feature_updates — List Windows feature update profiles get_feature_update — Get a feature update profile (policy_id) create_feature_update — Create a feature update profile (body) list_quality_updates — List quality/expedite update policies list_driver_updates — List driver update profiles

Manage Intune PowerShell scripts, proactive remediations and macOS shell scripts.

script_type: powershell | remediation | macos

action values: list — List scripts (script_type) get — Get script details (script_id, script_type) create — Upload a new script (body, script_type) update — Update a script (script_id, body, script_type) delete — Delete a script (script_id, script_type, confirm=True) assign — Assign a script to groups (script_id, body, script_type) get_status — Device run states for a script (script_id, script_type)

Manage Intune enrollment restrictions, Apple VPP/DEP tokens, and Android Enterprise.

action values: list_restrictions — List device enrollment configurations/restrictions create_restriction — Create an enrollment restriction (body) update_restriction — Update an enrollment restriction (config_id, body) delete_restriction — Delete a restriction (config_id, confirm=True) assign_restriction — Assign restriction to groups (config_id, body) list_vpp_tokens — List Apple VPP tokens get_vpp_token — Get a VPP token (token_id) sync_vpp_token — Sync a VPP token (token_id) list_dep_tokens — List Apple DEP/ADE onboarding settings sync_dep_token — Sync a DEP/ADE token (token_id) list_android_enterprise — List Android Enterprise account settings get_failures_report — Export enrollment failures report list_dep_profiles — List enrollment profiles for a DEP token (token_id)

Manage Windows Autopilot devices and deployment profiles.

action values: list_devices — List all Autopilot device identities list_profiles — List all Autopilot deployment profiles get_profile — Get profile details (profile_id) create_profile — Create an Autopilot deployment profile (body) update_profile — Update a profile (profile_id, body) delete_profile — Delete a profile (profile_id, confirm=True) assign_profile — Assign profile to device/group (profile_id, body) import_device — Import via hardware hash (body: {serialNumber,...}) delete_device — Delete Autopilot device registration (device_id, confirm=True) get_deployment_status — Autopilot deployment events list_esp_profiles — List Enrollment Status Page profiles

Manage Intune assignment filters and scope tags.

action values: list_filters — List all assignment filters get_filter — Get filter details (filter_id) create_filter — Create an assignment filter (body) update_filter — Update a filter (filter_id, body) delete_filter — Delete a filter (filter_id, confirm=True) list_tags — List all scope tags create_tag — Create a scope tag (body) delete_tag — Delete a scope tag (tag_id, confirm=True)

Manage Intune RBAC role definitions and role assignments.

action values: list_roles — List all role definitions (built-in + custom) get_role — Get role definition details (role_id) create_role — Create a custom role (body) update_role — Update a custom role (role_id, body) delete_role — Delete a custom role (role_id, confirm=True) list_assignments — List all role assignments create_assignment — Assign role to user/group with scope (body) delete_assignment — Remove a role assignment (assignment_id, confirm=True) list_resource_operations — List all available RBAC resource actions (permission strings)

Manage Windows 365 Cloud PCs, provisioning policies and network connections.

action values: list — List all Cloud PCs get — Get Cloud PC details (cloud_pc_id) get_overview — Cloud PC overview/summary restart — Restart a Cloud PC (cloud_pc_id) reprovision — Reprovision a Cloud PC (cloud_pc_id, confirm=True) resize — Resize/upgrade a Cloud PC (cloud_pc_id, body: {targetServicePlanId}) restore — Restore from snapshot (cloud_pc_id, body: {snapshotId}) troubleshoot — Trigger troubleshoot action (cloud_pc_id) list_snapshots — List available snapshots (cloud_pc_id) get_audit_events — Audit event logs list_provisioning_policies — List provisioning policies create_provisioning_policy — Create a provisioning policy (body) assign_provisioning_policy — Assign policy to groups (policy_id, body) list_gallery_images — List gallery images for provisioning list_connections — List Azure network connections

Manage Entra ID users — full lifecycle including licenses, manager, onboarding and offboarding.

action values: list — List all users (top) get — Get user details (user_id or UPN) search — Search users by displayName (search_term) create — Create a new user (body) update — Update user properties (user_id, body) delete — Delete a user (user_id, confirm=True) enable — Enable user account (user_id) disable — Disable/block user sign-in (user_id) reset_password — Reset user password (user_id, body: {newPassword, forceChangeAtNextSignIn}) revoke_sessions — Revoke all user refresh tokens (user_id) get_devices — List managed devices for a user (user_id) get_licenses — Get license assignments (user_id) assign_license — Assign a license (user_id, body: {addLicenses:[{skuId}], removeLicenses:[]}) remove_license — Remove a license (user_id, body: {addLicenses:[], removeLicenses:[skuId]}) list_available_licenses — List available license SKUs in tenant get_deleted_users — List recently deleted users restore_user — Restore a deleted user (user_id) assign_manager — Set user's manager (user_id, body: {"@odata.id": managerUrl}) remove_manager — Remove user's manager (user_id) get_direct_reports — List user's direct reports (user_id) get_member_groups — List groups the user belongs to (user_id) onboard_user — Full onboard: create + manager + license + group membership (body) offboard_user — Full offboard: disable + revoke sessions + remove groups (user_id, confirm=True) bulk_create — Create multiple users from a list (body: {users: [...]}) bulk_assign_license — Assign license to multiple users (body: {user_ids:[...], skuId:...})

