SIGN UPLOG IN
X (Twitter)LinkedInGitHubDiscordYouTube

Microsoft Entra ID MCP server for AI agents and assistants

Securely connect your AI agents and chatbots (Claude, ChatGPT, Cursor, etc) with Microsoft Entra ID MCP or direct API to manage users, groups, applications, roles, and audit data through natural language.

Get started for freeGet a demo
Microsoft Entra ID logoMicrosoft Entra ID
Oauth2S2s Oauth2

Microsoft Entra ID is Microsoft's cloud identity and access management service for users, groups, apps, devices, and policies. It helps organizations secure identities and control access across Microsoft cloud resources.

73 Tools

Try Microsoft Entra ID now

Type what you want done — sign in and watch it run live in the Tool Router playground.

TOOL ROUTER PLAYGROUND
Microsoft Entra ID
Try asking
TOOLS

Supported Tools

Every Microsoft Entra ID action and event your agent gets out of the box.

Add Administrative Unit Member

Add one existing user, group, or device to an assigned-membership Microsoft Entra administrative unit, bringing that object into the unit's delegated administration scope.

Add Application Owner

Add an existing user or service principal as an owner of an application registration, granting authority to administer it.

Add Directory Role Member

Assign a principal to an activated Microsoft Entra directory role, granting that role's tenant-wide administrative access.

Add Group Member

Add an existing directory object as a direct member of an assigned-membership Microsoft Entra group.

Add Group Owner

Add an existing user or service principal as an owner of a Microsoft 365 or security group, granting authority to modify the group.

Add Service Principal Owner

Add an existing user or service principal as an owner of an enterprise application/service principal, granting authority to administer it.

Assign User Licenses

Add and remove Microsoft product licenses for one Entra user in a single request.

Create Administrative Unit

Create an assigned or dynamic Microsoft Entra administrative unit for scoping directory administration.

Create Application

Create a Microsoft Entra application registration with allowlisted platform, role, and API permission settings, without creating or accepting password or key credentials.

Create App Role Assignment

Assign an application role to a user, group, or client service principal.

Create Group

Create a Microsoft 365, assigned security, or dynamic-membership group.

Create Role Assignment

Grant a user, role-assignable group, or service principal a Microsoft Entra directory role, conferring the role's administrative access at the explicit tenant, administrative-unit, resource-application, or app-specific scope.

Create Service Principal

Create an enterprise application (service principal) for an existing application ID without accepting or creating password or key credentials.

Create User

Create a Microsoft Entra tenant user with the required sign-in profile and an initial password.

Delete Administrative Unit

Delete a Microsoft Entra administrative unit and remove its administrative scope.

Delete Application

Delete a Microsoft Entra application registration by its directory Object ID.

Delete Group

Delete a Microsoft Entra group and its associated group resources.

Delete Service Principal

Delete a Microsoft Entra enterprise application/service principal.

Delete User

Delete a tenant user and remove the directory identity.

Disable User

Disable a Microsoft Entra user without deleting the directory object.

Get Administrative Unit

Get one Microsoft Entra administrative unit by directory object ID.

Get Application

Get one application registration by its directory Object ID, not its Application (client) ID, returning only credential-safe properties.

Get Conditional Access Policy

Get one Microsoft Entra Conditional Access policy by object ID.

Get Device

Get one Microsoft Entra device by its directory Object ID, not its distinct Device Registration Service deviceId value.

Get Directory Audit

Get one Microsoft Entra directory audit event by its event ID.

Get Directory Role

Get one Microsoft Entra directory role that is activated in the tenant by its activated role object ID.

Get Domain

Get one tenant domain by its fully qualified domain name.

Get Group

Get one tenant group by directory object ID.

Get Organization

Get the connected Microsoft Entra tenant's organization record by tenant organization ID.

Get Role Assignment

Get one unified Microsoft Entra directory role assignment by its assignment ID, including its principal, role definition, and directory or application scope identifiers.

Get Service Principal

Get one Microsoft Entra enterprise application/service principal by its directory Object ID, not its Application (client) ID, returning only credential-safe properties.

Get Sign In

Get one retained Microsoft Entra sign-in event by event ID.

Get Subscribed SKU

Get one commercial product subscription acquired by the Microsoft Entra tenant using its subscribed-SKU object ID.

Get User

Get one tenant user by directory object ID or user principal name.

Get User Manager

Get the directory object recorded as a user's manager.

List Administrative Unit Members

List users, groups, and devices directly assigned to a Microsoft Entra administrative unit.

List Administrative Units

List Microsoft Entra administrative units with optional OData filtering, search, field selection, relationship expansion, and cursor pagination.

List Administrative Unit Scoped Role Members

List the legacy scoped-role memberships that grant users administrative access within one Microsoft Entra administrative unit.

List Application Owners

List the users and service principals that own an application registration.

List Applications

List Microsoft Entra application registrations with OData filtering, search, ordering, and cursor pagination.

List App Role Assignments

List users, groups, and client service principals granted application roles on a resource service principal, with OData filtering, field selection, and cursor pagination.

