Home › Other › Microsoft 365 Admin

Microsoft 365 Admin

Microsoft 365 administration via Graph API application permissions (read-only by default).

TypeScript

★ 14 stars Last pushed 2026-09-21 License: MIT

View repository → Website →

Connect

Review any command before running it. Package names and URLs come from the server's own registry entry.

Package (npm 0.6.3)

npx -y @okapi-ca/ms-365-admin-mcp-server@0.6.3

Or add to your MCP client config:

{
  "mcpServers": {
    "ms-365-admin-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@okapi-ca/ms-365-admin-mcp-server@0.6.3"
      ],
      "env": {
        "MS365_ADMIN_MCP_TENANT_ID": "<YOUR_VALUE>",
        "MS365_ADMIN_MCP_CLIENT_ID": "<YOUR_VALUE>",
        "MS365_ADMIN_MCP_CLIENT_SECRET": "<YOUR_VALUE>",
        "MS365_ADMIN_MCP_KEYVAULT_URL": "<YOUR_VALUE>",
        "MS365_ADMIN_MCP_CLOUD_TYPE": "<YOUR_VALUE>",
        "MS365_ADMIN_MCP_MAX_TOP": "<YOUR_VALUE>",
        "READ_ONLY": "<YOUR_VALUE>",
        "ENABLED_TOOLS": "<YOUR_VALUE>"
      }
    }
  }
}

MS365_ADMIN_MCP_TENANT_ID required — Azure AD tenant ID (specific GUID, not 'common').
MS365_ADMIN_MCP_CLIENT_ID required — App registration client ID with the required application permissions.
MS365_ADMIN_MCP_CLIENT_SECRET required secret — App registration client secret. Prefer Azure Key Vault via MS365_ADMIN_MCP_KEYVAULT_URL for production.
MS365_ADMIN_MCP_KEYVAULT_URL — Optional Azure Key Vault URL. When set, secrets are pulled from the vault and override the env-var values above.
MS365_ADMIN_MCP_CLOUD_TYPE — Cloud environment: 'global' (default) or 'china' (21Vianet).
MS365_ADMIN_MCP_MAX_TOP — Cap on the $top query parameter to limit result size.
READ_ONLY — Set to 'true' or '1' to force read-only mode (default behavior; mutations require --allow-writes).
ENABLED_TOOLS — Regex to filter the catalog of available tools.