# How to connect Microsoft Entra ID to Claude

```json
{
  "title": "How to connect Microsoft Entra ID to Claude",
  "toolkit": "Microsoft Entra ID",
  "toolkit_slug": "microsoft_entra_id",
  "framework": "Claude Cowork",
  "framework_slug": "claude-cowork",
  "url": "https://composio.dev/toolkits/microsoft_entra_id/framework/claude-cowork",
  "markdown_url": "https://composio.dev/toolkits/microsoft_entra_id/framework/claude-cowork.md",
  "updated_at": "2026-10-28T05:33:39.240Z"
}
```

## Introduction

Claude is Anthropic's AI assistant, available on the web, in the desktop app, and on mobile. Cowork is its agent for knowledge work, and it runs on all of those surfaces too. Connected to your apps, Claude can work with your files and services to accomplish complex tasks on your behalf.
This guide walks you through the easiest and most secure way to connect your Microsoft Entra ID account to Claude via Composio Connect, enabling it to list users with expired passwords, review recent Microsoft Entra audit logs, find groups with inactive members, and more such actions on your behalf without compromising your account security.
Setup is the same on Claude Web, Desktop, and Cowork, and you only need to do it once. The connector is tied to your account, so it's available in all three.

## Also integrate Microsoft Entra ID with

- [ChatGPT](https://composio.dev/toolkits/microsoft_entra_id/framework/chatgpt)
- [Hermes](https://composio.dev/toolkits/microsoft_entra_id/framework/hermes-agent)
- [Atomic Agent](https://composio.dev/toolkits/microsoft_entra_id/framework/atomic-agent)

## Connect Microsoft Entra ID to Claude Cowork

### Connecting Microsoft Entra ID to Claude Web, Desktop, and Cowork
Two ways to add the Composio connector. Pick whichever you prefer.
### 1. Add with one click
Click the button. Claude opens with the Composio connector filled in. Click Add, then go to step 2.
[Add to Claude](https://claude.ai/customize/connectors?modal=add-custom-connector&connectorName=Composio&connectorUrl=https%3A%2F%2Fconnect.composio.dev%2Fmcp)
### Add manually
In Claude Desktop, click Customize in the left sidebar, then select Connectors and click the + icon at the top.
Click Add custom connector and paste in the Composio MCP server URL:

```bash
https://connect.composio.dev/mcp
```

## What is the Microsoft Entra ID MCP server, and what's possible with it?

The Microsoft Entra ID MCP server is an implementation of the Model Context Protocol that connects your AI agent and assistants like Claude, Cursor, etc directly to your Microsoft Entra ID account. It provides structured and secure access to directory resources, so your agent can create and manage users, groups, applications, and service principals, assign licenses and directory roles, organize memberships and ownership, inspect sign-in and audit events, and retrieve tenant details on your behalf.
- User and group administration: Have your agent create, retrieve, disable, and delete users, create and delete groups, manage group membership and ownership, and assign user licenses.
- Application and service principal management: Let the agent create, retrieve, and delete application registrations and service principals, then manage their owners and application role assignments.
- Access and role management: Direct your agent to add directory role members, create and retrieve role assignments, and add users, groups, or devices to administrative units.
- Directory visibility and auditing: Instruct your agent to inspect devices, domains, organizational details, subscriptions, Conditional Access policies, sign-in events, and directory audit events.
- Administrative unit management: Have your agent create, retrieve, list, and delete administrative units, review their members, and inspect scoped administrative role memberships.