Manage Entra ID groups — full CRUD plus membership and ownership operations.

action values: list — List all groups get — Get group details (group_id) search — Search groups by displayName (search_term) create_security — Create a security group ONLY after user confirms (body, confirm=True) create_m365 — Create a Microsoft 365 group ONLY after user confirms (body, confirm=True) create_dynamic — Create a dynamic security group ONLY after user confirms (body, confirm=True) update — Update group properties (group_id, body) delete — Delete a group (group_id, confirm=True) get_members — List group members (group_id) add_member — Add a member (group_id, member_id) remove_member — Remove a member (group_id, member_id) get_owners — List group owners (group_id) add_owner — Add an owner (group_id, member_id) bulk_add_members — Add multiple members (group_id, body: {member_ids:[...]})

Manage Entra ID device objects (separate from Intune managed devices).

action values: list — List all Entra ID devices get — Get device details (device_id) search — Search by displayName (search_term) enable — Enable a device in Entra ID (device_id) disable — Disable a device in Entra ID (device_id) delete_entra — Delete device from Entra ID (device_id, confirm=True) delete_intune — Delete device from Intune (intune_device_id, confirm=True) delete_both — Delete from both Intune and Entra (device_id + intune_device_id, confirm=True)

Manage Entra ID Conditional Access policies and named locations.

action values: list_policies — List all CA policies get_policy — Get CA policy details (policy_id) create_policy — Create a new CA policy (body) update_policy — Update a CA policy (policy_id, body) delete_policy — Delete a CA policy (policy_id, confirm=True) enable_policy — Enable a CA policy (policy_id) disable_policy — Disable a CA policy (policy_id) list_locations — List named locations create_location — Create a named location (body) update_location — Update a named location (location_id, body) delete_location — Delete a named location (location_id, confirm=True)

Manage identity protection, authentication methods, sign-in logs and risky users.

action values: get_auth_methods — List authentication methods for a user (user_id) get_mfa_status — Check MFA registration status for a user (user_id) delete_auth_method — Remove an authentication method (user_id, method_id, confirm=True) get_auth_methods_policy — Get tenant-wide authentication methods policy get_sign_in_logs — Sign-in logs (filter_query for OData filter, top) get_directory_audit_logs — Directory audit logs (filter_query, top) get_risky_users — List risky users get_risk_detections — Get risk detection events dismiss_risky_user — Dismiss risk for a user (body: {userIds: [...]}) confirm_compromised — Confirm users as compromised (body: {userIds: [...]})

Manage Entra ID app registrations and enterprise apps (service principals).

action values: list_registrations — List all app registrations get_registration — Get app registration details (app_id) search_registrations — Search registrations by name (search_term) delete_registration — Delete an app registration (app_id, confirm=True) get_expiring_credentials — App regs with credentials expiring soon (days_until_expiry) list_enterprise_apps — List all enterprise apps (service principals) get_enterprise_app — Get enterprise app details (sp_id) search_enterprise_apps — Search enterprise apps by name (search_term) get_app_permissions — Permissions granted to an enterprise app (sp_id) enable_enterprise_app — Enable an enterprise app (sp_id) disable_enterprise_app — Disable an enterprise app (sp_id)

Tenant administration — org info, service health, directory roles, subscriptions, terms of use.

action values: get_org_info — Get organization/tenant information get_domains — List tenant domains get_service_health — M365 service health status overview get_service_issues — Current/recent service issues get_message_center — Message center posts/advisories get_planned_maintenance — Planned maintenance events list_directory_roles — List active directory roles get_role_members — List members of a directory role (role_id) get_global_admins — List Global Administrator members assign_directory_role — Assign directory role to user/group (role_id, body) remove_directory_role_member — Remove member from role (role_id, member_id, confirm=True) get_subscriptions — List subscribed license SKUs get_security_defaults — Check security defaults status list_terms_of_use — List Terms of Use agreements create_terms_of_use — Create a Terms of Use agreement (body) get_cross_tenant_policy — Get cross-tenant access (B2B) policy

Intune reports, endpoint analytics and export jobs.

action values: compliance_report — Device compliance summary config_profile_status — Deployment status for a config profile (policy_id) compliance_policy_status — Deployment status for a compliance policy (policy_id) app_install_status — App install summary (app_id) license_usage — License usage summary hardware_inventory — Hardware inventory export job malware_report — Windows protection / malware state malware_on_device — Detected malware on a device (device_id) device_protection_overview — Device protection status overview endpoint_analytics_score — Endpoint Analytics baseline scores startup_performance — Device startup performance data app_reliability — Application reliability/crash scores work_from_anywhere — Work From Anywhere readiness report app_inventory — App inventory across all devices certificate_report — Device certificate status report co_management_report — Co-management eligibility/status encryption_report — Device encryption status export enrollment_failures — Enrollment failures report

List all supported Graph operations grouped by tool/domain. Optionally filter by category name (e.g., 'devices', 'users', 'policies').

Returns each tool with its name, description and all available action values.