Azure AD MCP Server
Azure AD MCP server
Connect the Azure AD MCP server
Connect the Azure AD MCP server to let AI agents query your directory data securely.
The Azure AD MCP (Model Context Protocol) server enables your AI agents to query Azure Active Directory and identity data through the Microsoft Graph API. By connecting this integration, your AI agents can securely access user information, groups, licenses, and other directory data directly from your Azure AD tenant.
The setup process for the Azure AD MCP Server is the same as the Intune setup which is why the video covers both. Please use the correct server permissions when setting up both.
[!NOTE] Note: The Azure AD MCP Server is in beta so changes on their end might affect tool use.
Configure the integration
Complete the following steps to register the Microsoft MCP Server for Enterprise as a service principal in your tenant and grant the necessary permissions.
- Open Azure Cloud Shell and start a PowerShell session.
- Install the Microsoft Entra Beta module by running the following command:
Install-Module Microsoft.Entra.Beta -Force -AllowClobber - Connect to Microsoft Entra with the required scopes by running:
Connect-Entra -Scopes 'Application.ReadWrite.All', 'Directory.Read.All', 'DelegatedPermissionGrant.ReadWrite.All' - Authenticate via your browser at https://login.microsoft.com/device using the code provided in your terminal.
- Grant MCP server permissions to your application by running the appropriate command for your setup. For Azure AD MCP, use:
Grant-EntraBetaMCPServerPermission -ApplicationId "<AZURE_AD_MCP_CLIENT_ID>" -Scopes "MCP.User.Read.All", "MCP.Device.Read.All", "MCP.Application.Read.All", "MCP.GroupMember.Read.All"
Review available MCP scopes
When granting permissions, you can specify various scopes depending on the data your AI agents need to access. Available scopes include:
- MCP.User.Read.All: Read user profiles and sign-in activity
- MCP.Device.Read.All: Read device information
- MCP.Application.Read.All: Read application registrations
- MCP.GroupMember.Read.All: Read group memberships
- MCP.AuditLog.Read.All: Read audit logs
- MCP.Policy.Read.ConditionalAccess: Read Conditional Access policies
- MCP.RoleManagement.Read.Directory: Read directory role assignments
- MCP.Organization.Read.All: Read organization information
To view the full list of scopes, run Get-EntraBetaMCPServerPermission after connecting.
Connect Azure AD MCP server with Atomicwork
- Navigate to Settings > MCP Store > Azure AD.
- Sign in with your Microsoft account.
- The list of available tools will be visible on screen.
Configure agent access
After the setup is complete, you can control which tools your AI agents can use. Besides the AI Workforce, these tools will also be available to the coding agent and the Admin Assist for use.
- Navigate to AI workforce > Agent name > Tools.
- Grant granular or complete access to the available JumpCloud tools based on your workspace requirements.