## Supported Tools

| Tool slug | Name | Description |
|---|---|---|
| `MICROSOFT_ENTRA_ID_ADD_ADMINISTRATIVE_UNIT_MEMBER` | Add Administrative Unit Member | Add one existing user, group, or device to an assigned-membership Microsoft Entra administrative unit, bringing that object into the unit's delegated administration scope. Dynamic administrative units are managed only by their membership rule and reject manual changes. In a restricted-management unit, a group must be a nonunified, security-enabled, non-mail-enabled group that is not synchronized from on-premises. For delegated access, Privileged Role Administrator is the least-privileged supported role. App-only callers that need directory reads also require a supported directory-reader role or an application permission such as Directory.Read.All. |
| `MICROSOFT_ENTRA_ID_ADD_APPLICATION_OWNER` | Add Application Owner | Add an existing user or service principal as an owner of an application registration, granting authority to administer it. For delegated access, the signed-in user must also hold Application Administrator, Cloud Application Administrator, Hybrid Identity Administrator, or a supported custom Microsoft Entra role. |
| `MICROSOFT_ENTRA_ID_ADD_DIRECTORY_ROLE_MEMBER` | Add Directory Role Member | Assign a principal to an activated Microsoft Entra directory role, granting that role's tenant-wide administrative access. This is an access-elevation operation. For delegated access, the signed-in user must be a Privileged Role Administrator (the least-privileged supported role) or hold a custom role that grants the permissions required for this operation. Prefer unified role assignments when scoped access is required. |
| `MICROSOFT_ENTRA_ID_ADD_GROUP_MEMBER` | Add Group Member | Add an existing directory object as a direct member of an assigned-membership Microsoft Entra group. Dynamic group membership cannot be changed manually. Role-assignable groups additionally require RoleManagement.ReadWrite.Directory and an eligible Entra role. Adding a device, service principal, or organizational contact can require an additional permission for that member type. |
| `MICROSOFT_ENTRA_ID_ADD_GROUP_OWNER` | Add Group Owner | Add an existing user or service principal as an owner of a Microsoft 365 or security group, granting authority to modify the group. Delegated callers must also be a group owner or hold a supported Microsoft Entra role; some roles can add only user owners or are limited to particular group types. |
| `MICROSOFT_ENTRA_ID_ADD_SERVICE_PRINCIPAL_OWNER` | Add Service Principal Owner | Add an existing user or service principal as an owner of an enterprise application/service principal, granting authority to administer it. For delegated access, the signed-in user must also hold Application Administrator, Cloud Application Administrator, Hybrid Identity Administrator, or a supported custom Microsoft Entra role. With app-only Application.ReadWrite.OwnedBy access, the calling application must already own the target service principal. |
| `MICROSOFT_ENTRA_ID_ASSIGN_USER_LICENSES` | Assign User Licenses | Add and remove Microsoft product licenses for one Entra user in a single request. Both add and remove lists are required and either can be empty. Removing a license revokes the user's entitlement to that product's services and can immediately prevent access; data retention depends on the affected Microsoft product. |
| `MICROSOFT_ENTRA_ID_CREATE_ADMINISTRATIVE_UNIT` | Create Administrative Unit | Create an assigned or dynamic Microsoft Entra administrative unit for scoping directory administration. Restricted member management can be set only during creation and is immutable afterward. |
| `MICROSOFT_ENTRA_ID_CREATE_APPLICATION` | Create Application | Create a Microsoft Entra application registration with allowlisted platform, role, and API permission settings, without creating or accepting password or key credentials. |
| `MICROSOFT_ENTRA_ID_CREATE_APP_ROLE_ASSIGNMENT` | Create App Role Assignment | Assign an application role to a user, group, or client service principal. This grants the principal the application access represented by that role; for client service principals, the grant is an application permission. |
| `MICROSOFT_ENTRA_ID_CREATE_GROUP` | Create Group | Create a Microsoft 365, assigned security, or dynamic-membership group. Optionally bind up to 20 total initial owners and members by directory object ID; dynamic groups cannot have initial members. |
