Comece a usar o Microsoft MCP Server for Enterprise

Para começar a usar o Microsoft MCP Server para Empresas, você deve habilitá-lo em seu locatário. Atualmente, esse processo provisiona o MCP Server e o Visual Studio Code. Após o provisionamento, você pode configurar seu cliente MCP para se conectar ao servidor MCP.

Este artigo descreve como provisionar o servidor MCP e configurar o VS Code e os clientes MCP personalizados para se conectarem ao Microsoft MCP Server para Empresas.

Provisionar o servidor MCP e o VS Code (necessário apenas uma vez por locatário)

Inicie o PowerShell no modo Administrador e instale o Microsoft.Entra. Módulo beta do PowerShell (versão 1.0.13 ou posterior):
```
Install-Module Microsoft.Entra.Beta -Force -AllowClobber
```
Autentique-se no locatário em que você gostaria de registrar o servidor MCP. Você deve receber a função de Administrador de Aplicativos ou Administrador de Aplicativos de Nuvem para consentir com as permissões necessárias:
```
Connect-Entra -Scopes 'Application.ReadWrite.All', 'Directory.Read.All', 'DelegatedPermissionGrant.ReadWrite.All'
```
Dica

Executar Get-EntraContext após autenticação para confirmar a conta, o locatário e os escopos atualmente em uso.
Registre o Microsoft MCP Server for Enterprise em seu locatário e conceda todas as permissões ao Visual Studio Code:
```
Grant-EntraBetaMCPServerPermission -ApplicationName VisualStudioCode
```

Confirmar o registro do servidor MCP

Verifique se ambos os aplicativos existem usando o Microsoft Graph, o Microsoft Entra PowerShell ou o portal do Microsoft Entra.

Nome	AppId globalmente exclusivo (ID do cliente)
Microsoft MCP Server para Empresas	`e8c77dc2-69b3-43f4-bc51-3213c9d915b4`
Visual Studio Code	`aebc6443-996d-45c2-90f0-388ff96faa56`

GET https://graph.microsoft.com/v1.0/servicePrincipals?$select=id,appId,displayName&$filter=appId in('e8c77dc2-69b3-43f4-bc51-3213c9d915b4','aebc6443-996d-45c2-90f0-388ff96faa56')


// Code snippets are only available for the latest version. Current version is 5.x

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.ServicePrincipals.GetAsync((requestConfiguration) =>
{
	requestConfiguration.QueryParameters.Select = new string []{ "id","appId","displayName" };
	requestConfiguration.QueryParameters.Filter = "appId in('e8c77dc2-69b3-43f4-bc51-3213c9d915b4','aebc6443-996d-45c2-90f0-388ff96faa56')";
});



// Code snippets are only available for the latest major version. Current major version is $v1.*

// Dependencies
import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
	  graphserviceprincipals "github.com/microsoftgraph/msgraph-sdk-go/serviceprincipals"
	  //other-imports
)


requestFilter := "appId in('e8c77dc2-69b3-43f4-bc51-3213c9d915b4','aebc6443-996d-45c2-90f0-388ff96faa56')"

requestParameters := &graphserviceprincipals.ServicePrincipalsRequestBuilderGetQueryParameters{
	Select: [] string {"id","appId","displayName"},
	Filter: &requestFilter,
}
configuration := &graphserviceprincipals.ServicePrincipalsRequestBuilderGetRequestConfiguration{
	QueryParameters: requestParameters,
}

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
servicePrincipals, err := graphClient.ServicePrincipals().Get(context.Background(), configuration)


// Code snippets are only available for the latest version. Current version is 6.x

GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);

