Microsoft 365 Admin — Claude Code MCP server for M365 admin
An MCP server that gives your agent administrative access to Microsoft 365 through Graph API application permissions. Read-only unless you opt in.
claude mcp add --env MS365_ADMIN_MCP_TENANT_ID=<MS365_ADMIN_MCP_TENANT_ID> --env MS365_ADMIN_MCP_CLIENT_ID=<MS365_ADMIN_MCP_CLIENT_ID> --env MS365_ADMIN_MCP_CLIENT_SECRET=<MS365_ADMIN_MCP_CLIENT_SECRET> --env MS365_ADMIN_MCP_KEYVAULT_URL=<MS365_ADMIN_MCP_KEYVAULT_URL> --env MS365_ADMIN_MCP_CLOUD_TYPE=<MS365_ADMIN_MCP_CLOUD_TYPE> --transport stdio microsoft-365-admin -- npx -y @okapi-ca/ms-365-admin-mcp-serverWhat Microsoft 365 Admin does
The server exposes 674 tools across security, audit, identity, app credentials, guest users, Exchange, Intune, governance, compliance, threat intelligence, advanced hunting, Defender for Identity, Microsoft 365 Copilot admin, eDiscovery, Teams and Cloud PC. Authentication uses client credentials with application permissions, so no user sign-in is involved.
Read-only is the default. Write tools stay off until you pass --allow-writes, and each one carries a risk label: low, medium, high or critical. Presets narrow the tool list to a single domain. Two transports are available — stdio and HTTP (StreamableHTTP) — plus Microsoft global and China (21Vianet) clouds, and Azure Key Vault for secrets.
You need Node.js 18 or newer, an Azure AD app registration with application permissions rather than delegated, and a specific tenant ID. common will not work here.
What it helps with
- audit tenant accounts and guest users
- work through a security incident with advanced hunting logs
- check Intune device state and policy compliance
- pull Microsoft 365 Copilot usage reports
- collect data through eDiscovery for legal export
Example prompts for the agent
- List the guest users in the tenant with their last sign-in date
- Find every Intune device without BitLocker enabled
- Pull the Microsoft 365 Copilot usage report for last month
How to install Microsoft 365 Admin
Platform CLI
claude mcp add --env MS365_ADMIN_MCP_TENANT_ID=<MS365_ADMIN_MCP_TENANT_ID> --env MS365_ADMIN_MCP_CLIENT_ID=<MS365_ADMIN_MCP_CLIENT_ID> --env MS365_ADMIN_MCP_CLIENT_SECRET=<MS365_ADMIN_MCP_CLIENT_SECRET> --env MS365_ADMIN_MCP_KEYVAULT_URL=<MS365_ADMIN_MCP_KEYVAULT_URL> --env MS365_ADMIN_MCP_CLOUD_TYPE=<MS365_ADMIN_MCP_CLOUD_TYPE> --transport stdio microsoft-365-admin -- npx -y @okapi-ca/ms-365-admin-mcp-serverReplace <…> with your own values. 3 more environment variables are in the server README
Platform CLI
codex mcp add microsoft-365-admin --env MS365_ADMIN_MCP_TENANT_ID=<MS365_ADMIN_MCP_TENANT_ID> --env MS365_ADMIN_MCP_CLIENT_ID=<MS365_ADMIN_MCP_CLIENT_ID> --env MS365_ADMIN_MCP_CLIENT_SECRET=<MS365_ADMIN_MCP_CLIENT_SECRET> --env MS365_ADMIN_MCP_KEYVAULT_URL=<MS365_ADMIN_MCP_KEYVAULT_URL> --env MS365_ADMIN_MCP_CLOUD_TYPE=<MS365_ADMIN_MCP_CLOUD_TYPE> -- npx -y @okapi-ca/ms-365-admin-mcp-serverReplace <…> with your own values. 3 more environment variables are in the server README
Config file
{
"mcpServers": {
"microsoft-365-admin": {
"command": "npx",
"args": [
"-y",
"@okapi-ca/ms-365-admin-mcp-server"
],
"env": {
"MS365_ADMIN_MCP_TENANT_ID": "<MS365_ADMIN_MCP_TENANT_ID>",
"MS365_ADMIN_MCP_CLIENT_ID": "<MS365_ADMIN_MCP_CLIENT_ID>",
"MS365_ADMIN_MCP_CLIENT_SECRET": "<MS365_ADMIN_MCP_CLIENT_SECRET>",
"MS365_ADMIN_MCP_KEYVAULT_URL": "<MS365_ADMIN_MCP_KEYVAULT_URL>",
"MS365_ADMIN_MCP_CLOUD_TYPE": "<MS365_ADMIN_MCP_CLOUD_TYPE>"
}
}
}
}Replace <…> with your own values. 3 more environment variables are in the server README
Config file
{
"servers": {
"microsoft-365-admin": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@okapi-ca/ms-365-admin-mcp-server"
],
"env": {
"MS365_ADMIN_MCP_TENANT_ID": "<MS365_ADMIN_MCP_TENANT_ID>",
"MS365_ADMIN_MCP_CLIENT_ID": "<MS365_ADMIN_MCP_CLIENT_ID>",
"MS365_ADMIN_MCP_CLIENT_SECRET": "<MS365_ADMIN_MCP_CLIENT_SECRET>",
"MS365_ADMIN_MCP_KEYVAULT_URL": "<MS365_ADMIN_MCP_KEYVAULT_URL>",
"MS365_ADMIN_MCP_CLOUD_TYPE": "<MS365_ADMIN_MCP_CLOUD_TYPE>"
}
}
}
}Replace <…> with your own values. 3 more environment variables are in the server README
Platform CLI
gemini mcp add -e MS365_ADMIN_MCP_TENANT_ID=<MS365_ADMIN_MCP_TENANT_ID> -e MS365_ADMIN_MCP_CLIENT_ID=<MS365_ADMIN_MCP_CLIENT_ID> -e MS365_ADMIN_MCP_CLIENT_SECRET=<MS365_ADMIN_MCP_CLIENT_SECRET> -e MS365_ADMIN_MCP_KEYVAULT_URL=<MS365_ADMIN_MCP_KEYVAULT_URL> -e MS365_ADMIN_MCP_CLOUD_TYPE=<MS365_ADMIN_MCP_CLOUD_TYPE> microsoft-365-admin npx -y @okapi-ca/ms-365-admin-mcp-serverReplace <…> with your own values. 3 more environment variables are in the server README
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Microsoft 365 Admin
How do I install Microsoft 365 Admin in Claude Code?
Run `claude mcp add ms-365-admin -e MS365_ADMIN_MCP_TENANT_ID=<MS365_ADMIN_MCP_TENANT_ID> -e MS365_ADMIN_MCP_CLIENT_ID=<MS365_ADMIN_MCP_CLIENT_ID> -e MS365_ADMIN_MCP_CLIENT_SECRET=<MS365_ADMIN_MCP_CLIENT_SECRET> -- npx -y @okapi-ca/ms-365-admin-mcp-server`.
What does Microsoft 365 Admin do?
It connects your agent to Microsoft 365 admin APIs through Graph API using application permissions. Coverage includes security, audit, identity, Intune, Exchange, Teams and reporting.
What permissions does the Azure AD app need?
Application permissions, not delegated. The tenant ID must be specific — common is rejected.
