Cloudflare Worker MCP Server für Entra ID / Microsoft 365 Administration — OAuth 2.1 Delegated Auth.
POST https://admin.m365.mcp.rieker.ai/mcp Authorization: Bearer <token> ← automatisch vom MCP Client verwaltet
/mcp (kein Token) → 401/.well-known/oauth-authorization-server/authorize → Microsoft Login (Browser, einmalig)/callback → /token → Bearer Token (30 Tage)| Tool | Beschreibung |
|---|---|
get_user | Retrieve full details for a user by UPN, email, or Entra object ID. Returns account status, department, job title, manager, mobile phone, and creation date. |
list_users | List users with optional filters by department, account status, or free-text search on display name / UPN. Returns up to 100 results. |
get_user_signin_activity | Retrieve the last interactive and non-interactive sign-in timestamps for a user. Requires AuditLog.Read.All. |
list_signin_activity | Bulk view of sign-in activity across users, sorted oldest-first (never signed in first, then longest since last sign-in). Optionally filter by department, accountEnabled, or free-text search. Use get_user_signin_activity for a single user. |
get_user_licenses | List all license SKUs assigned to a user including service plan details. |
get_user_group_memberships | List all groups the user is a member of. Optionally include transitive (nested) memberships. |
get_user_mfa_status | List all registered MFA authentication methods for a user (Authenticator, phone, FIDO2, etc.). Requires UserAuthenticationMethod.Read.All. |
get_mailbox_details | Retrieve mailbox type and size for a user. NOTE: Requires an on-premises Exchange Online PowerShell adapter. Returns NOT_IMPLEMENTED if adapter is not configured. |
list_available_licenses | List all subscribed license SKUs in the tenant with total, consumed, and available seats. |
search_service_principals | Search Entra ID Enterprise Applications (service principals) by display name. Use this to find the exact appId / appDisplayName for a service (e.g. 'Power BI', 'Copilot Studio', 'Visio') before checking sign-in activity with get_app_signin_history or check_license_usage. |
get_app_signin_history | Retrieve a user's sign-in history for one specific application, to check whether a licensed service (e.g. Power BI, Copilot Studio, Visio) is actually being used. Requires appDisplayName (exact match — use search_service_principals) or appId. Sign-in logs are retained ~30 days (Entra ID P1/P2) or ~7 days (Free). |
check_license_usage | Check whether a specific licensed M365 service is actually used by one user. Cross-references the user's assigned license SKUs against sign-in activity for the corresponding application. Works for any add-on license with a corresponding Enterprise Application — Power BI, Copilot Studio, Visio, Planner, etc. Returns LICENSED_AND_USED / LICENSED_NOT_USED / NOT_LICENSED. Response includes searchWindow stating the actual period checked, since Graph's sign-in log retention (~30 days P1/P2, ~7 days Free) may be shorter than inactiveDays. |
list_unused_license_holders | Tenant-wide reclamation report: list all users holding a given license SKU and flag those who have not signed into the corresponding application within N days. Useful for auditing Power BI, Copilot Studio, Visio, and other add-on licenses across the whole tenant for reclaim candidates. Uses 2 Graph calls total (batched, not one per user). Response includes searchWindow stating the actual period checked, since Graph's sign-in log retention (~30 days P1/P2, ~7 days Free) may be shorter than inactiveDays. |
get_group | Retrieve details and direct members for a group by object ID, display name, or email. |
list_groups | Search and list groups. Filter by type (security, m365, distribution) or display name. |
list_devices | List Intune-managed devices, optionally filtered by owner UPN or compliance state. |
get_bitlocker_recovery_key | Retrieve BitLocker recovery key(s) for a device. Requires BitLockerKey.Read.All. |
list_conditional_access_policies | List all Conditional Access policies including state, conditions, and grant controls. |