ServicePrincipalCollectionResponse result = graphClient.servicePrincipals().get(requestConfiguration -> {
	requestConfiguration.queryParameters.select = new String []{"id", "appId", "displayName"};
	requestConfiguration.queryParameters.filter = "appId in('e8c77dc2-69b3-43f4-bc51-3213c9d915b4','aebc6443-996d-45c2-90f0-388ff96faa56')";
});


const options = {
	authProvider,
};

const client = Client.init(options);

let servicePrincipals = await client.api('/servicePrincipals')
	.filter('appId in(\'e8c77dc2-69b3-43f4-bc51-3213c9d915b4\',\'aebc6443-996d-45c2-90f0-388ff96faa56\')')
	.select('id,appId,displayName')
	.get();


<?php
use Microsoft\Graph\GraphServiceClient;
use Microsoft\Graph\Generated\ServicePrincipals\ServicePrincipalsRequestBuilderGetRequestConfiguration;


$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);

$requestConfiguration = new ServicePrincipalsRequestBuilderGetRequestConfiguration();
$queryParameters = ServicePrincipalsRequestBuilderGetRequestConfiguration::createQueryParameters();
$queryParameters->select = ["id","appId","displayName"];
$queryParameters->filter = "appId in('e8c77dc2-69b3-43f4-bc51-3213c9d915b4','aebc6443-996d-45c2-90f0-388ff96faa56')";
$requestConfiguration->queryParameters = $queryParameters;


$result = $graphServiceClient->servicePrincipals()->get($requestConfiguration)->wait();


Import-Module Microsoft.Graph.Applications

Get-MgServicePrincipal -Property "id,appId,displayName" -Filter "appId in('e8c77dc2-69b3-43f4-bc51-3213c9d915b4','aebc6443-996d-45c2-90f0-388ff96faa56')"


# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
from msgraph.generated.service_principals.service_principals_request_builder import ServicePrincipalsRequestBuilder
from kiota_abstractions.base_request_configuration import RequestConfiguration
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
query_params = ServicePrincipalsRequestBuilder.ServicePrincipalsRequestBuilderGetQueryParameters(
		select = ["id","appId","displayName"],
		filter = "appId in('e8c77dc2-69b3-43f4-bc51-3213c9d915b4','aebc6443-996d-45c2-90f0-388ff96faa56')",
)

request_configuration = RequestConfiguration(
query_parameters = query_params,
)

result = await graph_client.service_principals.get(request_configuration = request_configuration)

Confirme as permissões concedidas aos seus clientes MCP

Valide as permissões do Microsoft MCP Server que foram concedidas a cada cliente MCP.

GET https://graph.microsoft.com/v1.0/oauth2PermissionGrants?$select=id,clientId,resourceId,scope&$filter=clientId eq '{mcp-client-servicePrincipal}' and resourceId eq '{mcp-server-servicePrincipal}'


// Code snippets are only available for the latest version. Current version is 5.x

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Oauth2PermissionGrants.GetAsync((requestConfiguration) =>
{
	requestConfiguration.QueryParameters.Select = new string []{ "id","clientId","resourceId","scope" };
	requestConfiguration.QueryParameters.Filter = "clientId eq '{mcp-client-servicePrincipal}' and resourceId eq '{mcp-server-servicePrincipal}'";
});



// Code snippets are only available for the latest major version. Current major version is $v1.*

// Dependencies
import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
	  graphoauth2permissiongrants "github.com/microsoftgraph/msgraph-sdk-go/oauth2permissiongrants"
	  //other-imports
)


requestFilter := "clientId eq '{mcp-client-servicePrincipal}' and resourceId eq '{mcp-server-servicePrincipal}'"

requestParameters := &graphoauth2permissiongrants.Oauth2PermissionGrantsRequestBuilderGetQueryParameters{
	Select: [] string {"id","clientId","resourceId","scope"},
	Filter: &requestFilter,
}
configuration := &graphoauth2permissiongrants.Oauth2PermissionGrantsRequestBuilderGetRequestConfiguration{
	QueryParameters: requestParameters,
}

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
oauth2PermissionGrants, err := graphClient.Oauth2PermissionGrants().Get(context.Background(), configuration)


// Code snippets are only available for the latest version. Current version is 6.x

GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);

