entra-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| ENTRA_CLIENT_ID | No | Azure app registration client ID. Required for live mode. | |
| ENTRA_TENANT_ID | No | Azure tenant ID. Required for live mode (not needed for demo mode). | |
| ENTRA_AUDIT_TRAIL | No | Path to write a JSONL audit trail. Optional; can also be set via --audit-trail. | |
| ENTRA_CLIENT_SECRET | No | Azure app registration client secret. Required for live mode. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| entra_list_usersA | List accounts in the Microsoft 365 tenant with the licences each one holds. Use this to answer "who works here", "who is in Finance", or as the first
step before looking at a specific person. Results are paged: check
Requires the Graph application permission User.Read.All. |
| entra_get_userA | Get one account's profile, manager, group memberships and licences. Use after entra_list_users when a question is about a specific person. Requires User.Read.All and Directory.Read.All. |
| entra_get_license_usageA | Show, per licence SKU, how many seats were purchased and how many are assigned.
Requires Organization.Read.All. |
| entra_find_stale_accountsA | Find accounts that have not signed in recently and the licences they hold. Answers "which licences are we paying for that nobody uses?". Joins the user list, sign-in activity and the licence SKUs, and reports how many seats could be reclaimed, broken down by product. Disabled accounts that still hold a licence are listed first — they are pure waste. Requires User.Read.All and AuditLog.Read.All. Sign-in activity also needs Microsoft Entra ID P1 or higher on the tenant; without it, Graph does not expose this data at all and the tool will say so. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 4 tools
Each tool targets a distinct resource or question: license SKU counts, full user list, a single user's details, and stale accounts. The one potentially overlapping pair (license usage vs. stale accounts) is explicitly disambiguated in the descriptions.
All tools use a consistent entra_ prefix followed by a clear verb_noun pattern: get_license_usage, list_users, get_user, find_stale_accounts. Verb choice maps predictably to collection vs. single-item vs. filtered lookup.
Four tools is a well-scoped set for a read-only Entra user and license audit server. Each tool covers a meaningful slice of the domain without redundancy or bloat.
The read-side is well covered: list users, get user details, summarize license usage, and find stale accounts. The main gap is the lack of any write or management operations, such as assigning/reclaiming licenses or disabling accounts, though the tool set appears intentionally focused on analysis rather than changes.