entra-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| ENTRA_CLIENT_ID | No | Azure app registration client ID. Required for live mode. | |
| ENTRA_TENANT_ID | No | Azure tenant ID. Required for live mode (not needed for demo mode). | |
| ENTRA_AUDIT_TRAIL | No | Path to write a JSONL audit trail. Optional; can also be set via --audit-trail. | |
| ENTRA_CLIENT_SECRET | No | Azure app registration client secret. Required for live mode. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| entra_list_usersA | List accounts in the Microsoft 365 tenant with the licences each one holds. Use this to answer "who works here", "who is in Finance", or as the first
step before looking at a specific person. Results are paged: check
Requires the Graph application permission User.Read.All. |
| entra_get_userA | Get one account's profile, manager, group memberships and licences. Use after entra_list_users when a question is about a specific person. Requires User.Read.All and Directory.Read.All. |
| entra_get_license_usageA | Show, per licence SKU, how many seats were purchased and how many are assigned.
Requires Organization.Read.All. |
| entra_find_stale_accountsA | Find accounts that have not signed in recently and the licences they hold. Answers "which licences are we paying for that nobody uses?". Joins the user list, sign-in activity and the licence SKUs, and reports how many seats could be reclaimed, broken down by product. Disabled accounts that still hold a licence are listed first — they are pure waste. Requires User.Read.All and AuditLog.Read.All. Sign-in activity also needs Microsoft Entra ID P1 or higher on the tenant; without it, Graph does not expose this data at all and the tool will say so. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/taitson/entra-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server