Microsoft 365 Admin

{
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "name": "io.github.okapi-ca/ms-365-admin",
  "description": "Microsoft 365 administration via Graph API application permissions (read-only by default).",
  "title": "Microsoft 365 Admin",
  "repository": {
    "url": "https://github.com/okapi-ca/ms-365-admin-mcp-server",
    "source": "github"
  },
  "version": "0.6.3",
  "websiteUrl": "https://github.com/okapi-ca/ms-365-admin-mcp-server",
  "packages": [
    {
      "registryType": "npm",
      "registryBaseUrl": "https://registry.npmjs.org",
      "identifier": "@okapi-ca/ms-365-admin-mcp-server",
      "version": "0.6.3",
      "transport": {
        "type": "stdio"
      },
      "environmentVariables": [
        {
          "description": "Azure AD tenant ID (specific GUID, not 'common').",
          "isRequired": true,
          "name": "MS365_ADMIN_MCP_TENANT_ID"
        },
        {
          "description": "App registration client ID with the required application permissions.",
          "isRequired": true,
          "name": "MS365_ADMIN_MCP_CLIENT_ID"
        },
        {
          "description": "App registration client secret. Prefer Azure Key Vault via MS365_ADMIN_MCP_KEYVAULT_URL for production.",
          "isRequired": true,
          "isSecret": true,
          "name": "MS365_ADMIN_MCP_CLIENT_SECRET"
        },
        {
          "description": "Optional Azure Key Vault URL. When set, secrets are pulled from the vault and override the env-var values above.",
          "name": "MS365_ADMIN_MCP_KEYVAULT_URL"
        },
        {
          "description": "Cloud environment: 'global' (default) or 'china' (21Vianet).",
          "name": "MS365_ADMIN_MCP_CLOUD_TYPE"
        },
        {
          "description": "Cap on the $top query parameter to limit result size.",
          "name": "MS365_ADMIN_MCP_MAX_TOP"
        },
        {
          "description": "Set to 'true' or '1' to force read-only mode (default behavior; mutations require --allow-writes).",
          "name": "READ_ONLY"
        },
        {
          "description": "Regex to filter the catalog of available tools.",
          "name": "ENABLED_TOOLS"
        }
      ]
    }
  ],
  "_meta": {
    "io.modelcontextprotocol.registry/publisher-provided": {
      "categories": [
        "security",
        "identity",
        "device-management",
        "audit",
        "compliance"
      ],
      "tags": [
        "microsoft-365",
        "azure-ad",
        "entra-id",
        "graph-api",
        "intune",
        "defender",
        "conditional-access",
        "secure-score",
        "incident-response"
      ]
    }
  }
}