Cloudflare Worker MCP Server für Entra ID / Microsoft 365 Administration — OAuth 2.1 Delegated Auth.
POST https://admin.m365.mcp.rieker.ai/mcp Authorization: Bearer <token> ← automatisch vom MCP Client verwaltet
/mcp (kein Token) → 401/.well-known/oauth-authorization-server/authorize → Microsoft Login (Browser, einmalig)/callback → /token → Bearer Token (30 Tage)| Tool | Beschreibung |
|---|---|
get_user | Retrieve full details for a user by UPN, email, or Entra object ID. Returns account status, department, job title, manager, mobile phone, and creation date. |
list_users | List users with optional filters by department, account status, or free-text search on display name / UPN. Returns up to 100 results. |
get_user_signin_activity | Retrieve the last interactive and non-interactive sign-in timestamps for a user. Requires AuditLog.Read.All. |
get_user_licenses | List all license SKUs assigned to a user including service plan details. |
get_user_group_memberships | List all groups the user is a member of. Optionally include transitive (nested) memberships. |
get_user_mfa_status | List all registered MFA authentication methods for a user (Authenticator, phone, FIDO2, etc.). Requires UserAuthenticationMethod.Read.All. |
get_mailbox_details | Retrieve mailbox type and size for a user. NOTE: Requires an on-premises Exchange Online PowerShell adapter. Returns NOT_IMPLEMENTED if adapter is not configured. |
list_available_licenses | List all subscribed license SKUs in the tenant with total, consumed, and available seats. |
get_group | Retrieve details and direct members for a group by object ID, display name, or email. |
list_groups | Search and list groups. Filter by type (security, m365, distribution) or display name. |
list_devices | List Intune-managed devices, optionally filtered by owner UPN or compliance state. |
get_bitlocker_recovery_key | Retrieve BitLocker recovery key(s) for a device. Requires BitLockerKey.Read.All. |
list_conditional_access_policies | List all Conditional Access policies including state, conditions, and grant controls. |
list_directory_role_assignments | List Entra ID directory roles and their assigned members. Optionally filter by role name. |
search_audit_log | Search the Entra ID audit log for administrative actions. Filter by category, activity, initiator, target, or date range. |
list_risky_signins | List risky users from Entra ID Identity Protection. Filter by risk level or state. |
list_stale_accounts | List accounts inactive for at least `inactiveDays` days (default 90) that hold an M365 license or are disabled. Returns sign-in data, account status, and assigned licenses per candidate. |
| Tool | Beschreibung |
|---|---|
plan_toggle_user_account | Preview enabling or disabling a user account. Returns a planId valid for 15 minutes. |
execute_toggle_user_account | Enable or disable a user account. Requires planId from plan_toggle_user_account. Fails if plan expired or account state changed. |
plan_update_user_attributes | Preview attribute changes for a user (department, job title, manager, mobile phone, office location). Returns a planId. |
execute_update_user_attributes | Apply attribute changes. Requires planId from plan_update_user_attributes. |
plan_assign_license | Preview assigning a license SKU to a user. Checks seat availability. Returns a planId. |
execute_assign_license | Assign a license. Requires planId from plan_assign_license. Re-checks seat availability at execute time. |
plan_remove_license | Preview removing a license from a user. Warns if the SKU includes Exchange Online (mailbox access will be lost). Returns a planId. |
execute_remove_license | Remove a license. Requires planId from plan_remove_license. Verifies user still holds the license. |
plan_group_membership_change | Preview adding or removing a user from a group. Returns a planId. |
execute_group_membership_change | Apply a group membership change. Requires planId from plan_group_membership_change. |
plan_retire_device | Preview retiring or wiping an Intune device. 'retire' removes corporate data; 'wipe' factory-resets. Returns a planId. |
execute_retire_device | Send retire or wipe command to device. WIPE IS IRREVERSIBLE. Requires planId from plan_retire_device. |
plan_convert_to_shared_mailbox | Preview converting a user mailbox to shared. Requires on-premises EXO adapter. Returns NOT_IMPLEMENTED if not configured. |
execute_convert_to_shared_mailbox | Convert mailbox to shared. Requires planId from plan_convert_to_shared_mailbox and on-premises EXO adapter. |
execute_offboard_user | Execute the offboard recommendation from plan_offboard_user. Converts mailbox + removes license OR deletes user, depending on the recommendation. |
plan_delete_user | Preview full user deletion. Lists all group memberships and licenses that will be released. Returns a planId. |
execute_delete_user | Soft-delete a user (recoverable from Entra Recycle Bin for 30 days). Requires planId from plan_delete_user. |
plan_reset_password_onprem | Preview resetting a password in on-premises Active Directory. Requires PowerShell connector to a Domain Controller. |
execute_reset_password_onprem | Execute on-premises AD password reset. Requires planId from plan_reset_password_onprem. |
plan_unlock_account_onprem | Preview unlocking a locked-out account in on-premises AD. Requires PowerShell connector to a Domain Controller. |
execute_unlock_account_onprem | Execute on-premises AD account unlock. Requires planId from plan_unlock_account_onprem. |
trigger_entra_connect_delta_sync | Trigger a manual Entra Connect delta sync to push on-premises AD changes to Entra ID immediately. |
| Tool | Beschreibung |
|---|---|
get_mailbox_details | Retrieve mailbox type and size for a user. NOTE: Requires an on-premises Exchange Online PowerShell adapter. Returns NOT_IMPLEMENTED if adapter is not configured. |
plan_convert_to_shared_mailbox | Preview converting a user mailbox to shared. Requires on-premises EXO adapter. Returns NOT_IMPLEMENTED if not configured. |
execute_convert_to_shared_mailbox | Convert mailbox to shared. Requires planId from plan_convert_to_shared_mailbox and on-premises EXO adapter. |
plan_reset_password_onprem | Preview resetting a password in on-premises Active Directory. Requires PowerShell connector to a Domain Controller. |
execute_reset_password_onprem | Execute on-premises AD password reset. Requires planId from plan_reset_password_onprem. |
plan_unlock_account_onprem | Preview unlocking a locked-out account in on-premises AD. Requires PowerShell connector to a Domain Controller. |
execute_unlock_account_onprem | Execute on-premises AD account unlock. Requires planId from plan_unlock_account_onprem. |
trigger_entra_connect_delta_sync | Trigger a manual Entra Connect delta sync to push on-premises AD changes to Entra ID immediately. |