Lokka (Microsoft 365 MCP server)
About
A server for the Microsoft Graph and Azure RM APIs to manage Azure and Microsoft 365 tenants with AI.
Details
- Author
- merill
- Downloads
- 708
- Categories
- Cloud Service, Other, Infrastructure, API, Security
Jump to
- Natural language queries to the Microsoft Graph API
- Works with any MCP‑compatible client (e.g., Claude Desktop)
- Secure app‑only authentication via Entra ID
- Customizable permissions per MCP tool
- Manages users, groups, policies, and Intune devices
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Lokka (Microsoft 365 MCP server)Command (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Install Node.js, clone the Lokka GitHub repository, create an Entra application with appropriate Microsoft Graph application permissions, and generate a client secret. Build the project with npm install and npm run build, then configure your MCP client’s JSON file with the absolute path to build/main.js and the tenant ID, client ID, and client secret environment variables.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"lokka (microsoft 365 mcp server)": {
"lokka": {
"command": "node",
"args": [
"<absolute-path-to-main.js>/src/mcp/build/main.js"
],
"env": {
"TENANT_ID": "",
"CLIENT_ID": "",
"CLIENT_SECRET": ""
}
}
}
}
}McpServers
{
"lokka": {
"command": "node",
"args": [
"<absolute-path-to-main.js>/src/mcp/build/main.js"
],
"env": {
"TENANT_ID": "",
"CLIENT_ID": "",
"CLIENT_SECRET": ""
}
}
}Lokka is a model-context-protocol server for the Microsoft Graph and Azure RM APIs that allows you to query and manage your Azure and Microsoft 365 tenants with AI.
Please seeLokka.devfor how to use Lokka with your favorite AI model and chat client.
Lokka lets you use Claude Desktop, or any MCP Client, to use natural language to accomplish things in your Azure and Microsoft 365 tenant through the Microsoft APIs.
- Create a new security group called 'Sales and HR' with a dynamic rule based on the department attribute.
- Find all the conditional access policies that haven't excluded the emergency access account
- Show me all the Intune device configuration policies assigned to the 'Call center' group
- What was the most expensive service in Azure last month?
Lokka now supports multiple authentication methods to accommodate different deployment scenarios:
For user-based authentication with interactive login, you can use the following configuration:
This is the simplest config and uses the default Lokka app.
{ "mcpServers": { "Lokka-Microsoft": { "command": "npx", "args": ["-y", "@merill/lokka"] } } }
If you wish to use a custom Microsoft Entra app, you can create a new app registration in Microsoft Entra and configure it with the following environment variables:
{ "mcpServers": { "Lokka-Microsoft": { "command": "npx", "args": ["-y", "@merill/lokka"], "env": { "TENANT_ID": "<tenant-id>", "CLIENT_ID": "<client-id>", "USE_INTERACTIVE": "true" } } } }
Traditional app-only authentication. You can use either certificate (recommended) or client secret authentication with the following configuration.
SeeInstall Guidefor more details on how to create an Entra app.
