Microsoft Entra SCIM MCP server

Read from the package source without running it. The installed server may list more.

• add_group_members

  Add one or more users to a group. Auto-chunks at … member ids per PATCH call (Entra SCIM API constraint), and duplicate ids in the input are deduped. Idempotent — adding an existing member is a no-op, so retrying after a partial failure is safe. If a chunk fails mid-sequence the error reports addedMemberIds, failedMemberIds and notAttemptedMemberIds, because earlier chunks are already committed an

• create_groupwrite action

  Create an Entra group via SCIM. displayName is required; the Entra extension flags decide the group type. securityEnabled true with mailEnabled false (or omitted) is a security group. mailEnabled true with securityEnabled false is a Microsoft 365 / Unified group and needs mailNickname. Entra does not support creating mail-enabled security groups, so setting both flags true is rejected. displayName

• delete_groupwrite action

  DELETE a group by id. Microsoft 365 / Unified groups are soft-deleted and restorable for 30 days, security groups are removed permanently — and either way restoration is a Microsoft Graph operation, not a SCIM one, so this server cannot undo it. The group's members are not deleted, only their membership. Any access granted through this group is revoked. A second call for the same id returns 404.

• deprovision_userwrite action

  DELETE a user by id. The user is soft-deleted into the Entra recycle bin and is restorable for 30 days — but only through Microsoft Graph, not SCIM, so this server cannot undo it. Deleting also strips every group membership, which is why a later remove_group_member for this user returns 404. A second call for the same id returns 404 rather than succeeding quietly.

• get_group

  Fetch a single group by id. Note: members are NOT returned, at any page size or projection. To find a user's groups, use list_groups with a members.value filter; to check one specific membership, filter list_groups on both id and members.value.

• get_service_provider_config

  Fetch the Entra SCIM service provider configuration (supported features: patch, filter, pagination, bulk). Answers what the endpoint supports, not what is in the directory. The response is the same for every tenant and changes only when Microsoft changes the API, so fetch it once and reuse it rather than calling it before each operation.

• get_user

  Fetch a single user by Entra object id. Two things are never in the response, whatever you project: Custom Security Attributes (the schema marks them returned:"request" — use get_user_custom_security_attributes) and group memberships (filter list_groups on members.value instead). To look a user up by userName rather than id, use list_users with an 'eq' filter.

• get_user_custom_security_attributes

  Fetch Custom Security Attributes for a user, projected by attribute set. attributeSets is required — the API rejects the bare extension URN with a 400. CSAs never come back from a plain get_user; they are only returned when named explicitly here. A set the user holds no values in comes back empty, which is a valid answer rather than an error. Requires CustomSecAttributeAssignment.Read.All (covered

• list_groups

  List Entra groups via SCIM. Filter supports 'eq' on displayName/id/members.value and 'ew' on displayName; only 'and' is supported. Cursor-based pagination. A members.value filter is the only way to discover which groups a user belongs to — neither get_user nor get_group reports membership.

• list_resource_types

  List the SCIM resource types Entra supports (User, Group) and the schemas each one uses. Pass id to fetch a single type. Static per API version — cache it rather than re-fetching.

• list_schemas

  List Entra SCIM schemas (core User, core Group, enterprise extension, Entra extensions, CustomSecurityAttributes) with each attribute's type, mutability and whether it is returned by default. Use it to check an attribute name or extension URN before building a patch path. Pass id to fetch a single schema. Static per API version — cache it rather than re-fetching. It describes the schema shape only

• list_users

  List Entra users via SCIM. Filter supports 'eq' on userName/externalId/id/groups.value/mailNickname and 'ew' on userName/mailNickname; only 'and' is supported. Cursor-based pagination. This is also how you resolve a userName to an object id, since every other user tool takes the id. Prefer a filter plus a narrow 'attributes' list over listing everything: each page is a separate billed request.

• provision_userwrite action

  Create a user in Entra via SCIM. Enforces the required attribute set: userName, password, displayName, givenName, familyName, mailNickname. active defaults to true. Not idempotent — a second call with the same userName fails with a uniqueness conflict, so check with list_users first if a retry might be a duplicate. Group membership is not settable here: create the user, then call add_group_members

• remove_group_memberwrite action

  Remove a single user from a group. The Entra SCIM API only allows one removal per PATCH call and no other ops in the same call, so removing several members means several calls. A 404 here does not mean the group is missing: the API answers "Resource '<groupId>' does not exist or one of its queried reference-property objects are not present" — naming the group, not the member — whenever the user is

• update_groupwrite action

  PATCH group attributes — e.g. { op: "replace", path: "displayName", value: "Platform Engineering" }, or the Entra extension URN ending in ":description". Membership changes are NOT allowed here: a "members" path is rejected client-side before any request is sent, so use add_group_members / remove_group_member instead. Group type flags (mailEnabled, securityEnabled) are fixed at creation and cannot

• update_userwrite action
• update_user_custom_security_attributeswrite action

  PATCH CustomSecurityAttributes on a user. Set a value with { op: "replace", path: "urn:ietf:params:scim:schemas:extension:Microsoft:Entra:2.0:CustomSecurityAttributes:Engineering.Team", value: "Platform" }. Clear one with op "remove" on the same path, or by replacing a multi-valued attribute with an empty array — both delete the assignment outright. The attribute set and attribute must already exi

• update_user_lifecyclewrite action

  PATCH lifecycle attributes on a user — currently employeeLeaveDateTime. Not an inert field: Entra Lifecycle Workflows can be scheduled off it, so writing a past or imminent date may start offboarding. Called with no attributes set it changes nothing and returns { noChanges: true } without issuing a request. Requires User-LifeCycleInfo.ReadWrite.All on the app registration, which is separate from t

• Code scan57 source files scanned25/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitystatic API keys via environment variables6/15
• Maintenancelast push 5 days ago15/15
• Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Microsoft Entra SCIM: common questions

Is Microsoft Entra SCIM MCP server safe?

Mostly: it is graded B (83/100). Read the Microsoft Entra SCIM safety report

How do I install Microsoft Entra SCIM?

It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.

Does Microsoft Entra SCIM need an API key?

Yes. The registry entry asks for ENTRA_CLIENT_SECRET, ENTRA_CLIENT_CERT_PASSWORD, ENTRA_SCIM_STATIC_TOKEN.

Is Microsoft Entra SCIM maintained?

The last commit was 6 days ago (2026-09-14). The latest release is v0.2.1.