List Conditional Access Policies

List read-only Microsoft Entra Conditional Access policy definitions, including conditions, grant controls, and session controls, with OData queries and cursor pagination.

List Devices

List devices registered in the Microsoft Entra tenant with optional advanced OData queries and cursor pagination.

List Directory Audits

List retained Microsoft Entra directory audit events with documented OData filtering, activity-time ordering, and opaque cursor pagination.

List Directory Role Members

List principals currently assigned to one activated Microsoft Entra directory role.

List Directory Roles

List Microsoft Entra directory roles that are activated in the tenant.

List Domains

List verified and unverified domains configured for the Microsoft Entra tenant, with documented OData query controls and cursor pagination.

List Group Members

List a group's direct members; transitive members are not included.

List Group Owners

List the users and service principals that own a group.

List Groups

List tenant groups with general OData options, or list only dynamic-membership groups with a fixed safe filter and membership-rule fields.

List Organizations

Return the connected Microsoft Entra tenant's organization record.

List Role Assignments

List unified Microsoft Entra directory role assignments, including the assigned principal, role definition, and directory or application scope.

List Service Principal Owners

List directory objects that own an enterprise application/service principal.

List Service Principals

List Microsoft Entra enterprise applications and service principals with OData filtering, search, ordering, and cursor pagination.

List Sign Ins

List retained Microsoft Entra sign-in events, newest first.

List Subscribed SKUs

List commercial product subscriptions acquired by the Microsoft Entra tenant, including assigned-license counts, prepaid-unit availability, and included service plans.

List User Direct Reports

List directory objects that directly report to one user, with optional OData filtering, search, ordering, field selection, and safe cursor pagination.

List User License Details

List one tenant user's assigned product licenses and the provisioning state of their included service plans.

List User Memberships

List groups, directory roles, and administrative units a user directly belongs to.

List Users

List tenant users with optional OData filtering, search, ordering, field selection, and a safe continuation cursor.

Remove Administrative Unit Member

Remove a user, group, or device from a Microsoft Entra administrative unit, ending administration scoped through that membership.

Remove Application Owner

Remove an owner from a Microsoft Entra application registration, revoking that principal's authority to administer the application.

Remove App Role Assignment

Remove an app-role assignment from a Microsoft Entra resource service principal.

Remove Directory Role Member

Remove a principal from an activated Microsoft Entra directory role, revoking the role's tenant-wide administrative access.

Remove Group Member

Remove a direct member from an assigned-membership Microsoft Entra group, revoking access inherited through that membership.

Remove Group Owner

Remove a user or service principal as an owner of a Microsoft Entra group, revoking that principal's authority to administer the group.

Remove Role Assignment

Remove a unified Microsoft Entra directory role assignment and revoke the principal's administrative access at that assignment's scope.

Remove Service Principal Owner

Remove an owner from a Microsoft Entra enterprise application/service principal, revoking that principal's authority to administer it.

Update Administrative Unit

Update explicitly supplied profile or dynamic-membership properties of one Microsoft Entra administrative unit.

Update Application

Update explicitly supplied, allowlisted settings of one Microsoft Entra application registration.

Update Group

Update explicitly supplied, allowlisted properties of one Microsoft Entra group, including its dynamic membership rule or processing state.

Update Service Principal

Update explicitly supplied, allowlisted settings of one Microsoft Entra enterprise application/service principal.

Update User

Update allowlisted, non-credential profile properties for one Microsoft Entra user.

SETUP GUIDE

Connect Microsoft Entra ID MCP Tool with your Agent

1

Install Composio

typescript
npm install @composio/core ai @ai-sdk/mcp @ai-sdk/openai
Install the Composio SDK and your agent framework
2

Create a session with MCP enabled

typescript
import { Composio } from "@composio/core";

const composio = new Composio();
const { mcp } = await composio.create("your-user-id", {
  toolkits: ["microsoft_entra_id"],
  mcp: true,
});
Create a session scoped to Microsoft Entra ID and read its MCP URL and headers
3

Connect your agent to the MCP server

typescript
import { createMCPClient } from "@ai-sdk/mcp";
import { openai } from "@ai-sdk/openai";
import { generateText, stepCountIs } from "ai";

const client = await createMCPClient({
  transport: { type: "http", url: mcp.url, headers: mcp.headers },
});

const { text } = await generateText({
  model: openai("gpt-5.6-sol"),
  tools: await client.tools(),
  prompt: "List all users in my Microsoft Entra ID directory and show their display names and email addresses.",
  stopWhen: stepCountIs(10),
});

console.log(text);
await client.close();
Pass the session's MCP URL and headers to your agent and run a Microsoft Entra ID request
SETUP GUIDE

Connect Microsoft Entra ID API Tool with your Agent

1

Install Composio

typescript
npm install @composio/core @composio/openai openai
Install the Composio SDK, the OpenAI provider, and the OpenAI SDK
2

Create a Composio session

typescript
import OpenAI from "openai";
import { Composio } from "@composio/core";
import { OpenAIResponsesProvider } from "@composio/openai";

const composio = new Composio({ provider: new OpenAIResponsesProvider() });
const client = new OpenAI();

const session = await composio.create("your-user-id", { toolkits: ["microsoft_entra_id"] });
const tools = await session.tools();
Initialize Composio with the OpenAI Responses provider and create a session scoped to Microsoft Entra ID
3

