SIGN UPLOG IN
X (Twitter)LinkedInGitHubDiscordYouTube

How to integrate Microsoft Entra ID MCP with Hermes

Connect Hermes to Microsoft Entra ID MCP. List users with expired passwords, review recent microsoft entra audit logs, and more using natural language, with authentication handled for you.

Get started for freeGet a demo
Microsoft Entra ID logoMicrosoft Entra ID
Oauth2S2s Oauth2

Microsoft Entra ID is Microsoft's cloud identity and access management service for users, groups, apps, devices, and policies. It helps organizations secure identities and control access across Microsoft cloud resources.

73 Tools

Introduction

Hermes is a 24/7 autonomous agent that lives on your computer or server — it remembers what it learns and evolves as your usage grows.

This guide explains the easiest and most robust way to connect your Microsoft Entra ID account to Hermes. You can do this through either Composio Connect CLI or Composio Connect MCP. For personal use we recommend the CLI, but you won't go wrong with MCP either.

Also integrate Microsoft Entra ID with

ChatGPTClaude CoworkAtomic Agent

What is Composio Connect?

Composio Connect is a consumer offering that lets anyone plug 1,500+ applications directly into their agent harness — including Hermes. It can:

  • Search and load tools from relevant toolkits on-demand, reducing context usage.
  • Chain multiple tools to accomplish complex workflows via a remote workbench, without excessive back-and-forth with the LLM.
  • Manage app authentication end-to-end with zero manual overhead.

Integrating Microsoft Entra ID with Hermes

Using Composio Connect CLI

1. Install the Composio CLI

Run the install script directly, or paste https://composio.dev/hermes into your Hermes chat box to have it installed for you.

bash
curl -fsSL https://composio.dev/install | bash
Hermes authenticating with Composio

2. Authenticate

Once the CLI is installed, ask Hermes to authenticate with Composio.

3. Connect to Microsoft Entra ID

Ask your agent to connect to Microsoft Entra ID, or simply request any Microsoft Entra ID-related task. Hermes will prompt you to authenticate and authorize access.

4. Done. You're all set with a new Microsoft Entra ID connection.

Using Composio Connect MCP

1. Get your MCP URL and API Key

Go to dashboard.composio.dev and copy your Connect MCP URL and API key.

Copy MCP URL and API key from Composio dashboard

2. Open the Hermes config file

bash
nano ~/.hermes/config.yaml

3. Add the Composio Connect MCP server

bash
mcp_servers:
  composio:
    url: "https://connect.composio.dev/mcp"
    headers:
      x-consumer-api-key: "YOUR_COMPOSIO_API_KEY"
    connect_timeout: 60
    timeout: 180

Save with Ctrl + O, Enter, then exit with Ctrl + X.

4. Restart your Hermes agent

Once restarted, ask your agent to connect to Microsoft Entra ID or request any Microsoft Entra ID-related task. It will prompt you to authenticate and authorize access.

5. Done!

What is the Microsoft Entra ID MCP server, and what's possible with it?

The Microsoft Entra ID MCP server is an implementation of the Model Context Protocol that connects your AI agent and assistants like Claude, Cursor, etc directly to your Microsoft Entra ID account. It provides structured and secure access to directory resources, so your agent can create and manage users, groups, applications, and service principals, assign licenses and directory roles, organize memberships and ownership, inspect sign-in and audit events, and retrieve tenant details on your behalf.

  • User and group administration: Have your agent create, retrieve, disable, and delete users, create and delete groups, manage group membership and ownership, and assign user licenses.
  • Application and service principal management: Let the agent create, retrieve, and delete application registrations and service principals, then manage their owners and application role assignments.
  • Access and role management: Direct your agent to add directory role members, create and retrieve role assignments, and add users, groups, or devices to administrative units.
  • Directory visibility and auditing: Instruct your agent to inspect devices, domains, organizational details, subscriptions, Conditional Access policies, sign-in events, and directory audit events.
  • Administrative unit management: Have your agent create, retrieve, list, and delete administrative units, review their members, and inspect scoped administrative role memberships.

Way Forward

With Microsoft Entra ID connected, Hermes can now act on your behalf whenever it detects a relevant task or you ask it to.

From here, you can extend Hermes further:

  • Connect more apps: Calendar, Slack, Notion, Linear, and hundreds of others are available through the same Composio Connect setup. Each new integration compounds what Hermes can do for you.
  • Build workflows across tools: Once multiple apps are connected, Hermes can chain actions together — turn an email into a calendar invite, a Slack message into a Linear ticket, or a meeting note into a follow-up draft.
  • Let it learn your patterns: The more you use Hermes, the better it gets at anticipating how you'd handle recurring tasks. Give it feedback on drafts and decisions, and it will adapt.