list_directory_role_assignments | List Entra ID directory roles and their assigned members. Optionally filter by role name. |
search_audit_log | Search the Entra ID audit log for administrative actions. Filter by category, activity, initiator, target, or date range. |
list_risky_signins | List risky users from Entra ID Identity Protection. Filter by risk level or state. |
list_stale_m365_accounts | License-reclaim audit: list users who hold at least one M365 license and are inactive for at least `inactiveDays` days (default 90) or already disabled. Scans up to 999 users per call. Use list_stale_accounts for a license-agnostic sweep. |
list_stale_accounts | General dormant-identity audit: list ALL accounts inactive for at least `inactiveDays` days (default 90), regardless of license or enabled/disabled state. Catches unlicensed and guest/service accounts that list_stale_m365_accounts would miss. Scans up to 999 users per call. |
get_smtp_aliases | List all SMTP proxy addresses for a user (primary + all secondary aliases). In hybrid environments, aliases are managed on-prem via Set-ADUser proxyAddresses. |
get_user_ou | Show the on-premises Active Directory Organizational Unit (OU) of a synced user, derived from onPremisesDistinguishedName. |
get_archive_status | Check whether the Exchange Online archive mailbox is enabled for a user. Reads mailboxSettings.archiveFolder via Graph API. Requires MailboxSettings.Read scope. |
get_mailbox_size | Retrieve mailbox size statistics. Requires Exchange Online PowerShell: Get-MailboxStatistics -Identity '{upn}' | Select DisplayName,TotalItemSize,ItemCount |
get_mailbox_delegation | List delegation permissions (FullAccess, SendAs, SendOnBehalf) for a mailbox. Requires EXO PowerShell: Get-MailboxPermission / Get-RecipientPermission / Get-Mailbox | Select GrantSendOnBehalfTo |
| Tool | Beschreibung |
|---|---|
plan_toggle_user_account | Preview enabling or disabling a user account. Returns a planId valid for 15 minutes. |
execute_toggle_user_account | Enable or disable a user account. Requires planId from plan_toggle_user_account. Fails if plan expired or account state changed. |
plan_assign_license | Preview assigning a license SKU to a user. Checks seat availability. Returns a planId. |
execute_assign_license | Assign a license. Requires planId from plan_assign_license. Re-checks seat availability at execute time. |
plan_remove_license | Preview removing a license from a user. Warns if the SKU includes Exchange Online (mailbox access will be lost). Returns a planId. |
execute_remove_license | Remove a license. Requires planId from plan_remove_license. Verifies user still holds the license. |
plan_group_membership_change | Preview adding or removing a user from a cloud-only Entra/M365 group. NOTE: AD-synchronized groups cannot be modified in Entra ID — use plan_add_smtp_alias_onprem or on-premises AD for synced groups. Returns a planId. |
execute_group_membership_change | Apply a group membership change. Requires planId from plan_group_membership_change. |
plan_retire_device | Preview retiring or wiping an Intune device. 'retire' removes corporate data; 'wipe' factory-resets. Returns a planId. |
execute_retire_device | Send retire or wipe command to device. WIPE IS IRREVERSIBLE. Requires planId from plan_retire_device. |
plan_convert_to_shared_mailbox | Preview converting a user mailbox to shared. Requires on-premises EXO adapter. Returns NOT_IMPLEMENTED if not configured. |
execute_convert_to_shared_mailbox | Convert mailbox to shared. Requires planId from plan_convert_to_shared_mailbox and on-premises EXO adapter. |
execute_offboard_user | Execute the offboard recommendation from plan_offboard_user. Converts mailbox + removes license OR deletes user, depending on the recommendation. |
plan_enable_archive | Preview enabling Exchange Online archive mailbox. Requires EXO PowerShell: Enable-Mailbox -Identity '{upn}' -Archive |
execute_enable_archive | Enable Exchange Online archive. Requires planId from plan_enable_archive and EXO PowerShell adapter. |
