Best Practice

Identity Agent

The EntraMCP server integrates Microsoft Entra ID for tenant management: identities, Conditional Access, groups, licenses, and roles, all through natural language commands.

Microsoft Entra ID component

Overview

EntraMCP is an MCP (Model Context Protocol) server that exposes Microsoft Entra ID data and operations as tools for AI. It covers the entire enterprise identity lifecycle: user and group management, app registrations, license and role assignments, as well as access to sign-in and audit logs.

OPERATIONS

Identity and ticket management automation

With more than 50 tools available, the Entra Agent can autonomously handle the following tickets:

1 - Identity & Access

Identity Lifecycle

Manages identities and group memberships, checking the user's status before adding or removing memberships through Microsoft Entra ID.

Account protection

Protects and restores account access through identity verification, password reset, account unlocking, and MFA method recovery.

Licenses

Checks the availability of the required licenses and manages their assignment to users through Microsoft Entra ID.

Permissions

Manages permission change requests and issues related to missing, incorrect, or no longer required access rights, performing the necessary checks before taking action.

2 - Governance

Conditional access

Reviews the existing policy and applies the requested changes.

Tenant config

Verifies permissions and applies the requested changes to the tenant configuration.

Admin access

Reviews the relevant policies and assigns a role based on the principle of least privilege.

3- Security

Suspicious login

Investigates suspicious sign-ins by reviewing Entra ID logs, revoking active sessions, and notifying the user.

Examples

Example prompts

Natural language requests that users can send to the bot in Teams; the agent translates them into MCP tool actions, with a validated execution plan and approval whenever required.

"Who is a member of the Finance-Access group?"

Get Group Members

"Remove Marco from the Finance-Access group: he no longer needs access."

Remove Group Member

"Is there an app with a secret expiring next month?"

Get Expiring Credentials

"Alessia can't sign in and we suspect her account may be blocked. Check today's sign-ins."

Get Sign In Logs

VISUAL TOOLS

Visual views for operators

Thanks to graphical helpers, the tools can return pre-rendered HTML and JavaScript: dashboards, detail pages, and summaries that can be viewed directly within the conversation.

Groups dashboard

Overview of groups with membership and owner details.

Detail group

Detailed group view with quick actions.

Sign-in logs render

Sign-in logs displayed with filters and contextual information.

Audit logs render

Directory audit logs displayed in an easy-to-read format.

Expiring credentials

Dedicated view of credentials approaching expiration.

Device detail

Device detail page with a compliance summary and available actions.

identity agent

Try Identity Agent in action!

Our Best Practices

Product & Accelerator