If you run into trouble or want to share what you've built, join the community or check out the Docs for deeper configuration options.

TOOLS

Supported Tools

Every Microsoft Entra ID action and event your agent gets out of the box.

Add Administrative Unit Member

Add one existing user, group, or device to an assigned-membership Microsoft Entra administrative unit, bringing that object into the unit's delegated administration scope.

Add Application Owner

Add an existing user or service principal as an owner of an application registration, granting authority to administer it.

Add Directory Role Member

Assign a principal to an activated Microsoft Entra directory role, granting that role's tenant-wide administrative access.

Add Group Member

Add an existing directory object as a direct member of an assigned-membership Microsoft Entra group.

Add Group Owner

Add an existing user or service principal as an owner of a Microsoft 365 or security group, granting authority to modify the group.

Add Service Principal Owner

Add an existing user or service principal as an owner of an enterprise application/service principal, granting authority to administer it.

Assign User Licenses

Add and remove Microsoft product licenses for one Entra user in a single request.

Create Administrative Unit

Create an assigned or dynamic Microsoft Entra administrative unit for scoping directory administration.

Create Application

Create a Microsoft Entra application registration with allowlisted platform, role, and API permission settings, without creating or accepting password or key credentials.

Create App Role Assignment

Assign an application role to a user, group, or client service principal.

Create Group

Create a Microsoft 365, assigned security, or dynamic-membership group.

Create Role Assignment

Grant a user, role-assignable group, or service principal a Microsoft Entra directory role, conferring the role's administrative access at the explicit tenant, administrative-unit, resource-application, or app-specific scope.

Create Service Principal

Create an enterprise application (service principal) for an existing application ID without accepting or creating password or key credentials.

Create User

Create a Microsoft Entra tenant user with the required sign-in profile and an initial password.

Delete Administrative Unit

Delete a Microsoft Entra administrative unit and remove its administrative scope.

Delete Application

Delete a Microsoft Entra application registration by its directory Object ID.

Delete Group

Delete a Microsoft Entra group and its associated group resources.

Delete Service Principal

Delete a Microsoft Entra enterprise application/service principal.

Delete User

Delete a tenant user and remove the directory identity.

Disable User

Disable a Microsoft Entra user without deleting the directory object.

Get Administrative Unit

Get one Microsoft Entra administrative unit by directory object ID.

Get Application

Get one application registration by its directory Object ID, not its Application (client) ID, returning only credential-safe properties.

Get Conditional Access Policy

Get one Microsoft Entra Conditional Access policy by object ID.

Get Device

Get one Microsoft Entra device by its directory Object ID, not its distinct Device Registration Service deviceId value.

Get Directory Audit

Get one Microsoft Entra directory audit event by its event ID.

Get Directory Role

Get one Microsoft Entra directory role that is activated in the tenant by its activated role object ID.

Get Domain

Get one tenant domain by its fully qualified domain name.

Get Group

Get one tenant group by directory object ID.

Get Organization

Get the connected Microsoft Entra tenant's organization record by tenant organization ID.

Get Role Assignment

Get one unified Microsoft Entra directory role assignment by its assignment ID, including its principal, role definition, and directory or application scope identifiers.

Get Service Principal

Get one Microsoft Entra enterprise application/service principal by its directory Object ID, not its Application (client) ID, returning only credential-safe properties.

Get Sign In

Get one retained Microsoft Entra sign-in event by event ID.

Get Subscribed SKU

Get one commercial product subscription acquired by the Microsoft Entra tenant using its subscribed-SKU object ID.

Get User

Get one tenant user by directory object ID or user principal name.

Get User Manager

Get the directory object recorded as a user's manager.

List Administrative Unit Members

List users, groups, and devices directly assigned to a Microsoft Entra administrative unit.

List Administrative Units

List Microsoft Entra administrative units with optional OData filtering, search, field selection, relationship expansion, and cursor pagination.

List Administrative Unit Scoped Role Members

List the legacy scoped-role memberships that grant users administrative access within one Microsoft Entra administrative unit.

List Application Owners

List the users and service principals that own an application registration.

List Applications

List Microsoft Entra application registrations with OData filtering, search, ordering, and cursor pagination.

List App Role Assignments

List users, groups, and client service principals granted application roles on a resource service principal, with OData filtering, field selection, and cursor pagination.

List Conditional Access Policies

List read-only Microsoft Entra Conditional Access policy definitions, including conditions, grant controls, and session controls, with OData queries and cursor pagination.

List Devices

List devices registered in the Microsoft Entra tenant with optional advanced OData queries and cursor pagination.