| `MICROSOFT_ENTRA_ID_CREATE_ROLE_ASSIGNMENT` | Create Role Assignment | Grant a user, role-assignable group, or service principal a Microsoft Entra directory role, conferring the role's administrative access at the explicit tenant, administrative-unit, resource-application, or app-specific scope. This is an access-elevation operation. For delegated access, the signed-in user must be a Privileged Role Administrator (the least-privileged supported role) or hold a custom role that grants the required permissions. |
| `MICROSOFT_ENTRA_ID_CREATE_SERVICE_PRINCIPAL` | Create Service Principal | Create an enterprise application (service principal) for an existing application ID without accepting or creating password or key credentials. Delegated callers also need a supported Microsoft Entra role. With app-only Application.ReadWrite.OwnedBy, the calling application must own the backing application. |
| `MICROSOFT_ENTRA_ID_CREATE_USER` | Create User | Create a Microsoft Entra tenant user with the required sign-in profile and an initial password. This action only sets the password required during creation; it does not reset passwords or modify authentication methods. |
| `MICROSOFT_ENTRA_ID_DELETE_ADMINISTRATIVE_UNIT` | Delete Administrative Unit | Delete a Microsoft Entra administrative unit and remove its administrative scope. This is irreversible from this toolkit because restoration is not supported here. |
| `MICROSOFT_ENTRA_ID_DELETE_APPLICATION` | Delete Application | Delete a Microsoft Entra application registration by its directory Object ID. This is irreversible from this toolkit because restoration is not supported here. Deleting the registration can break dependent user or workload sign-in and integrations that rely on its Application (client) ID, permissions, roles, or redirect configuration. |
| `MICROSOFT_ENTRA_ID_DELETE_GROUP` | Delete Group | Delete a Microsoft Entra group and its associated group resources. This is irreversible from this toolkit: Microsoft 365 and security groups can be restored for 30 days only through recovery outside this toolkit, while distribution groups are permanently deleted immediately. |
| `MICROSOFT_ENTRA_ID_DELETE_SERVICE_PRINCIPAL` | Delete Service Principal | Delete a Microsoft Entra enterprise application/service principal. This is irreversible from this toolkit because restoration is not supported here. Deletion removes the enterprise application's tenant identity and can break sign-in, resource access, and app-role assignments that depend on it. |
| `MICROSOFT_ENTRA_ID_DELETE_USER` | Delete User | Delete a tenant user and remove the directory identity. This deletion is irreversible from this toolkit; restoration is outside this toolkit. |
| `MICROSOFT_ENTRA_ID_DISABLE_USER` | Disable User | Disable a Microsoft Entra user without deleting the directory object. This sets accountEnabled=false and blocks future sign-ins; already-issued access tokens or sessions can remain usable until they expire or are separately revoked. |
| `MICROSOFT_ENTRA_ID_GET_ADMINISTRATIVE_UNIT` | Get Administrative Unit | Get one Microsoft Entra administrative unit by directory object ID. |
| `MICROSOFT_ENTRA_ID_GET_APPLICATION` | Get Application | Get one application registration by its directory Object ID, not its Application (client) ID, returning only credential-safe properties. |
| `MICROSOFT_ENTRA_ID_GET_CONDITIONAL_ACCESS_POLICY` | Get Conditional Access Policy | Get one Microsoft Entra Conditional Access policy by object ID. This is a read-only paid-tier capability; delegated callers also need a supported Entra role such as Security Reader, Global Reader, or Conditional Access Administrator. |
| `MICROSOFT_ENTRA_ID_GET_DEVICE` | Get Device | Get one Microsoft Entra device by its directory Object ID, not its distinct Device Registration Service deviceId value. |
| `MICROSOFT_ENTRA_ID_GET_DIRECTORY_AUDIT` | Get Directory Audit | Get one Microsoft Entra directory audit event by its event ID. |
| `MICROSOFT_ENTRA_ID_GET_DIRECTORY_ROLE` | Get Directory Role | Get one Microsoft Entra directory role that is activated in the tenant by its activated role object ID. Inactive role definitions are not available. |
| `MICROSOFT_ENTRA_ID_GET_DOMAIN` | Get Domain | Get one tenant domain by its fully qualified domain name. |
| `MICROSOFT_ENTRA_ID_GET_GROUP` | Get Group | Get one tenant group by directory object ID. |
| `MICROSOFT_ENTRA_ID_GET_ORGANIZATION` | Get Organization | Get the connected Microsoft Entra tenant's organization record by tenant organization ID. The keyed Graph route returns one organization entity. |
| `MICROSOFT_ENTRA_ID_GET_ROLE_ASSIGNMENT` | Get Role Assignment | Get one unified Microsoft Entra directory role assignment by its assignment ID, including its principal, role definition, and directory or application scope identifiers. |
| `MICROSOFT_ENTRA_ID_GET_SERVICE_PRINCIPAL` | Get Service Principal | Get one Microsoft Entra enterprise application/service principal by its directory Object ID, not its Application (client) ID, returning only credential-safe properties. |
