Get started with the Microsoft MCP Server for Enterprise

GET https://graph.microsoft.com/v1.0/servicePrincipals?$select=id,appId,displayName&$filter=appId in('e8c77dc2-69b3-43f4-bc51-3213c9d915b4','aebc6443-996d-45c2-90f0-388ff96faa56')

$mcpClientSp = Get-EntraBetaServicePrincipal -Select id,appId,displayName -Filter "appId eq 'aebc6443-996d-45c2-90f0-388ff96faa56'"
$mcpServerSp = Get-EntraBetaServicePrincipal -Select id,appId,displayName -Filter "appId eq 'e8c77dc2-69b3-43f4-bc51-3213c9d915b4'"
$mcpClientSp, $mcpServerSp | Format-Table id, appId, displayName -AutoSize

1. Sign in to the Microsoft Entra portal.
2. Expand Entra ID > Enterprise apps.
3. Under the Manage group, select All applications.
4. Search for each application by name or client ID.

GET https://graph.microsoft.com/v1.0/oauth2PermissionGrants?$select=id,clientId,resourceId,scope&$filter=clientId eq '{mcp-client-servicePrincipal}' and resourceId eq '{mcp-server-servicePrincipal}'

$grant = Get-EntraBetaServicePrincipalOAuth2PermissionGrant -ServicePrincipalId $mcpClientSp.Id
$grant.Scope -split ' '

1. Sign in to the Microsoft Entra portal.
2. Expand Entra ID > Enterprise apps.
3. Under the Manage group, select All applications.
4. Search for the service principal by name or client ID and open it.
5. Select Permissions to review the Microsoft MCP Server permissions that are granted to the MCP client.

1. Click Install Microsoft MCP Server for Enterprise to open VS Code's MCP install page.
2. Select Install in VS Code and authenticate with an administrator account.
3. Open Copilot Chat in Agent mode and ask a tenant-specific question such as "How many users are in my tenant?"
   1. Review the MCP Server response, which includes:
      1. The tools that were invoked to understand the intent.
      2. The Microsoft Graph REST API call that was executed.
      3. A natural language answer that summarizes the tenant data.

1. Sign in to the Microsoft Entra admin center with an account that can register applications (Application Administrator or Cloud Application Administrator roles are sufficient).
2. Register an application and consider the following settings:
   1. Application name.
   2. Supported account types (Single tenant).
   3. Platform and redirect URI for your MCP client.
3. Record both the Application (client) ID and the Directory (tenant) ID for later configuration.
4. To grant permissions:
   1. Select Delegated permissions and add the scopes that match your scenario (for example, add MCP.User.Read.All to count users in the tenant).
   2. Grant admin consent for the delegated permissions that you added.
5. Test your MCP client to confirm it can connect to the Microsoft MCP Server for Enterprise and complete the required operations.

Manage scopes for custom MCP clients by using Microsoft Entra PowerShell:

Grant-EntraBetaMCPServerPermission -ApplicationId "<MCP_Client_Application_Id>" -Scopes "<Scope1>", "<Scope2>", "<...>"
Revoke-EntraBetaMCPServerPermission -ApplicationId "<MCP_Client_Application_Id>" -Scopes "<Scope1>", "<Scope2>", "<...>"

GET https://graph.microsoft.com/v1.0/servicePrincipals(appId='e8c77dc2-69b3-43f4-bc51-3213c9d915b4')/oauth2PermissionScopes

(Get-EntraBetaServicePrincipal -Property "PublishedPermissionScopes" -Filter "AppId eq 'e8c77dc2-69b3-43f4-bc51-3213c9d915b4'").PublishedPermissionScopes |
  Where-Object { $_.IsEnabled -eq $true -and $_.AdditionalProperties["isPrivate"] -ne $true } |
  Select-Object Value, AdminConsentDisplayName |
  Sort-Object

1. Sign in to the Microsoft Entra portal.
2. Expand Entra ID > Enterprise apps.
3. Under the Manage group, select All applications.
4. Search for Microsoft MCP Server for Enterprise (or the appId e8c77dc2-69b3-43f4-bc51-3213c9d915b4) and open the application.
5. From the Security group, select Permissions to review the delegated scopes that the MCP Server exposes.

PATCH https://graph.microsoft.com/v1.0/servicePrincipals(appId='e8c77dc2-69b3-43f4-bc51-3213c9d915b4')
{
  "accountEnabled": false
}

$mcpServerSp = Get-EntraBetaServicePrincipal -Select id,appId,displayName -Filter "appId eq 'e8c77dc2-69b3-43f4-bc51-3213c9d915b4'"
Set-EntraBetaServicePrincipal -ServicePrincipalId $mcpServerSp.Id -AccountEnabled $false

1. Sign in to the Microsoft Entra portal.
2. Expand Entra ID > Enterprise apps.
3. Under the Manage group, select All applications.
4. Search for the MCP Server and Visual Studio Code applications by name or client ID and open each one.
5. Under the Manage group, toggle Enabled for users to sign-in? to No.