List Directory Audits

List retained Microsoft Entra directory audit events with documented OData filtering, activity-time ordering, and opaque cursor pagination.

List Directory Role Members

List principals currently assigned to one activated Microsoft Entra directory role.

List Directory Roles

List Microsoft Entra directory roles that are activated in the tenant.

List Domains

List verified and unverified domains configured for the Microsoft Entra tenant, with documented OData query controls and cursor pagination.

List Group Members

List a group's direct members; transitive members are not included.

List Group Owners

List the users and service principals that own a group.

List Groups

List tenant groups with general OData options, or list only dynamic-membership groups with a fixed safe filter and membership-rule fields.

List Organizations

Return the connected Microsoft Entra tenant's organization record.

List Role Assignments

List unified Microsoft Entra directory role assignments, including the assigned principal, role definition, and directory or application scope.

List Service Principal Owners

List directory objects that own an enterprise application/service principal.

List Service Principals

List Microsoft Entra enterprise applications and service principals with OData filtering, search, ordering, and cursor pagination.

List Sign Ins

List retained Microsoft Entra sign-in events, newest first.

List Subscribed SKUs

List commercial product subscriptions acquired by the Microsoft Entra tenant, including assigned-license counts, prepaid-unit availability, and included service plans.

List User Direct Reports

List directory objects that directly report to one user, with optional OData filtering, search, ordering, field selection, and safe cursor pagination.

List User License Details

List one tenant user's assigned product licenses and the provisioning state of their included service plans.

List User Memberships

List groups, directory roles, and administrative units a user directly belongs to.

List Users

List tenant users with optional OData filtering, search, ordering, field selection, and a safe continuation cursor.

Remove Administrative Unit Member

Remove a user, group, or device from a Microsoft Entra administrative unit, ending administration scoped through that membership.

Remove Application Owner

Remove an owner from a Microsoft Entra application registration, revoking that principal's authority to administer the application.

Remove App Role Assignment

Remove an app-role assignment from a Microsoft Entra resource service principal.

Remove Directory Role Member

Remove a principal from an activated Microsoft Entra directory role, revoking the role's tenant-wide administrative access.

Remove Group Member

Remove a direct member from an assigned-membership Microsoft Entra group, revoking access inherited through that membership.

Remove Group Owner

Remove a user or service principal as an owner of a Microsoft Entra group, revoking that principal's authority to administer the group.

Remove Role Assignment

Remove a unified Microsoft Entra directory role assignment and revoke the principal's administrative access at that assignment's scope.

Remove Service Principal Owner

Remove an owner from a Microsoft Entra enterprise application/service principal, revoking that principal's authority to administer it.

Update Administrative Unit

Update explicitly supplied profile or dynamic-membership properties of one Microsoft Entra administrative unit.

Update Application

Update explicitly supplied, allowlisted settings of one Microsoft Entra application registration.

Update Group

Update explicitly supplied, allowlisted properties of one Microsoft Entra group, including its dynamic membership rule or processing state.

Update Service Principal

Update explicitly supplied, allowlisted settings of one Microsoft Entra enterprise application/service principal.

Update User

Update allowlisted, non-credential profile properties for one Microsoft Entra user.

FRAMEWORKS

How to build Microsoft Entra ID MCP Agent with another framework

ChatGPT logo

ChatGPT

Use Microsoft Entra ID MCP with ChatGPT

Claude Cowork logo

Claude Cowork

Use Microsoft Entra ID MCP with Claude Cowork

Atomic Agent logo

Atomic Agent

Use Microsoft Entra ID MCP with Atomic Agent

FAQ

Frequently asked questions

With a standalone Microsoft Entra ID MCP server, the agents and LLMs can only access a fixed set of Microsoft Entra ID tools tied to that server. However, with the Composio Tool Router, agents can dynamically load tools from Microsoft Entra ID and many other apps based on the task at hand, all through a single MCP endpoint.

Yes, you can. Hermes fully supports MCP integration. You get structured tool calling, message history handling, and model orchestration while Tool Router takes care of discovering and serving the right Microsoft Entra ID tools.

Yes, absolutely. You can configure which Microsoft Entra ID scopes and actions are allowed when connecting your account to Composio. You can also bring your own OAuth credentials or API configuration so you keep full control over what the agent can do.

All sensitive data such as tokens, keys, and configuration is fully encrypted at rest and in transit. Composio is SOC 2 Type 2 compliant and follows strict security practices so your Microsoft Entra ID data and credentials are handled as safely as possible.

Start with Microsoft Entra ID.It takes 30 seconds.

Managed auth, hosted MCP servers, and every Microsoft Entra ID tool your agent needs.Free to start.

Start building