| `MICROSOFT_ENTRA_ID_GET_SIGN_IN` | Get Sign In | Get one retained Microsoft Entra sign-in event by event ID. Availability is limited by the tenant's sign-in data retention policy; downloading sign-in logs requires Microsoft Entra ID P1 or P2, and delegated callers need a supported Entra role such as Reports Reader or Security Reader. P2-only risk details can be hidden. |
| `MICROSOFT_ENTRA_ID_GET_SUBSCRIBED_SKU` | Get Subscribed SKU | Get one commercial product subscription acquired by the Microsoft Entra tenant using its subscribed-SKU object ID. |
| `MICROSOFT_ENTRA_ID_GET_USER` | Get User | Get one tenant user by directory object ID or user principal name. |
| `MICROSOFT_ENTRA_ID_GET_USER_MANAGER` | Get User Manager | Get the directory object recorded as a user's manager. Returns not found when no manager is assigned. |
| `MICROSOFT_ENTRA_ID_LIST_ADMINISTRATIVE_UNIT_MEMBERS` | List Administrative Unit Members | List users, groups, and devices directly assigned to a Microsoft Entra administrative unit. Hidden membership requires the additional Member.Read.Hidden grant, so hidden members can otherwise be omitted. Properties other than id and type can be null when the connection lacks permission to read a member's concrete object type. |
| `MICROSOFT_ENTRA_ID_LIST_ADMINISTRATIVE_UNITS` | List Administrative Units | List Microsoft Entra administrative units with optional OData filtering, search, field selection, relationship expansion, and cursor pagination. |
| `MICROSOFT_ENTRA_ID_LIST_ADMINISTRATIVE_UNIT_SCOPED_ROLE_MEMBERS` | List Administrative Unit Scoped Role Members | List the legacy scoped-role memberships that grant users administrative access within one Microsoft Entra administrative unit. This action is read-only; create new scoped grants with unified role assignments instead. |
| `MICROSOFT_ENTRA_ID_LIST_APPLICATION_OWNERS` | List Application Owners | List the users and service principals that own an application registration. Properties other than id and type can be null when the connection lacks permission to read an owner's concrete object type. |
| `MICROSOFT_ENTRA_ID_LIST_APPLICATIONS` | List Applications | List Microsoft Entra application registrations with OData filtering, search, ordering, and cursor pagination. Selection and output schemas structurally exclude password and key credential collections. |
| `MICROSOFT_ENTRA_ID_LIST_APP_ROLE_ASSIGNMENTS` | List App Role Assignments | List users, groups, and client service principals granted application roles on a resource service principal, with OData filtering, field selection, and cursor pagination. Recently added or removed assignments can be delayed by Microsoft Entra replication. |
| `MICROSOFT_ENTRA_ID_LIST_CONDITIONAL_ACCESS_POLICIES` | List Conditional Access Policies | List read-only Microsoft Entra Conditional Access policy definitions, including conditions, grant controls, and session controls, with OData queries and cursor pagination. Conditional Access is license-dependent; delegated callers also need a supported Microsoft Entra role. |
| `MICROSOFT_ENTRA_ID_LIST_DEVICES` | List Devices | List devices registered in the Microsoft Entra tenant with optional advanced OData queries and cursor pagination. Results distinguish each device's directory object ID from its registration-service deviceId. |
| `MICROSOFT_ENTRA_ID_LIST_DIRECTORY_AUDITS` | List Directory Audits | List retained Microsoft Entra directory audit events with documented OData filtering, activity-time ordering, and opaque cursor pagination. Availability is limited by the tenant's Microsoft Entra data-retention policy. For delegated access, the signed-in user must have Reports Reader, Security Reader, Security Administrator, or a supported custom role. |
| `MICROSOFT_ENTRA_ID_LIST_DIRECTORY_ROLE_MEMBERS` | List Directory Role Members | List principals currently assigned to one activated Microsoft Entra directory role. Microsoft Graph returns up to 1,000 objects by default and this operation does not support $top pagination, so the result is a single bounded collection. Concrete-type properties can be null when the connection has limited permission. |
| `MICROSOFT_ENTRA_ID_LIST_DIRECTORY_ROLES` | List Directory Roles | List Microsoft Entra directory roles that are activated in the tenant. Inactive built-in roles and other available role definitions are not returned. |
| `MICROSOFT_ENTRA_ID_LIST_DOMAINS` | List Domains | List verified and unverified domains configured for the Microsoft Entra tenant, with documented OData query controls and cursor pagination. |