OAuth2PermissionGrantCollectionResponse result = graphClient.oauth2PermissionGrants().get(requestConfiguration -> {
	requestConfiguration.queryParameters.select = new String []{"id", "clientId", "resourceId", "scope"};
	requestConfiguration.queryParameters.filter = "clientId eq '{mcp-client-servicePrincipal}' and resourceId eq '{mcp-server-servicePrincipal}'";
});


const options = {
	authProvider,
};

const client = Client.init(options);

let oauth2PermissionGrants = await client.api('/oauth2PermissionGrants')
	.filter('clientId eq \'{mcp-client-servicePrincipal}\' and resourceId eq \'{mcp-server-servicePrincipal}\'')
	.select('id,clientId,resourceId,scope')
	.get();


<?php
use Microsoft\Graph\GraphServiceClient;
use Microsoft\Graph\Generated\Oauth2PermissionGrants\Oauth2PermissionGrantsRequestBuilderGetRequestConfiguration;


$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);

$requestConfiguration = new Oauth2PermissionGrantsRequestBuilderGetRequestConfiguration();
$queryParameters = Oauth2PermissionGrantsRequestBuilderGetRequestConfiguration::createQueryParameters();
$queryParameters->select = ["id","clientId","resourceId","scope"];
$queryParameters->filter = "clientId eq '{mcp-client-servicePrincipal}' and resourceId eq '{mcp-server-servicePrincipal}'";
$requestConfiguration->queryParameters = $queryParameters;


$result = $graphServiceClient->oauth2PermissionGrants()->get($requestConfiguration)->wait();


Import-Module Microsoft.Graph.Identity.SignIns

Get-MgOauth2PermissionGrant -Property "id,clientId,resourceId,scope" -Filter "clientId eq '{mcp-client-servicePrincipal}' and resourceId eq '{mcp-server-servicePrincipal}'"


# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
from msgraph.generated.oauth2_permission_grants.oauth2_permission_grants_request_builder import Oauth2PermissionGrantsRequestBuilder
from kiota_abstractions.base_request_configuration import RequestConfiguration
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
query_params = Oauth2PermissionGrantsRequestBuilder.Oauth2PermissionGrantsRequestBuilderGetQueryParameters(
		select = ["id","clientId","resourceId","scope"],
		filter = "clientId eq '{mcp-client-servicePrincipal}' and resourceId eq '{mcp-server-servicePrincipal}'",
)

request_configuration = RequestConfiguration(
query_parameters = query_params,
)

result = await graph_client.oauth2_permission_grants.get(request_configuration = request_configuration)

Clique em Instalar o Microsoft MCP Server para Empresas para abrir a página de instalação do MCP do VS Code.
Selecione Instalar no VS Code e autentique com uma conta de administrador.
Abra o Copilot Chat no modo de Agente e faça uma pergunta específica do locatário, como "Quantos usuários há no meu locatário?"
1. Examine a resposta do MCP Server, que inclui:
  1. As ferramentas que foram invocadas para entender a intenção.
  2. A chamada à API REST do Microsoft Graph que foi executada.
  3. Uma resposta em linguagem natural que resume os dados do locatário.

Entre no centro de administração do Microsoft Entra com uma conta que possa registrar aplicativos (as funções de Administrador de Aplicativos ou Administrador de Aplicativos de Nuvem são suficientes).
Registre um aplicativo e considere as seguintes configurações:
1. Nome do aplicativo.
2. Tipos de conta com suporte (locatário único).
3. Plataforma e URI de redirecionamento para seu cliente MCP.
Registre a ID do aplicativo (cliente) e a ID do diretório (locatário) para configuração posterior.
Para conceder permissões:
1. Selecione Permissões delegadas e adicione os escopos que correspondem ao seu cenário (por exemplo, adicionar MCP.User.Read.All para contar os usuários no locatário).
2. Dê consentimento de administrador para as permissões delegadas que você adicionou.
Teste seu cliente MCP para confirmar se ele pode se conectar ao Microsoft MCP Server for Enterprise e concluir as operações necessárias.

