# Microsoft 365 Admin

An MCP server that gives your agent administrative access to Microsoft 365 through Graph API application permissions. Read-only unless you opt in.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 17
- Author: okapi-ca
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/okapi-ca/ms-365-admin-mcp-server
- Updated: 2026-10-20
- HTML: https://affpapa.org/en/nevibecode/mcp/microsoft-365-admin

## What it does

The server exposes 674 tools across security, audit, identity, app credentials, guest users, Exchange, Intune, governance, compliance, threat intelligence, advanced hunting, Defender for Identity, Microsoft 365 Copilot admin, eDiscovery, Teams and Cloud PC. Authentication uses client credentials with application permissions, so no user sign-in is involved.

Read-only is the default. Write tools stay off until you pass `--allow-writes`, and each one carries a risk label: low, medium, high or critical. Presets narrow the tool list to a single domain. Two transports are available — stdio and HTTP (StreamableHTTP) — plus Microsoft global and China (21Vianet) clouds, and Azure Key Vault for secrets.

You need Node.js 18 or newer, an Azure AD app registration with application permissions rather than delegated, and a specific tenant ID. `common` will not work here.

## Requirements
- Needs: Node.js (commands run via npx)
- Environment variables: `MS365_ADMIN_MCP_TENANT_ID`, `MS365_ADMIN_MCP_CLIENT_ID`, `MS365_ADMIN_MCP_CLIENT_SECRET`, `MS365_ADMIN_MCP_KEYVAULT_URL`, `MS365_ADMIN_MCP_CLOUD_TYPE`, `MS365_ADMIN_MCP_MAX_TOP`, `READ_ONLY`, `ENABLED_TOOLS` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add --env MS365_ADMIN_MCP_TENANT_ID=<MS365_ADMIN_MCP_TENANT_ID> --env MS365_ADMIN_MCP_CLIENT_ID=<MS365_ADMIN_MCP_CLIENT_ID> --env MS365_ADMIN_MCP_CLIENT_SECRET=<MS365_ADMIN_MCP_CLIENT_SECRET> --env MS365_ADMIN_MCP_KEYVAULT_URL=<MS365_ADMIN_MCP_KEYVAULT_URL> --env MS365_ADMIN_MCP_CLOUD_TYPE=<MS365_ADMIN_MCP_CLOUD_TYPE> --transport stdio microsoft-365-admin -- npx -y @okapi-ca/ms-365-admin-mcp-server
```
Replace <…> with your own values. 3 more environment variables are in the server README

### Codex

**Platform CLI**
```bash
codex mcp add microsoft-365-admin --env MS365_ADMIN_MCP_TENANT_ID=<MS365_ADMIN_MCP_TENANT_ID> --env MS365_ADMIN_MCP_CLIENT_ID=<MS365_ADMIN_MCP_CLIENT_ID> --env MS365_ADMIN_MCP_CLIENT_SECRET=<MS365_ADMIN_MCP_CLIENT_SECRET> --env MS365_ADMIN_MCP_KEYVAULT_URL=<MS365_ADMIN_MCP_KEYVAULT_URL> --env MS365_ADMIN_MCP_CLOUD_TYPE=<MS365_ADMIN_MCP_CLOUD_TYPE> -- npx -y @okapi-ca/ms-365-admin-mcp-server
```
Replace <…> with your own values. 3 more environment variables are in the server README

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "microsoft-365-admin": {
            "command": "npx",
            "args": [
                "-y",
                "@okapi-ca/ms-365-admin-mcp-server"
            ],
            "env": {
                "MS365_ADMIN_MCP_TENANT_ID": "<MS365_ADMIN_MCP_TENANT_ID>",
                "MS365_ADMIN_MCP_CLIENT_ID": "<MS365_ADMIN_MCP_CLIENT_ID>",
                "MS365_ADMIN_MCP_CLIENT_SECRET": "<MS365_ADMIN_MCP_CLIENT_SECRET>",
                "MS365_ADMIN_MCP_KEYVAULT_URL": "<MS365_ADMIN_MCP_KEYVAULT_URL>",
                "MS365_ADMIN_MCP_CLOUD_TYPE": "<MS365_ADMIN_MCP_CLOUD_TYPE>"
            }
        }
    }
}
```
Replace <…> with your own values. 3 more environment variables are in the server README

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "microsoft-365-admin": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "@okapi-ca/ms-365-admin-mcp-server"
            ],
            "env": {
                "MS365_ADMIN_MCP_TENANT_ID": "<MS365_ADMIN_MCP_TENANT_ID>",
                "MS365_ADMIN_MCP_CLIENT_ID": "<MS365_ADMIN_MCP_CLIENT_ID>",
                "MS365_ADMIN_MCP_CLIENT_SECRET": "<MS365_ADMIN_MCP_CLIENT_SECRET>",
                "MS365_ADMIN_MCP_KEYVAULT_URL": "<MS365_ADMIN_MCP_KEYVAULT_URL>",
                "MS365_ADMIN_MCP_CLOUD_TYPE": "<MS365_ADMIN_MCP_CLOUD_TYPE>"
            }
        }
    }
}
```
Replace <…> with your own values. 3 more environment variables are in the server README

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e MS365_ADMIN_MCP_TENANT_ID=<MS365_ADMIN_MCP_TENANT_ID> -e MS365_ADMIN_MCP_CLIENT_ID=<MS365_ADMIN_MCP_CLIENT_ID> -e MS365_ADMIN_MCP_CLIENT_SECRET=<MS365_ADMIN_MCP_CLIENT_SECRET> -e MS365_ADMIN_MCP_KEYVAULT_URL=<MS365_ADMIN_MCP_KEYVAULT_URL> -e MS365_ADMIN_MCP_CLOUD_TYPE=<MS365_ADMIN_MCP_CLOUD_TYPE> microsoft-365-admin npx -y @okapi-ca/ms-365-admin-mcp-server
```
Replace <…> with your own values. 3 more environment variables are in the server README

## When to use it
- audit tenant accounts and guest users
- work through a security incident with advanced hunting logs
- check Intune device state and policy compliance
- pull Microsoft 365 Copilot usage reports
- collect data through eDiscovery for legal export

## Example prompts
- List the guest users in the tenant with their last sign-in date
- Find every Intune device without BitLocker enabled
- Pull the Microsoft 365 Copilot usage report for last month

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md