| `MICROSOFT_ENTRA_ID_LIST_GROUP_MEMBERS` | List Group Members | List a group's direct members; transitive members are not included. Hidden membership requires the additional Member.Read.Hidden grant and, for delegated access, an eligible Entra role, so hidden members can otherwise be omitted. Properties other than id and type can be null when the connection lacks permission to read a member's concrete object type. |
| `MICROSOFT_ENTRA_ID_LIST_GROUP_OWNERS` | List Group Owners | List the users and service principals that own a group. Microsoft Graph can omit service-principal owners during its staged v1.0 rollout. Properties other than id and type can be null when the connection lacks permission to read an owner's concrete object type. |
| `MICROSOFT_ENTRA_ID_LIST_GROUPS` | List Groups | List tenant groups with general OData options, or list only dynamic-membership groups with a fixed safe filter and membership-rule fields. |
| `MICROSOFT_ENTRA_ID_LIST_ORGANIZATIONS` | List Organizations | Return the connected Microsoft Entra tenant's organization record. Microsoft Graph exposes it as a collection containing exactly one organization. |
| `MICROSOFT_ENTRA_ID_LIST_ROLE_ASSIGNMENTS` | List Role Assignments | List unified Microsoft Entra directory role assignments, including the assigned principal, role definition, and directory or application scope. |
| `MICROSOFT_ENTRA_ID_LIST_SERVICE_PRINCIPAL_OWNERS` | List Service Principal Owners | List directory objects that own an enterprise application/service principal. Properties other than id and type can be null when the connection lacks permission to read an owner's concrete object type. |
| `MICROSOFT_ENTRA_ID_LIST_SERVICE_PRINCIPALS` | List Service Principals | List Microsoft Entra enterprise applications and service principals with OData filtering, search, ordering, and cursor pagination. Selection and output schemas structurally exclude password credentials, key credentials, and token-encryption key identifiers. |
| `MICROSOFT_ENTRA_ID_LIST_SIGN_INS` | List Sign Ins | List retained Microsoft Entra sign-in events, newest first. Prefer a createdDateTime range filter to avoid timeouts. Results are limited by the tenant's retention policy; downloading sign-in logs requires Microsoft Entra ID P1 or P2, and delegated callers need a supported Entra role such as Reports Reader or Security Reader. P2-only risk details can be hidden. |
| `MICROSOFT_ENTRA_ID_LIST_SUBSCRIBED_SKUS` | List Subscribed SKUs | List commercial product subscriptions acquired by the Microsoft Entra tenant, including assigned-license counts, prepaid-unit availability, and included service plans. |
| `MICROSOFT_ENTRA_ID_LIST_USER_DIRECT_REPORTS` | List User Direct Reports | List directory objects that directly report to one user, with optional OData filtering, search, ordering, field selection, and safe cursor pagination. |
| `MICROSOFT_ENTRA_ID_LIST_USER_LICENSE_DETAILS` | List User License Details | List one tenant user's assigned product licenses and the provisioning state of their included service plans. |
| `MICROSOFT_ENTRA_ID_LIST_USER_MEMBERSHIPS` | List User Memberships | List groups, directory roles, and administrative units a user directly belongs to. This is not transitive. Hidden memberships require the additional Member.Read.Hidden grant and otherwise might be omitted. Advanced OData queries use an eventually consistent index, so recent membership changes might not appear immediately. |
| `MICROSOFT_ENTRA_ID_LIST_USERS` | List Users | List tenant users with optional OData filtering, search, ordering, field selection, and a safe continuation cursor. |
| `MICROSOFT_ENTRA_ID_REMOVE_ADMINISTRATIVE_UNIT_MEMBER` | Remove Administrative Unit Member | Remove a user, group, or device from a Microsoft Entra administrative unit, ending administration scoped through that membership. This is irreversible from this toolkit because the prior membership is not restored automatically. The request retains the mandatory /$ref suffix, so it removes only the membership reference and never deletes the member directory object. |
| `MICROSOFT_ENTRA_ID_REMOVE_APPLICATION_OWNER` | Remove Application Owner | Remove an owner from a Microsoft Entra application registration, revoking that principal's authority to administer the application. This is irreversible from this toolkit because prior ownership and administration access are not restored automatically. Microsoft recommends retaining at least two owners; verify that another valid owner will retain access before removal. The request preserves the required /$ref suffix, so it removes only the ownership reference and never deletes the owner directory object. With app-only authentication, the target application must be owned by the calling application when using Application.ReadWrite.OwnedBy. |
