Microsoft Entra SCIM 2.0 Provisioning API: user and group lifecycle, with a local mock.
Connect Runs on your machine
claude mcp add entra-scim-mcp -e ENTRA_TENANT_ID=<ENTRA_TENANT_ID> -e ENTRA_CLIENT_ID=<ENTRA_CLIENT_ID> -e ENTRA_CLIENT_SECRET=<ENTRA_CLIENT_SECRET> -e ENTRA_CLIENT_CERT_PATH=<ENTRA_CLIENT_CERT_PATH> -e ENTRA_CLIENT_CERT_PASSWORD=<ENTRA_CLIENT_CERT_PASSWORD> -e ENTRA_SCIM_BASE_URL=<ENTRA_SCIM_BASE_URL> -e ENTRA_SCIM_STATIC_TOKEN=<ENTRA_SCIM_STATIC_TOKEN> -e ENTRA_SCIM_DRY_RUN=<ENTRA_SCIM_DRY_RUN> -- npx -y [email protected]{
"mcpServers": {
"entra-scim-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"ENTRA_TENANT_ID": "<ENTRA_TENANT_ID>",
"ENTRA_CLIENT_ID": "<ENTRA_CLIENT_ID>",
"ENTRA_CLIENT_SECRET": "<ENTRA_CLIENT_SECRET>",
"ENTRA_CLIENT_CERT_PATH": "<ENTRA_CLIENT_CERT_PATH>",
"ENTRA_CLIENT_CERT_PASSWORD": "<ENTRA_CLIENT_CERT_PASSWORD>",
"ENTRA_SCIM_BASE_URL": "<ENTRA_SCIM_BASE_URL>",
"ENTRA_SCIM_STATIC_TOKEN": "<ENTRA_SCIM_STATIC_TOKEN>",
"ENTRA_SCIM_DRY_RUN": "<ENTRA_SCIM_DRY_RUN>"
}
}
}
}{
"mcpServers": {
"entra-scim-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"ENTRA_TENANT_ID": "<ENTRA_TENANT_ID>",
"ENTRA_CLIENT_ID": "<ENTRA_CLIENT_ID>",
"ENTRA_CLIENT_SECRET": "<ENTRA_CLIENT_SECRET>",
"ENTRA_CLIENT_CERT_PATH": "<ENTRA_CLIENT_CERT_PATH>",
"ENTRA_CLIENT_CERT_PASSWORD": "<ENTRA_CLIENT_CERT_PASSWORD>",
"ENTRA_SCIM_BASE_URL": "<ENTRA_SCIM_BASE_URL>",
"ENTRA_SCIM_STATIC_TOKEN": "<ENTRA_SCIM_STATIC_TOKEN>",
"ENTRA_SCIM_DRY_RUN": "<ENTRA_SCIM_DRY_RUN>"
}
}
}
}{
"servers": {
"entra-scim-mcp": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"ENTRA_TENANT_ID": "<ENTRA_TENANT_ID>",
"ENTRA_CLIENT_ID": "<ENTRA_CLIENT_ID>",
"ENTRA_CLIENT_SECRET": "<ENTRA_CLIENT_SECRET>",
"ENTRA_CLIENT_CERT_PATH": "<ENTRA_CLIENT_CERT_PATH>",
"ENTRA_CLIENT_CERT_PASSWORD": "<ENTRA_CLIENT_CERT_PASSWORD>",
"ENTRA_SCIM_BASE_URL": "<ENTRA_SCIM_BASE_URL>",
"ENTRA_SCIM_STATIC_TOKEN": "<ENTRA_SCIM_STATIC_TOKEN>",
"ENTRA_SCIM_DRY_RUN": "<ENTRA_SCIM_DRY_RUN>"
}
}
}
}Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.
Tools
This server runs locally, so its tools are listed by your MCP client once it starts.
Environment variables
| Name | Description |
|---|---|
ENTRA_TENANT_IDOptional | Directory (tenant) GUID. Required to authenticate against a live tenant; not needed for ENTRA_SCIM_DRY_RUN or ENTRA_SCIM_STATIC_TOKEN, which supply their own placeholder. |
ENTRA_CLIENT_IDOptional | App registration (client) GUID. Required to authenticate against a live tenant; not needed for ENTRA_SCIM_DRY_RUN or ENTRA_SCIM_STATIC_TOKEN. |
ENTRA_CLIENT_SECRETOptional, secret | Client secret value. For a live tenant set exactly one of ENTRA_CLIENT_SECRET or ENTRA_CLIENT_CERT_PATH; a certificate is preferred for anything long-lived. |
ENTRA_CLIENT_CERT_PATHOptional | Path to a PEM holding the certificate and its private key. Set exactly one of ENTRA_CLIENT_SECRET or ENTRA_CLIENT_CERT_PATH. |
ENTRA_CLIENT_CERT_PASSWORDOptional, secret | Password for the PEM, if it is encrypted. |
ENTRA_SCIM_BASE_URLOptional | Override the SCIM base URL (default https://graph.microsoft.com/rp/scim). Point it at the bundled mock to try the tools without a tenant. |
ENTRA_SCIM_STATIC_TOKENOptional, secret | Use a fixed bearer token instead of Azure AD. Refuses any microsoft.com/microsoft.us host and requires ENTRA_SCIM_BASE_URL; intended for the local mock only. |
ENTRA_SCIM_DRY_RUNOptional | Set to 1 to run every client-side validation and return the request that would have been sent, without sending it or acquiring a token. |
Details
| Package | [email protected] (NPM, stdio) |
| First published | 14 Oct 2026 |
| Last updated | 14 Oct 2026 |
| Registry name | io.github.darrenjrobinson/entra-scim-mcp |
More other servers See all
Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.