Run Microsoft Entra ID tools with your agent

typescript
let response = await client.responses.create({
  model: "gpt-5.6-sol",
  tools,
  input: [{ role: "user", content: "List all users in my Microsoft Entra ID directory and show their display names and email addresses." }],
});

while (response.output.some((o) => o.type === "function_call")) {
  const outputs = await composio.provider.handleToolCalls(session, response.output);
  response = await client.responses.create({
    model: "gpt-5.6-sol",
    tools,
    previous_response_id: response.id,
    input: outputs,
  });
}

console.log(response.output_text);
Send a request, execute the Microsoft Entra ID tool calls through the session, and print the final answer

Why Use Composio?

AI Native Microsoft Entra ID Integration

  • Supports both Microsoft Entra ID MCP and direct API based integrations
  • Structured, LLM-friendly schemas for reliable tool execution
  • Rich coverage for reading, writing, and querying your Microsoft Entra ID data

Managed Auth

  • Built-in OAuth handling with automatic token refresh and rotation
  • Central place to manage, scope, and revoke Microsoft Entra ID access
  • Per user and per environment credentials instead of hard-coded keys

Agent Optimized Design

  • Tools are tuned using real error and success rates to improve reliability over time
  • Comprehensive execution logs so you always know what ran, when, and on whose behalf

Enterprise Grade Security

  • Fine-grained RBAC so you control which agents and users can access Microsoft Entra ID
  • Scoped, least privilege access to Microsoft Entra ID resources
  • Full audit trail of agent actions to support review and compliance
FRAMEWORKS

Use Microsoft Entra ID with any AI Agent Framework

Choose a Framework you want to connect Microsoft Entra ID with

ChatGPT logo

ChatGPT

Use Microsoft Entra ID MCP with ChatGPT

Claude Cowork logo

Claude Cowork

Use Microsoft Entra ID MCP with Claude Cowork

Hermes logo

Hermes

Use Microsoft Entra ID MCP with Hermes

Atomic Agent logo

Atomic Agent

Use Microsoft Entra ID MCP with Atomic Agent

Rolling this out across your team?

Give your team centralized access control across every framework with Composio’s MCP Gateway.

EXPLORE MCP GATEWAY
FAQ

Frequently asked questions

Microsoft Entra ID requires connections to go through your own OAuth app. You register it once with Microsoft Entra ID, add its client ID and secret in the Composio dashboard, and from then on everyone connects by signing in to Microsoft Entra ID as usual. Composio handles the rest of the flow and the token refresh.

Yes! Composio's Tool Router enables agents to use multiple toolkits. Learn more.

Yes. Composio is SOC 2 Type II compliant and is built to keep your Microsoft Entra ID connection and credentials secure. OAuth tokens and API keys are encrypted, and sensitive customer data is protected at rest and in transit.

Composio also undergoes independent security testing and continuously monitors its systems for security threats. You can review the latest reports and policies in the Composio Trust Center.

Composio maintains and updates all toolkit integrations automatically, so your agents always work with the latest API versions.

When you connect a Microsoft Entra ID account through Composio, every action runs under that account, so anything the agent creates, sends, or changes shows up in Microsoft Entra ID as done by you. Keep an approval step in your prompt for actions with side effects, such as sending or deleting, and have the agent draft first.

Exactly the ones Microsoft Entra ID lists on its consent screen when you connect. Review that screen before approving. If you connect a work account, your Microsoft Entra ID administrator may need to approve the app first, and you can revoke the access inside Microsoft Entra ID whenever you want.

Yes. Composio supports multiple connected accounts for the same app, and that works in Claude, ChatGPT, or any other assistant you connect through Composio. Give each Microsoft Entra ID connection a name such as work or personal, and the assistant uses the one you mention in the request. Each account keeps its own credentials and nothing is merged.

Composio refreshes Microsoft Entra ID tokens automatically, so day to day you do nothing. If you revoke access inside Microsoft Entra ID, or Microsoft Entra ID invalidates the session, the connection shows as expired in Composio and the agent stops acting on that account until you reconnect it, which is a single sign-in.

Composio's free Hobby plan includes 100,000 tool calls per month with no credit card, which covers most personal Microsoft Entra ID use. Paid plans add higher limits and team features. Your Microsoft Entra ID plan and its API limits still apply as usual.

Built-in connectors usually give one AI access to a limited set of apps. Many people use Composio because it lets their AI connect to more apps than it normally supports, or connect to multiple accounts for the same app (e.g. connect Claude to multiple Microsoft Entra ID accounts).

With Composio, you connect Microsoft Entra ID once and then use it across different AI assistants without setting it up separately in each one. Connect your apps to Composio once, then connect Composio to whichever AI you use, whether that's Claude, ChatGPT, Hermes, or your own custom assistant.

Start with Microsoft Entra ID.It takes 30 seconds.

Managed auth, hosted MCP servers, and every Microsoft Entra ID tool your agent needs.Free to start.

Start building