| `MICROSOFT_ENTRA_ID_REMOVE_APP_ROLE_ASSIGNMENT` | Remove App Role Assignment | Remove an app-role assignment from a Microsoft Entra resource service principal. This revokes the user, group, or client service principal's application access granted by that role. The removal is irreversible from this toolkit because the prior assignment is not restored automatically. |
| `MICROSOFT_ENTRA_ID_REMOVE_DIRECTORY_ROLE_MEMBER` | Remove Directory Role Member | Remove a principal from an activated Microsoft Entra directory role, revoking the role's tenant-wide administrative access. This is irreversible from this toolkit because the prior role membership is not restored automatically. The request retains the mandatory /$ref suffix, so it removes only the membership reference and never deletes the principal directory object. |
| `MICROSOFT_ENTRA_ID_REMOVE_GROUP_MEMBER` | Remove Group Member | Remove a direct member from an assigned-membership Microsoft Entra group, revoking access inherited through that membership. This is irreversible from this toolkit because the prior membership is not restored automatically. Dynamic groups do not support manual membership changes. Role-assignable groups additionally require RoleManagement.ReadWrite.Directory and a supported Microsoft Entra role. The request retains the required /$ref suffix so it removes only the membership reference and never deletes the member object. |
| `MICROSOFT_ENTRA_ID_REMOVE_GROUP_OWNER` | Remove Group Owner | Remove a user or service principal as an owner of a Microsoft Entra group, revoking that principal's authority to administer the group. This is irreversible from this toolkit because prior ownership is not restored automatically. Verify that another valid owner remains before removing the current owner; removing the last owner can leave ownership-dependent groups without an administrator. The owner directory object itself is not deleted. |
| `MICROSOFT_ENTRA_ID_REMOVE_ROLE_ASSIGNMENT` | Remove Role Assignment | Remove a unified Microsoft Entra directory role assignment and revoke the principal's administrative access at that assignment's scope. This is irreversible from this toolkit because the prior assignment is not restored automatically. |
| `MICROSOFT_ENTRA_ID_REMOVE_SERVICE_PRINCIPAL_OWNER` | Remove Service Principal Owner | Remove an owner from a Microsoft Entra enterprise application/service principal, revoking that principal's authority to administer it. This is irreversible from this toolkit because prior ownership and administration access are not restored automatically. Microsoft recommends retaining at least two owners; verify that another valid owner will retain access before removal. The request preserves the required /$ref suffix, so it removes only the ownership reference and never deletes the owner directory object. With app-only authentication, the target service principal must be owned by the calling application when using Application.ReadWrite.OwnedBy. |
| `MICROSOFT_ENTRA_ID_UPDATE_ADMINISTRATIVE_UNIT` | Update Administrative Unit | Update explicitly supplied profile or dynamic-membership properties of one Microsoft Entra administrative unit. The immutable restricted-member-management property is not accepted. |
| `MICROSOFT_ENTRA_ID_UPDATE_APPLICATION` | Update Application | Update explicitly supplied, allowlisted settings of one Microsoft Entra application registration. Password credentials, key credentials, and token encryption key selection are structurally unavailable. With app-only OAuth, the least-privilege grant can update only applications owned by the calling app. |
| `MICROSOFT_ENTRA_ID_UPDATE_GROUP` | Update Group | Update explicitly supplied, allowlisted properties of one Microsoft Entra group, including its dynamic membership rule or processing state. Properties that require separate permissions or delegated-only support are unavailable. |
| `MICROSOFT_ENTRA_ID_UPDATE_SERVICE_PRINCIPAL` | Update Service Principal | Update explicitly supplied, allowlisted settings of one Microsoft Entra enterprise application/service principal. Password credentials, key credentials, and token-encryption-key selection are structurally unavailable. With app-only OAuth, the least-privilege grant applies only to service principals owned by the calling application. |
| `MICROSOFT_ENTRA_ID_UPDATE_USER` | Update User | Update allowlisted, non-credential profile properties for one Microsoft Entra user. Only explicitly supplied fields are changed; use null only on fields whose description permits clearing. Account status, passwords, authentication methods, identities, phone properties, lifecycle data, and custom security attributes are intentionally unavailable. |

## Supported Triggers

None listed.

## Troubleshooting

### 1. Why does Claude not use the Composio connector for Microsoft Entra ID?

The connector can show as connected, but Claude must use it in each Microsoft Entra ID conversation.
- Click + at the lower left of the chat, or type /.
- Hover Connectors.
- Turn on Composio.
- Ask Claude to connect to Microsoft Entra ID again.

### 2. Why does Claude show an MCP server error before Microsoft Entra ID connects?

Claude can show Couldn't reach the MCP server or Authorization with the MCP server failed when you add the connector for Microsoft Entra ID.
- Check that the connector URL is https://connect.composio.dev/mcp.
- Connectors run from Anthropic's cloud, so your device network is usually not the problem.
- Add the connector again from Customize > Connectors, then ask Claude to connect Microsoft Entra ID.
- If it fails again, send the error and the ofid_ reference id to support@composio.dev.

### 3. Why does the Microsoft Entra ID authorization link not work?

The Composio connector is one server. Your Microsoft Entra ID account connects separately when Claude asks for it.
- If the browser does not open, or the link expires, ask Claude to retry the Microsoft Entra ID connection.
- Composio creates a fresh Microsoft Entra ID authorization link.
- Open that link in your browser and finish the Microsoft Entra ID sign-in.

### 4. Why do Microsoft Entra ID actions fail after they worked before?

The Microsoft Entra ID connection can expire or lose permission.
- Ask Claude to inspect the Microsoft Entra ID connection.
- If the connection is unhealthy, disconnect it when Claude prompts you.
- Reconnect the Microsoft Entra ID account and retry the action.
- If Claude shows a permission prompt, approve it before Claude changes data in Microsoft Entra ID.
- If the action still fails with a permission error, check that the connected account has that permission in Microsoft Entra ID itself.

### 5. How do I switch to a different Microsoft Entra ID account?

Claude can manage the Microsoft Entra ID connection for you.
- Ask Claude to disconnect or delete the current Microsoft Entra ID account.
- Ask Claude to connect Microsoft Entra ID again.
- Open the new Composio authorization link for Microsoft Entra ID.
- Sign in with the other Microsoft Entra ID account in the browser.
- After the account connects, ask Claude to retry the Microsoft Entra ID task.

### 6. Why is my Microsoft Entra ID connection missing in Claude Desktop or on a Team plan?

The connector belongs to your Claude account, so your Microsoft Entra ID connection works in Claude Web, Desktop, and Cowork.
- In Claude Desktop, open Customize > Connectors.
- Next to Composio, click ⋮ and click Clear cache.
- If Microsoft Entra ID tools still do not appear, click ⋮, disconnect, remove the connector, and add it again.
- On Team or Enterprise, an Owner or Primary Owner must enable the connector before you can connect Microsoft Entra ID.

## Creating MCP Server - Stand-alone vs Composio SDK

The Microsoft Entra ID MCP server connects Claude Web, Desktop, and Cowork to your Microsoft Entra ID account through Composio. Once connected, Claude can use the available Microsoft Entra ID tools and triggers to complete tasks on your behalf.

## Complete Code

None listed.

## How to build Microsoft Entra ID MCP Agent with another framework

- [ChatGPT](https://composio.dev/toolkits/microsoft_entra_id/framework/chatgpt)
- [Hermes](https://composio.dev/toolkits/microsoft_entra_id/framework/hermes-agent)
- [Atomic Agent](https://composio.dev/toolkits/microsoft_entra_id/framework/atomic-agent)