plan_set_mail_forwarding | Preview setting or clearing mail forwarding for a mailbox. Requires EXO PowerShell: Set-Mailbox -Identity '{upn}' -ForwardingSmtpAddress '{smtp}' -DeliverToMailboxAndForward $keepCopy |
execute_set_mail_forwarding | Apply mail forwarding change. Requires planId from plan_set_mail_forwarding and EXO PowerShell adapter. |
plan_set_mailbox_delegation | Preview adding or removing a mailbox delegation permission (FullAccess, SendAs, SendOnBehalf). Requires EXO PowerShell adapter. |
execute_set_mailbox_delegation | Apply delegation permission change. Requires planId from plan_set_mailbox_delegation and EXO PowerShell adapter. |
plan_reset_password_onprem | Preview resetting a password in on-premises Active Directory. Requires PowerShell connector to a Domain Controller. |
execute_reset_password_onprem | Execute on-premises AD password reset. Requires planId from plan_reset_password_onprem. |
plan_unlock_account_onprem | Preview unlocking a locked-out account in on-premises AD. Requires PowerShell connector to a Domain Controller. |
execute_unlock_account_onprem | Execute on-premises AD account unlock. Requires planId from plan_unlock_account_onprem. |
trigger_entra_connect_delta_sync | Trigger a manual Entra Connect delta sync to push on-premises AD changes to Entra ID immediately. |
plan_create_user_onprem | Preview creating a new user in on-premises Active Directory. Use New-ADUser on a Domain Controller. Entra Connect will sync the account to Entra ID. |
execute_create_user_onprem | Execute on-premises AD user creation. Requires planId from plan_create_user_onprem. |
plan_add_smtp_alias_onprem | Preview adding a secondary SMTP alias to a user. In hybrid, proxy addresses are managed in on-premises AD via Set-ADUser proxyAddresses. Trigger trigger_entra_connect_delta_sync after applying. |
execute_add_smtp_alias_onprem | Apply SMTP alias addition. Requires planId from plan_add_smtp_alias_onprem. |
plan_move_user_ou_onprem | Preview moving a user to a different Organizational Unit in on-premises AD. Use Move-ADObject on a Domain Controller. Use get_user_ou to find current OU first. |
execute_move_user_ou_onprem | Execute OU move. Requires planId from plan_move_user_ou_onprem. |
plan_migrate_mailbox_to_cloud | Preview enabling remote mailbox for a user to migrate their mailbox to Exchange Online. Runs Enable-RemoteMailbox on the on-premises Exchange Management Shell. |
execute_migrate_mailbox_to_cloud | Execute mailbox migration to cloud. Requires planId from plan_migrate_mailbox_to_cloud. Must run on on-premises Exchange Management Shell, NOT Exchange Online PowerShell. |
| Tool | Beschreibung |
|---|---|
get_mailbox_details | Retrieve mailbox type and size for a user. NOTE: Requires an on-premises Exchange Online PowerShell adapter. Returns NOT_IMPLEMENTED if adapter is not configured. |
plan_convert_to_shared_mailbox | Preview converting a user mailbox to shared. Requires on-premises EXO adapter. Returns NOT_IMPLEMENTED if not configured. |
execute_convert_to_shared_mailbox | Convert mailbox to shared. Requires planId from plan_convert_to_shared_mailbox and on-premises EXO adapter. |
get_archive_status | Check whether the Exchange Online archive mailbox is enabled for a user. Reads mailboxSettings.archiveFolder via Graph API. Requires MailboxSettings.Read scope. |
plan_reset_password_onprem | Preview resetting a password in on-premises Active Directory. Requires PowerShell connector to a Domain Controller. |
execute_reset_password_onprem | Execute on-premises AD password reset. Requires planId from plan_reset_password_onprem. |
plan_unlock_account_onprem | Preview unlocking a locked-out account in on-premises AD. Requires PowerShell connector to a Domain Controller. |
execute_unlock_account_onprem | Execute on-premises AD account unlock. Requires planId from plan_unlock_account_onprem. |
trigger_entra_connect_delta_sync | Trigger a manual Entra Connect delta sync to push on-premises AD changes to Entra ID immediately. |