EntraID MCP Server (Microsoft Graph FastMCP)

This project provides a modular, resource-oriented FastMCP server for interacting with Microsoft Graph API. It is designed for extensibility, maintainability, and security, supporting advanced queries for users, sign-in logs, MFA status, and privileged users.

Features

• Modular Resource Structure:
  • Each resource (users, sign-in logs, MFA, etc.) is implemented in its own module under src/msgraph_mcp_server/resources/.
  • Easy to extend with new resources (e.g., groups, devices).
• Centralized Graph Client:
  • Handles authentication and client initialization.
  • Shared by all resource modules.
• Comprehensive User Operations:
  • Search users by name/email.
  • Get user by ID.
  • List all privileged users (directory role members).
• Full Group Lifecycle & Membership Management:
  • Create, read, update, and delete groups.
  • Add/remove group members and owners.
  • Search and list groups and group members.
• Application & Service Principal Management:
  • List, create, update, and delete applications (app registrations).
  • List, create, update, and delete service principals.
  • View app role assignments and delegated permissions for both applications and service principals.
• Sign-in Log Operations:
  • Query sign-in logs for a user for the last X days.
• MFA Operations:
  • Get MFA status for a user.
  • Get MFA status for all members of a group.
• Password Management:
  • Reset user passwords directly with custom or auto-generated secure passwords.
  • Option to require password change on next sign-in.
• Permissions Helper:
  • Suggest appropriate Microsoft Graph permissions for common tasks.
  • Search and explore available Graph permissions.
  • Helps implement the principle of least privilege by recommending only necessary permissions.
• Error Handling & Logging:
  • Consistent error handling and progress reporting via FastMCP context.
  • Detailed logging for troubleshooting.
• Security:
  • .env and secret files are excluded from version control.
  • Uses Microsoft best practices for authentication.

Project Structure

src/msgraph_mcp_server/
├── auth/           # Authentication logic (GraphAuthManager)
├── resources/      # Resource modules (users, signin_logs, mfa, ...)
│   ├── users.py            # User operations (search, get by ID, etc.)
│   ├── signin_logs.py      # Sign-in log operations
│   ├── mfa.py              # MFA status operations
│   ├── permissions_helper.py # Graph permissions utilities and suggestions
│   ├── applications.py       # Application (app registration) operations
│   ├── service_principals.py # Service principal operations
│   └── ...                 # Other resource modules
├── utils/          # Core GraphClient and other ultilities tool, such as password generator..
├── server.py       # FastMCP server entry point (registers tools/resources)
├── __init__.py     # Package marker

Usage

1. Setup

• Clone the repo.
• Create a config/.env file with your Azure AD credentials:

  TENANT_ID=your-tenant-id
  CLIENT_ID=your-client-id
  CLIENT_SECRET=your-client-secret
  

• (Optional) Set up certificate-based auth if needed.

2. Testing & Development

You can test and develop your MCP server directly using the FastMCP CLI:

fastmcp dev '/path/to/src/msgraph_mcp_server/server.py'

This launches an interactive development environment with the MCP Inspector. For more information and advanced usage, see the FastMCP documentation.

3. Available Tools

User Tools

• search_users(query, ctx, limit=10) — Search users by name/email
• get_user_by_id(user_id, ctx) — Get user details by ID
• get_privileged_users(ctx) — List all users in privileged directory roles
• get_user_roles(user_id, ctx) — Get all directory roles assigned to a user
• get_user_groups(user_id, ctx) — Get all groups (including transiti

... View full README on GitHub