Skip to main content
Glama
Sign In
entraadm-mcp

entraadm-mcp

by shigechika
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

audit_log_search_result

Check status and retrieve summarized records from an Entra audit log search started by audit_log_search_start; poll until done, then page results.

Instructions

Status and, once finished, the summarised records of an audit search started by audit_log_search_start.

Reads Graph GET /security/auditLog/queries/{id}. While status is notStarted or running the answer is the status only (done: false); call again in a minute or two. failed, cancelled and any status this server does not know are done: true with an error. Once succeeded, the records are paged (/records) and come back as:

  • summary: total_records, first_seen/last_seen, counts by operation, service, record type and user, and per client IP the count with first/last seen (top 25 of each list; distinct has the full counts);

  • records: the newest top records, each with time, operation, service, record type, user, client IP, object id and a few details from auditData (client IP, user agent, result status, site URL, file name, the names of cmdlet parameters -- never their values), every string cut to 200 characters. The full auditData is not returned.

capped=true means the counts are lower bounds: either the page budget or the deadline ran out before every record was read (call again with a larger max_pages), or query.record_count_limit_exceeded is true -- Graph itself stopped collecting at its per-search record limit (query.record_count_limit), so the search holds only part of the matching records whatever max_pages is; narrow the window or the filters and start a new search. records_truncated means more records were read than top returns (the summary counts them all). An unknown id is found: false: a search exists only in the tenant that created it, so pass the tenant its start call used. Permissions as audit_log_search_start; a 403 returns missing_permission.

Args: query_id: The query_id returned by audit_log_search_start (a GUID). top: Maximum records to return, clamped to [1, 500]. max_pages: Page budget for the records (default: ENTRAADM_MAX_PAGES_DEFAULT). tenant: Tenant the search was started in: a [tenant.] section name, one of its domains or its tenant id (default: the default tenant).

Input Schema

NameRequiredDescriptionDefault
topNo
tenantNo
query_idYes
max_pagesNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv1.10.1

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so thoroughly: it discloses status states, done/error semantics, paging behavior, capped and records_truncated meanings, Graph record-limit behavior, omitted auditData details, and 403 missing_permission handling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long, but the length is earned by the tool's complexity: status polling, paging, truncation, permissions, and four undocumented schema parameters. It is front-loaded with the core purpose and uses bullets to structure the return details cleanly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no annotations, no output schema, and 0% schema description coverage, the description provides everything an agent needs: return structure, status semantics, error and truncation behavior, tenant scoping, and parameter meanings. Nothing material appears missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description compensates by documenting every parameter: query_id as the GUID from audit_log_search_start, top clamped to [1, 500], max_pages as the records page budget with an environment default, and tenant as a section name, domain, or tenant id with default behavior.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific resource and operation: it returns the status and, once finished, summarized records of an audit search started by audit_log_search_start. It explicitly ties itself to the sibling start tool, making its role distinct and immediately clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit polling guidance: while status is notStarted or running, call again in a minute or two; once succeeded, records are returned. It also explains failure statuses, unknown IDs, tenant scoping, and permission behavior, leaving little ambiguity about when and how to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools