Microsoft MCP Server for Enterprise (Microsoft Graph): Tools, Setup and Security

The Microsoft MCP Server for Enterprise lets an AI app answer questions about your Microsoft Entra tenant, such as "How many guest users do we have?". It turns the question into read-only Microsoft Graph API calls. Microsoft publishes and hosts it, and as of October 2026 it is in public preview.

Checked against: Overview of Microsoft MCP Server for Enterprise on 28 October 2026. eSEOspace did not install or test this server.

This is Microsoft's official Graph MCP server, but it is not a Microsoft 365 documents server. Microsoft says it focuses on Entra identity and directory data: users, groups, applications, devices and admin reports. It does not read Outlook mail, OneDrive files or Teams chats.

At a glance

What it can do

Microsoft documents three tools:

• microsoft_graph_suggest_queries searches a curated catalog of Microsoft Graph query examples that match the user's question.
• microsoft_graph_get runs read-only Microsoft Graph calls. Microsoft says it honors user roles, granted scopes and Graph throttling limits.
• microsoft_graph_list_properties returns the schema for Graph entities, so the model knows which properties exist.

Microsoft gives example uses for IT helpdesk ("Is MFA enabled for all administrators?"), admin reporting ("Show me the unassigned licenses in my tenant") and developers exploring Graph APIs. The answer includes the Graph call that ran, which helps people reuse it in scripts.

How to connect it

Microsoft's get started guide says you must provision the server once per tenant. An admin with the Application Administrator or Cloud Application Administrator role runs these PowerShell commands:

Install-Module Microsoft.Entra.Beta -Force -AllowClobber
Connect-Entra -Scopes 'Application.ReadWrite.All', 'Directory.Read.All', 'DelegatedPermissionGrant.ReadWrite.All'
Grant-EntraBetaMCPServerPermission -ApplicationName VisualStudioCode

That registers the server and grants VS Code access. In VS Code, you install the server from Microsoft's install link, sign in with an administrator account and ask a question in Copilot Chat agent mode.

For other MCP clients, you register an app in the Microsoft Entra admin center and add delegated permissions. Microsoft's example is MCP.User.Read.All for counting users. You then grant admin consent. Scopes for a custom client can be managed with:

Grant-EntraBetaMCPServerPermission -ApplicationId "<MCP_Client_Application_Id>" -Scopes "<Scope1>", "<Scope2>"
Revoke-EntraBetaMCPServerPermission -ApplicationId "<MCP_Client_Application_Id>" -Scopes "<Scope1>", "<Scope2>"

Security notes

This server is read-only by design, which removes a whole class of risk. The data it reads is still sensitive. Scopes include MCP.AuditLog.Read.All, MCP.IdentityRiskyUser.Read.All and MCP.Policy.Read.ConditionalAccess.

• Scope naming. Each scope mirrors a Graph permission with an MCP. prefix. Grant only the ones a client needs. Our page on excessive permissions explains why.
• Delegated only. Microsoft says app-only permissions are not supported. The AI can never see more than the signed-in user.
• Logging. Turn on Microsoft Graph activity logs and filter by the server's app ID, e8c77dc2-69b3-43f4-bc51-3213c9d915b4. Microsoft gives a sample Kusto query. See our guide to MCP audit logging.
• Kill switch. You cannot delete the server from your tenant, but Microsoft documents a Graph PATCH that sets accountEnabled to false on its service principal.
• Preview terms. Microsoft warns the preview may change substantially before release.
• Data leaving the tenant. Answers about users and risk events flow into the AI app's conversation. Check that app's data policy before you connect it.

For more, see the MCP security hub.

Alternatives

• Google Workspace MCP servers if your organization runs on Google.
• Box MCP server for permission-aware access to company files.
• Smartsheet MCP server, which lists Microsoft 365 Copilot among its OAuth clients.

Next step

For IT teams, a read-only directory server is a sensible first MCP deployment. It lets you practice consent, scopes and logging before you connect anything that writes. eSEOspace can help you plan that rollout through an MCP readiness audit, or you can browse more profiles in the MCP server directory.

Frequently asked questions