## Related Toolkits

- [Supabase](https://composio.dev/toolkits/supabase) - Supabase is an open-source backend platform offering scalable Postgres databases, authentication, storage, and real-time APIs. It lets developers build modern apps without managing infrastructure.
- [Codeinterpreter](https://composio.dev/toolkits/codeinterpreter) - Codeinterpreter is a Python-based coding environment with built-in data analysis and visualization. It lets you instantly run scripts, plot results, and prototype solutions inside supported platforms.
- [1password](https://composio.dev/toolkits/_1password) - 1Password is a password manager and digital vault for storing logins, secrets, notes, and secure documents. It helps individuals and teams protect credentials, share access safely, and reduce password risk.
- [Ably](https://composio.dev/toolkits/ably) - Ably is a real-time messaging platform for live chat and data sync in modern apps. It offers global scale and rock-solid reliability for seamless, instant experiences.
- [Abuselpdb](https://composio.dev/toolkits/abuselpdb) - Abuselpdb is a central database for reporting and checking IPs linked to malicious online activity. Use it to quickly identify and report suspicious or abusive IP addresses.
- [Alchemy](https://composio.dev/toolkits/alchemy) - Alchemy is a blockchain development platform offering APIs and tools for Ethereum apps. It simplifies building and scaling Web3 projects with robust infrastructure.
- [Algolia](https://composio.dev/toolkits/algolia) - Algolia is a hosted search API that powers lightning-fast, relevant search experiences for web and mobile apps. It helps developers deliver instant, typo-tolerant, and scalable search without complex infrastructure.
- [Anakin](https://composio.dev/toolkits/anakin_io) - Anakin is a web automation platform offering scraping, crawling, search, and browser automation. Use it to extract structured data, automate site tasks, and monitor web changes reliably.
- [Anchor browser](https://composio.dev/toolkits/anchor_browser) - Anchor browser is a developer platform for AI-powered web automation. It transforms complex browser actions into easy API endpoints for streamlined web interaction.
- [Apiflash](https://composio.dev/toolkits/apiflash) - Apiflash is a website screenshot API for programmatically capturing web pages. It delivers high-quality screenshots on demand for automation, monitoring, or reporting.
- [Apiverve](https://composio.dev/toolkits/apiverve) - Apiverve delivers a suite of powerful APIs that simplify integration for developers. It's designed for reliability and scalability so you can build faster, smarter applications without the integration headache.
- [Appcircle](https://composio.dev/toolkits/appcircle) - Appcircle is an enterprise-grade mobile CI/CD platform for building, testing, and publishing mobile apps. It streamlines mobile DevOps so teams ship faster and with more confidence.
- [Appdrag](https://composio.dev/toolkits/appdrag) - Appdrag is a cloud platform for building websites, APIs, and databases with drag-and-drop tools and code editing. It accelerates development and iteration by combining hosting, database management, and low-code features in one place.
- [Appveyor](https://composio.dev/toolkits/appveyor) - AppVeyor is a cloud-based continuous integration service for building, testing, and deploying applications. It helps developers automate and streamline their software delivery pipelines.
- [Authyo](https://composio.dev/toolkits/authyo) - Authyo is a REST API service for passwordless authentication, OTP verification, session management, and transactional notifications. Use it to add secure login flows and user verification without building auth infrastructure from scratch.
- [AWS Marketplace MCP](https://composio.dev/toolkits/aws_marketplace_mcp) - AWS Marketplace MCP provides MCP access to AWS Marketplace's cloud software, data, and services catalog. Use it to discover, compare, and evaluate 30K+ AWS Marketplace listings faster.
- [Azure Monitor Activity Log](https://composio.dev/toolkits/azure_monitor_activity_log) - Azure Monitor Activity Log is Azure's service that records management and control-plane events for a subscription. Use it to audit changes, troubleshoot issues, and track resource operations across your Azure resources.
- [Backendless](https://composio.dev/toolkits/backendless) - Backendless is a backend-as-a-service platform for mobile and web apps, offering database, file storage, user authentication, and APIs. It helps developers ship scalable applications faster without managing server infrastructure.
- [Baserow](https://composio.dev/toolkits/baserow) - Baserow is an open-source no-code database platform for building collaborative data apps. It makes it easy for teams to organize data and automate workflows without writing code.
- [Bench](https://composio.dev/toolkits/bench) - Bench is a benchmarking tool for automated performance measurement and analysis. It helps you quickly evaluate, compare, and track your systems or workflows.

## Frequently Asked Questions

### What are the differences in Tool Router MCP and Microsoft Entra ID MCP?

With a standalone Microsoft Entra ID MCP server, the agents and LLMs can only access a fixed set of Microsoft Entra ID tools tied to that server. However, with the Composio Tool Router, agents can dynamically load tools from Microsoft Entra ID and many other apps based on the task at hand, all through a single MCP endpoint.

### Can I use Tool Router MCP with Claude Cowork?

Yes, you can. Claude Cowork fully supports MCP integration. You get structured tool calling, message history handling, and model orchestration while Tool Router takes care of discovering and serving the right Microsoft Entra ID tools.

### Can I manage the permissions and scopes for Microsoft Entra ID while using Tool Router?

Yes, absolutely. You can configure which Microsoft Entra ID scopes and actions are allowed when connecting your account to Composio. You can also bring your own OAuth credentials or API configuration so you keep full control over what the agent can do.

### How safe is my data with Composio Tool Router?

All sensitive data such as tokens, keys, and configuration is fully encrypted at rest and in transit. Composio is SOC 2 Type 2 compliant and follows strict security practices so your Microsoft Entra ID data and credentials are handled as safely as possible.

---
[See all toolkits](https://composio.dev/toolkits) · [Composio docs](https://docs.composio.dev/llms.txt)