Microsoft Entra SCIM

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/darrenjrobinson-entra-scim-mcp

About

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools

8 read · 3 write · 7 delete

Secrets

3 (API keys, tokens or passwords)

Install scripts

None found

Runs as

Node.js package

Tools (18)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• add_group_membersAdd group members

  Description is built at runtime.

• create_groupCreate group

  Create an Entra group via SCIM. displayName is required; the Entra extension flags decide the group type. securityEnabled true with mailEnabled false (or omitted) is a security group. mailEnabled true with securityEnabled false is a Microsoft 365 / Unified group and needs mailNickname. Entra does not support creating mail-enabled security groups, so setting both flags true is rejected. displayName is not unique in Entra — creating the same name twice yields two groups, so check with list_groups if a retry might duplicate. Members cannot be set here: create the group, then call add_group_member…

• delete_groupDelete groupcan change or delete data

  DELETE a group by id. Microsoft 365 / Unified groups are soft-deleted and restorable for 30 days, security groups are removed permanently — and either way restoration is a Microsoft Graph operation, not a SCIM one, so this server cannot undo it. The group's members are not deleted, only their membership. Any access granted through this group is revoked. A second call for the same id returns 404.

• deprovision_userDeprovision usercan change or delete data

  DELETE a user by id. The user is soft-deleted into the Entra recycle bin and is restorable for 30 days — but only through Microsoft Graph, not SCIM, so this server cannot undo it. Deleting also strips every group membership, which is why a later remove_group_member for this user returns 404. A second call for the same id returns 404 rather than succeeding quietly.

• get_groupGet group by idread-only

  Fetch a single group by id. Note: members are NOT returned, at any page size or projection. To list this group's direct members, use list_users with a groups.value filter (Microsoft's recommended path); to find a user's groups, use list_groups with a members.value filter; to check one specific membership, filter list_groups on both id and members.value.

• get_service_provider_configGet SCIM service provider configread-only

  Fetch the Entra SCIM service provider configuration (supported features: patch, filter, pagination, bulk). Answers what the endpoint supports, not what is in the directory. The response is the same for every tenant and changes only when Microsoft changes the API, so fetch it once and reuse it rather than calling it before each operation.

• get_userGet user by idread-only

  Fetch a single user by Entra object id. Two things are never in the response, whatever you project: Custom Security Attributes (the schema marks them returned:"request" — use get_user_custom_security_attributes) and group memberships (filter list_groups on members.value instead; for the reverse, a group's members, filter list_users on groups.value). To look a user up by userName rather than id, use list_users with an 'eq' filter.

• get_user_custom_security_attributesGet user Custom Security Attributesread-only

  Fetch Custom Security Attributes for a user, projected by attribute set. attributeSets is required — the API rejects the bare extension URN with a 400. CSAs never come back from a plain get_user; they are only returned when named explicitly here. A set the user holds no values in comes back empty, which is a valid answer rather than an error. Requires CustomSecAttributeAssignment.Read.All (covered by CustomSecAttributeAssignment.ReadWrite.All).

• list_groupsList groupsread-only

  List Entra groups via SCIM. Filter supports 'eq' on displayName/id/members.value/securityEnabled/mailEnabled/owners.value and 'ew' on displayName; only 'and' is supported. Cursor-based pagination. A members.value filter is the only way to discover which groups a user belongs to — neither get_user nor get_group reports membership. For the reverse, a group's members, use list_users filtered on groups.value.

• list_resource_typesList SCIM resource typesread-only

  List the SCIM resource types Entra supports (User, Group) and the schemas each one uses. Pass id to fetch a single type. Static per API version — cache it rather than re-fetching.

• list_schemasList SCIM schemasread-only

  List Entra SCIM schemas (core User, core Group, enterprise extension, Entra extensions, CustomSecurityAttributes) with each attribute's type, mutability and whether it is returned by default. Use it to check an attribute name or extension URN before building a patch path. Pass id to fetch a single schema. Static per API version — cache it rather than re-fetching. It describes the schema shape only: it does not list the tenant's Custom Security Attribute sets or their values.

• list_usersList usersread-only

  List Entra users via SCIM. Filter supports 'eq' on userName/externalId/id/active/groups.value/mailNickname/ownedGroups.value and 'ew' on userName/mailNickname, with not(...) allowed on 'ew' clauses; only 'and' combines them. Cursor-based pagination. This is also how you resolve a userName to an object id, since every other user tool takes the id, and how you list a group's direct members (groups.value eq "<groupId>") — get_group never returns them. Prefer a filter plus a narrow 'attributes' list over listing everything: each page is a separate billed request. An app granted only User.ReadBasic…

• provision_userProvision user

  Create a user in Entra via SCIM. Enforces the required attribute set: userName, password, displayName, givenName, familyName. mailNickname is optional — omit it and Entra derives it from userName. active defaults to true. Not idempotent — a second call with the same userName fails with a uniqueness conflict, so check with list_users first if a retry might be a duplicate. Group membership is not settable here: create the user, then call add_group_members.

• remove_group_memberRemove group membercan change or delete data

  Remove a single user from a group. The Entra SCIM API only allows one removal per PATCH call and no other ops in the same call, so removing several members means several calls. A 404 here does not mean the group is missing: the API answers "Resource '<groupId>' does not exist or one of its queried reference-property objects are not present" — naming the group, not the member — whenever the user is not a member, including when that user has been deleted. Confirm with list_groups filtered on members.value before concluding the group is gone.

• update_groupUpdate group attributescan change or delete data

  PATCH group attributes — e.g. { op: "replace", path: "displayName", value: "Platform Engineering" }, or the Entra extension URN ending in ":description". Membership changes are NOT allowed here: a "members" path is rejected client-side before any request is sent, so use add_group_members / remove_group_member instead. Group type flags (mailEnabled, securityEnabled) are fixed at creation and cannot be patched.

Signals

Stars

2

Forks

0

Open issues

0

Last commit

Oct 14, 2026 (17 days ago)

Last release

Oct 14, 2026 (17 days ago)

From GitHub (fetched Oct 24, 2026).

Details

Registry name

io.github.darrenjrobinson/entra-scim-mcp

Version

0.4.0

Auth

API key

Packages

npm entra-scim-mcp

License

MIT

Repository

github.com/darrenjrobinson/entra-scim-mcp

Website

github.com/darrenjrobinson/entra-scim-mcp#readme

First seen

Oct 24, 2026

Last checked

Oct 25, 2026

Source

Official MCP Registrygithub-graphql