Integration · Developer tools

Connect Claude & ChatGPT to Microsoft Entra ID

Ask your AI who is in a group, who a person reports to, or which licences are still free, and get the answer from your Microsoft Entra ID directory. It can read users, groups, admin roles, devices, sign-ins and audit logs. It can also update profiles, add and remove group members, assign licences, invite guests and sign a user out everywhere, with your approval if you want it.

Connect Microsoft Entra ID free

Free plan, no credit card. Takes about a minute.

Try asking

“Who is in the Sales group, and who owns it?”
The AI finds the group and lists its members and owners.
“Anna in Finance leaves today. Block her sign-in and sign her out everywhere.”
It updates her account so sign-in is blocked and signs her out of all sessions on every device.
“How many licences of each type are still free?”
It lists your licence products with how many are assigned and how many are available.

What your AI can do

Users and managers

Search and read users, update job title, department and other profile fields, set managers, list direct reports and block sign-in.

Groups and licences

Create and update groups, add and remove members, list owners, and see and assign licences per user.

Roles, devices and logs

List admin roles and their members, registered devices, guest invitations, sign-ins and directory audit logs.

“Invite [email protected] as a guest and email him the invitation.”
It creates a guest invitation with the page he lands on after accepting, and sends the invitation email.
“Who holds the Global Administrator role?”
It lists the activated admin roles and the members of the one you ask about.
“Who changed the Marketing group yesterday?”
It reads the directory audit log filtered by date and shows who changed what.

29 tools for Microsoft Entra ID

These tools are switched on when you connect. You can switch any of them off, or require your approval before it runs.

add_group_memberChanges dataAdd a user or device to a group: `group_id` plus the member as `odata_id` set to https://graph.microsoft.com/v1.0/directoryObjects/{id}. This may grant them access to the group's resources.
assign_user_licenseChanges dataAdd or remove licences for a user by `user_id`: `add_licenses` (list of {skuId}) and/or `remove_licenses` (list of SKU IDs). May change billing seats.
create_groupChanges dataCreate a group with fields in `body`: `displayName`, `mailNickname`, `mailEnabled`, `securityEnabled`, and `groupTypes` ["Unified"] for a Microsoft 365 group.
get_groupGet one group by `group_id`.
get_meGet the signed-in user's own profile (name, email, job title, department).
get_organizationGet your organisation (tenant) details: name, verified domains and contact info.
get_userGet one user by `user_id` (object ID or sign-in name such as [email protected]), optionally choosing fields with `select`.
get_user_managerGet a user's manager by `user_id`.
invite_guest_userChanges dataInvite an external guest by `invited_user_email_address` with `invite_redirect_url` (where they land after accepting). Set `send_invitation_message` true to email them the invitation.
list_audit_logsList directory audit log entries (who changed what), with `filter` by activity or date.
list_devicesList or search devices registered in your directory, with `filter` and `select`.
list_direct_reportsList the people who report to a user by `user_id`.
list_directory_rolesList the activated admin roles in your directory (e.g. Global Administrator).
list_group_membersList the members of a group by `group_id`.
list_group_ownersList the owners of a group by `group_id`.
list_groupsList or search groups. Use `filter` (e.g. "startswith(displayName,'Sales')"), `search`, `select` and `limit`.
list_invitationsList guest invitations.
list_licensesList the licence products (SKUs) your organisation has, with how many are assigned and available.
list_role_membersList who holds an admin role by `directory_role_id`.
list_sign_insList recent sign-in events, e.g. `filter` "userPrincipalName eq '[email protected]'" or by date. Requires an Entra ID P1/P2 licence.
list_user_devicesList the devices a user has registered, by `user_id`.
list_user_groupsList the groups and roles a user is a direct member of, by `user_id`.
list_user_licensesList the licences assigned to a user by `user_id`.
list_usersList or search users in the directory. Use `filter` (e.g. "department eq 'Sales'"), `search` (e.g. "\"displayName:anna\"" with `consistency_level` eventual), `select` and `limit`.
remove_group_memberMoves moneyRemove a member from a group by `group_id` and the member's ID (`directory_object_id`). They lose access granted through the group.
set_user_managerVisible to othersSet a user's manager: pass the user's `user_id` and the manager as `odata_id` set to https://graph.microsoft.com/v1.0/directoryObjects/{id}.
sign_out_user_everywhereChanges dataSign a user out of all sessions by `user_id`, forcing them to sign in again on every device.
update_groupChanges dataUpdate a group by `group_id` with fields in `body`, such as `displayName`, `description` or `visibility`.
update_userChanges dataUpdate a user's profile by `user_id` with fields in `body`: job title, department, office, phone or city, or `accountEnabled` false to block sign-in.

Set up in three steps

1
Pick the app
Create a free PipMCP account and choose Microsoft Entra ID from the app list.
2
Paste your key
Paste the Application (client) ID and Client secret value from your own app registration, then sign in once with an admin account. In the Microsoft Entra admin center go to App registrations > New registration, choose Accounts in this organizational directory only and add the Web redirect URI https://pipmcp.com/oauth/callback. Create a client secret under Certificates & secrets, add the delegated Microsoft Graph permissions listed in PipMCP under API permissions, and click Grant admin consent.
3
Add the link to your AI
You get a personal MCP link. Add it to Claude, ChatGPT or Cursor:
1. Click your name, then Settings › Connectors › Add custom connector.
2. Paste your link as the Remote MCP server URL.
3. Switch it on from the + menu in a chat.

Questions

What can the AI do in Microsoft Entra ID?

It can read users, managers, direct reports, groups, members, owners, licences, admin roles, devices, guest invitations, sign-ins and audit logs. It can update users and groups, create groups, set a manager, add and remove group members, assign or remove licences, invite guests and sign a user out of all sessions.

Does the AI see my Microsoft Entra ID credentials?

No. Your Microsoft Entra ID credentials are encrypted at rest and never shown to the AI. After you save them, they are not shown again, not even to you. The AI only sees the results of the tools it calls.

Can I control what the AI is allowed to do?

Yes. You choose which tools are switched on, so you can start read-only. Blocking sign-in, signing a user out everywhere and changing group membership affect people's access, and assigning licences can change billing seats. These can require your approval before they run. Every tool call is logged.

Does it work with ChatGPT?

Yes. In ChatGPT go to Settings › Apps & Connectors › Advanced and turn on Developer mode, then add your PipMCP link. Developer mode needs a paid ChatGPT plan: Plus, Pro, Business or Enterprise. The same link also works in Claude (Settings › Connectors › Add custom connector), Cursor and other MCP clients.

What does it cost?

Microsoft Entra ID connects with OAuth, and OAuth connections need the PipMCP Pro plan or above. PipMCP also has a free plan with no credit card, but it does not include this connection. Paid plans bill per completed task. You also need your own Microsoft Entra ID tenant and an admin account.

Can the AI read sign-in logs?

Yes. The sign-in tool lists recent sign-in events, for example for one user or a date range. It needs an Entra ID P1 or P2 licence in your tenant. The audit log, which shows who changed what in the directory, has its own tool.