App only authentication using a PEM-encoded client certificate:
{ "mcpServers": { "Lokka-Microsoft": { "command": "npx", "args": ["-y", "@merill/lokka"], "env": { "TENANT_ID": "<tenant-id>", "CLIENT_ID": "<client-id>", "CERTIFICATE_PATH": "/path/to/certificate.pem", "CERTIFICATE_PASSWORD": "<optional-certificate-password>", "USE_CERTIFICATE": "true" } } } }
For comfort, in order to convert a PFX client certificate to a PEM-encoded certificate:
openssl pkcs12 -in /path/to/cert.pfx -out /path/to/cert.pem -nodes -clcerts
{ "mcpServers": { "Lokka-Microsoft": { "command": "npx", "args": ["-y", "@merill/lokka"], "env": { "TENANT_ID": "<tenant-id>", "CLIENT_ID": "<client-id>", "CLIENT_SECRET": "<client-secret>" } } } }
Token-based authentication where the MCP Client provides access tokens:
{ "mcpServers": { "Lokka-Microsoft": { "command": "npx", "args": ["-y", "@merill/lokka"], "env": { "USE_CLIENT_TOKEN": "true" } } } }
- Start the MCP server withUSE_CLIENT_TOKEN=true
- Use theset-access-tokentool to provide a valid Microsoft Graph access token
- Use theget-auth-statustool to verify authentication status
- Refresh tokens as needed usingset-access-token
- set-access-token: Set or update access tokens for Microsoft Graph authentication
- get-auth-status: Check current authentication status and capabilities
- add-graph-permission: Request additional Microsoft Graph permission scopes interactively
Lokka now supports controlling the default Microsoft Graph API version used for all requests:
- Default behavior: Usesbetaversion for access to latest features
- Production mode: SetUSE_GRAPH_BETA=falseto force all requests to usev1.0version
- Per-request override: You can still specifygraphApiVersionparameter in individual requests (unlessUSE_GRAPH_BETA=false)
WhenUSE_GRAPH_BETA=false, all Graph API calls will use the stablev1.0version, even ifbetais explicitly requested in thegraphApiVersionparameter.
See the docs for more information on how to install and configure Lokka.
- Introduction
- Install guide
- Developer guide
- Call Microsoft Graph & Azure APIs. Supports querying Azure and Microsoft 365 tenants. Updates are also supported if permissions are provided.
- Input:
- apiType(string): Type of Microsoft API to query. Options: 'graph' for Microsoft Graph (Entra) or 'azure' for Azure Resource Management.
- path(string): The Azure or Graph API URL path to call (e.g. '/users', '/groups', '/subscriptions').
- method(string): HTTP method to use (e.g., get, post, put, patch, delete)
- apiVersion(string): Azure Resource Management API version (required for apiType Azure)
- subscriptionId(string): Azure Subscription ID (for Azure Resource Management).
- queryParams(string): Array of query parameters like $filter, $select, etc. All parameters are strings.
- body(JSON): The request body (for POST, PUT, PATCH)
- Set or update an access token for Microsoft Graph authentication when using client-provided token mode.
- Input:
- accessToken(string): The access token obtained from Microsoft Graph authentication
- expiresOn(string, optional): Token expiration time in ISO format
- Check the current authentication status and mode of the MCP Server
- Returns: Authentication mode, readiness status, and capabilities
The configuration of the server is done using environment variables. The following environment variables are supported:
- Interactive and Token-based Authentication (v0.2.0) -@darrenjrobinson
- Certificate Authentication (v0.2.1) -@nitzpo
To use this server with the Claude Desktop app, add the following configuration to the "mcpServers" section of yourclaude_desktop_config.json:
{ "mcpServers": { "Lokka-Microsoft": { "command": "npx", "args": ["-y", "@merill/lokka"] } } }
{ "mcpServers": { "Lokka-Microsoft": { "command": "npx", "args": ["-y", "@merill/lokka"], "env": { "TENANT_ID": "<tenant-id>", "CLIENT_ID": "<client-id>", "CLIENT_SECRET": "<client-secret>" } } } }
Make sure to replace<tenant-id>,<client-id>, and<client-secret>with the actual values from your Microsoft Entra application. (SeeInstall Guidefor more details on how to create an Entra app and configure the agent.)
Query Azure retail pricing information using the Azure Retail Prices API.
Manage Azure Cloud PCs using the Microsoft Graph API.
A RESTful API to programmatically interact with the Opal Security platform.
Manage and interact with Microsoft Azure services.
Automate Akamai resource actions using a conversational AI client. Requires Akamai API credentials.
Enables AI assistants to interact with Azure Kubernetes Service (AKS) clusters.
Interact with and manage Azure services using natural language.
Integrate with Apache CloudStack to manage cloud resources directly from your desktop.
Integrates with the Cloudways API, allowing AI assistants to access and manage Cloudways infrastructure.
Interact with Confluent Cloud REST APIs to manage Kafka clusters, topics, and data.
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
