EntraID MCP Server (Microsoft Graph FastMCP)
This project provides a modular, resource-oriented FastMCP server for interacting with Microsoft Graph API. It is designed for extensibility, maintainability, and security, supporting advanced queries for users, sign-in logs, MFA status, and privileged users.
Features
- Modular Resource Structure:
- Each resource (users, sign-in logs, MFA, etc.) is implemented in its own module under
src/msgraph_mcp_server/resources/. - Easy to extend with new resources (e.g., groups, devices).
- Each resource (users, sign-in logs, MFA, etc.) is implemented in its own module under
- Centralized Graph Client:
- Handles authentication and client initialization.
- Shared by all resource modules.
- Comprehensive User Operations:
- Search users by name/email.
- Get user by ID.
- List all privileged users (directory role members).
- Full Group Lifecycle & Membership Management:
- Create, read, update, and delete groups.
- Add/remove group members and owners.
- Search and list groups and group members.
- Application & Service Principal Management:
- List, create, update, and delete applications (app registrations).
- List, create, update, and delete service principals.
- View app role assignments and delegated permissions for both applications and service principals.
- Sign-in Log Operations:
- Query sign-in logs for a user for the last X days.
- MFA Operations:
- Get MFA status for a user.
- Get MFA status for all members of a group.
- Password Management:
- Reset user passwords directly with custom or auto-generated secure passwords.
- Option to require password change on next sign-in.
- Permissions Helper:
- Suggest appropriate Microsoft Graph permissions for common tasks.
- Search and explore available Graph permissions.
- Helps implement the principle of least privilege by recommending only necessary permissions.
- Error Handling & Logging:
- Consistent error handling and progress reporting via FastMCP context.
- Detailed logging for troubleshooting.
- Security:
.envand secret files are excluded from version control.- Uses Microsoft best practices for authentication.
