# Fun with Microsoft MCP Server for Enterprise

You want to know what I did between Christmas and New Years Eve? Of course I spent time with the family, but that would be no content for a tech blog right?  
I tried out the [**Microsoft MCP Server for Enterprise (preview)**](https://learn.microsoft.com/en-us/graph/mcp-server/overview)

## What is this for?

In general the **Model Context Protocol (MCP)** is a standard that lets AI models securely and consistently access external tools, data, and services.

In our case the MCP is adressing GraphAPI. Its abilities is defined by its [MCP Server scopes](https://learn.microsoft.com/en-us/graph/mcp-server/get-started?tabs=portal%2Cvscode#list-of-mcp-server-scopes). Of course you know some of them, like User.Read.All or Organization.Read.All.  
🔴First key takeaway: the MCP has read-only scopes. In case you need more details on scopes, have a look [here](https://learn.microsoft.com/en-us/powershell/entra-powershell/how-to-manage-mcp-server-permissions?view=entra-powershell).  
🔴Next takeaway is about licensing: There are no extra cost or separate licenses. But the right licenses are required for the data you want to access (for example Entra ID P2 licenses for Privileged Identity Management data)

The process how the MCP works looks like this:

[![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767917375121/9f267ed0-42d3-4e79-acb2-e4b025b23699.png align="center")](https://learn.microsoft.com/en-us/graph/mcp-server/overview#how-it-works)

You will recognize the single steps at the end of the post in my short ref case.

## What do you have to do?

Honestly - just follow the [Microsoft article](https://learn.microsoft.com/en-us/graph/mcp-server/get-started?tabs=http%2Cvscode) because its on point. Let me outline the basic steps for you:

1. Install **Microsoft.Entra.Beta** PowerShell module (version 1.0.13 or later):
    
    ```powershell
    Install-Module Microsoft.Entra.Beta -Force -AllowClobber
    ```
    
2. To register the MCP Server, you have to connect to Entra and consent to the required permissions:
    
    ```powershell
    Connect-Entra -Scopes 'Application.ReadWrite.All', 'Directory.Read.All', 'DelegatedPermissionGrant.ReadWrite.All'
    ```
    
3. Register the Microsoft MCP Server for Enterprise in your tenant and grant all permissions to Visual Studio Code:
    
    ```powershell
    Grant-EntraBetaMCPServerPermission -ApplicationName VisualStudioCode
    ```
    
4. After the grant you will find some new Enterprise Applications:
    
    | Name | Globally unique **appId** (client ID) |
    | --- | --- |
    | Microsoft MCP Server for Enterprise | `e8c77dc2-69b3-43f4-bc51-3213c9d915b4` |
    | Visual Studio Code | `aebc6443-996d-45c2-90f0-388ff96faa56` |
    
    The “server“ app ships a service principal with the endpoint `https://mcp.svc.cloud.microsoft/enterprise`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767908833910/fba51734-f0ba-48d9-9539-2414935afe3a.png align="center")
    
    The “client“ app named “Visual Studio Code“ has the defined MCP scopes:
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767907327019/3169d855-e955-4f87-b4bb-6a50ba521430.png align="center")
    
5. Connect to MCP using VS Code
    
    Go for it and click [Install Microsoft MCP Server for Enterprise](https://vscode.dev/redirect/mcp/install?name=Microsoft%20MCP%20Server%20for%20Enterprise&config=%7b%22name%22:%22Microsoft%20MCP%20Server%20for%20Enterprise%22%2c%22type%22:%22http%22%2c%22url%22:%22https://mcp.svc.cloud.microsoft/enterprise%22%7d) to open VS Code's MCP install page:
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767908165109/f2a58d5f-778a-467d-b34c-a1647dfac1a4.png align="center")

After a successfull authentication you and your MCP are set.

## Prompting

I have started prompting in VS Code by an easy idea: I asked to evaluate the oldest user logins.  
It’s fun to see how natural language is translated to proper Graph calls and vice versa:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767909526967/7d0c10fe-a1a7-4691-a182-0213fff49903.png align="center")

To understand the documented process above about how the MCP Server works, I created a short recording. Every M365 admin should relate these daily basic tasks:

%[https://youtu.be/vdgkeM2E3co] 

## Monitoring

Because of the Enterprise App you can easily monitor the Microsoft MCP Server activity logs with [KQL](https://github.com/microsoft/EnterpriseMCP/?tab=readme-ov-file#logs):

```plaintext
MicrosoftGraphActivityLogs
| where TimeGenerated >= ago(30d)
| where AppId == "e8c77dc2-69b3-43f4-bc51-3213c9d915b4"
| project RequestId, TimeGenerated, UserId, RequestMethod, RequestUri, ResponseStatusCode
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767979306722/1c289067-3086-4399-a2f4-7766c339b61a.png align="center")

## What’s next?

A next step I like to try, is to use a custom MCP client and not VS Code. In case this happens, I will let you know for sure. 😁  
Another idea is to attach Azure Foundry as outlined [here](https://github.com/mcp/microsoft/EnterpriseMCP).  
And the final takeaway: 🔴 In case you want more than just read stuff from your tenant - have a look at [lokka.dev](https://lokka.dev/) or just be patient because write access is on the [roadmap](https://github.com/mcp/microsoft/EnterpriseMCP):

*“Support for write operations is planned for a future release.“*

And to optimize the preview service, you can [give feedback here](https://forms.cloud.microsoft/pages/responsepage.aspx?id=v4j5cvGGr0GRqy180BHbR_moJKPUTstMhn24HC7OQadUQ0hLUUVUMVhBQlAyTkQzVDIyWjdZN0dIMC4u&route=shorturl).