entraadm-mcp

Microsoft Entra ID sign-in and audit-log triage MCP for Claude Code. Investigate why a sign-in failed (AADSTS-annotated), tenant-wide failure trends and password-spray suspects, accounts that were probably taken over (plus Microsoft's risky users when the tenant has Entra ID P2), who changed what in the directory, what an account did afterwards in OneDrive/SharePoint, Exchange and Entra (Microsoft Purview audit log search), whether MFA is registered for an account, whether your Azure VMs are backed up (Azure Resource Manager, Reader role) and whether a Microsoft 365 service is degraded, plus a one-shot daily_brief. Read-only by default; the one write tool (revoke_sign_in_sessions) is registered only when ENTRAADM_ENABLE_REVOKE_SESSIONS=1. Needs either app-only credentials (ENTRAADM_TENANT_ID/_CLIENT_ID/_CLIENT_SECRET) or an existing `az login` session already present on the machine; the plugin cannot create or supply those for you.

1 MCP server