Gerenciar escopos para clientes MCP personalizados usando o Microsoft Entra PowerShell:

Grant-EntraBetaMCPServerPermission -ApplicationId "<MCP_Client_Application_Id>" -Scopes "<Scope1>", "<Scope2>", "<...>"
Revoke-EntraBetaMCPServerPermission -ApplicationId "<MCP_Client_Application_Id>" -Scopes "<Scope1>", "<Scope2>", "<...>"

Exibir escopos do MCP Server compatíveis

O servidor MCP dá suporte apenas a permissões delegadas para cenários interativos do usuário. Não há suporte para permissões somente de aplicativo ou fluxos de trabalho somente de aplicativo. Use uma das opções a seguir (requer pelo menos a DelegatedPermissionGrant.Read.All permissão delegada) para inspecionar os escopos MCP disponíveis e concentre-se nos escopos em que isEnabled está true.

Microsoft Graph – listar escopos de MCP

GET https://graph.microsoft.com/v1.0/servicePrincipals(appId='e8c77dc2-69b3-43f4-bc51-3213c9d915b4')/oauth2PermissionScopes

Lista de escopos do servidor MCP

A nomenclatura dos escopos MCP segue o padrão MCP.{microsoft-graph-scope-name}. Por exemplo, o escopo User.Read.All do Microsoft Graph é exposto como MCP.User.Read.All no servidor MCP. Para entender o que cada escopo permite, consulte a referência de permissões do Microsoft Graph.

MCP. AccessReview.Read.All
MCP. AdministrativeUnit.Read.All
MCP. Application.Read.All
MCP. AuditLog.Read.All
MCP. AuthenticationContext.Read.All
MCP. DelegatedPermissionGrant.Read.All
MCP. Device.Read.All
MCP. DirectoryRecommendations.Read.All
MCP. Domain.Read.All
MCP. EntitlementManagement.Read.All
MCP. Group.Read.All
MCP. GroupMember.Read.All
MCP. GroupSettings.Read.All
MCP. HealthMonitoringAlert.Read.All
MCP. IdentityRiskEvent.Read.All
MCP. IdentityRiskyServicePrincipal.Read.All
MCP. IdentityRiskyUser.Read.All
MCP. LicenseAssignment.Read.All
MCP. LifecycleWorkflows.Read.All
MCP. LifecycleWorkflows-CustomExt.Read.All
MCP. LifecycleWorkflows-Reports.Read.All
MCP. LifecycleWorkflows-Workflow.Read.All
MCP. LifecycleWorkflows-Workflow.ReadBasic.All
MCP. NetworkAccess.Read.All
MCP. NetworkAccess-Reports.Read.All
MCP. Organization.Read.All
MCP. OrgContact.Read.All
MCP. Policy.Read.All
MCP. Policy.Read.ConditionalAccess
MCP. ProvisioningLog.Read.All
MCP. Reports.Read.All
MCP. RoleAssignmentSchedule.Read.Directory
MCP. RoleEligibilitySchedule.Read.Directory
MCP. RoleManagement.Read.Directory
MCP. SecurityAlert.Read.All
MCP. SecurityIncident.Read.All
MCP. ServiceHealth.Read.All
MCP. ServiceMessage.Read.All
MCP. Synchronization.Read.All
MCP. User.Read.All
MCP. UserAuthenticationMethod.Read.All

Desabilitar o MCP Server para Empresas

Como o MCP Server for Enterprise é um serviço de propriedade da Microsoft, você não pode excluí-lo do locatário. No entanto, você pode desativá-la, se necessário.

Microsoft Graph - desabilitar o servidor MCP

PATCH https://graph.microsoft.com/v1.0/servicePrincipals(appId='e8c77dc2-69b3-43f4-bc51-3213c9d915b4')
{
  "accountEnabled": false
}

Comentários

Esta página foi útil?

Last updated on 2026-08-24