Introducción a Microsoft MCP Server for Enterprise

Para empezar a usar Microsoft MCP Server for Enterprise, debe habilitarlo en el inquilino. Actualmente, este proceso aprovisiona el servidor MCP y Visual Studio Code. Después del aprovisionamiento, puede configurar el cliente MCP para conectarse al servidor MCP.

En este artículo se describe cómo aprovisionar el servidor MCP y configurar tanto VS Code como clientes MCP personalizados para conectarse a Microsoft MCP Server for Enterprise.

Aprovisionar el servidor MCP y VS Code (solo se requiere una vez por inquilino)

Inicie PowerShell en modo de administrador e instale Microsoft.Entra. Módulo beta de PowerShell (versión 1.0.13 o posterior):
```
Install-Module Microsoft.Entra.Beta -Force -AllowClobber
```
Autentíquese en el inquilino donde desea registrar el servidor MCP. Debe tener asignado el rol Administrador de aplicaciones o Administrador de aplicaciones en la nube para dar su consentimiento a los permisos necesarios:
```
Connect-Entra -Scopes 'Application.ReadWrite.All', 'Directory.Read.All', 'DelegatedPermissionGrant.ReadWrite.All'
```
Sugerencia

Ejecute Get-EntraContext después de la autenticación para confirmar la cuenta, el inquilino y los ámbitos actualmente en uso.
Registre Microsoft MCP Server for Enterprise en el inquilino y conceda todos los permisos para Visual Studio Code:
```
Grant-EntraBetaMCPServerPermission -ApplicationName VisualStudioCode
```

Confirmación del registro del servidor MCP

Compruebe que ambas aplicaciones existen mediante Microsoft Graph, Microsoft Entra PowerShell o el portal de Microsoft Entra.

Nombre	AppId único globalmente (id. de cliente)
Microsoft MCP Server for Enterprise	`e8c77dc2-69b3-43f4-bc51-3213c9d915b4`
Visual Studio Code	`aebc6443-996d-45c2-90f0-388ff96faa56`

GET https://graph.microsoft.com/v1.0/servicePrincipals?$select=id,appId,displayName&$filter=appId in('e8c77dc2-69b3-43f4-bc51-3213c9d915b4','aebc6443-996d-45c2-90f0-388ff96faa56')


// Code snippets are only available for the latest version. Current version is 5.x

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.ServicePrincipals.GetAsync((requestConfiguration) =>
{
	requestConfiguration.QueryParameters.Select = new string []{ "id","appId","displayName" };
	requestConfiguration.QueryParameters.Filter = "appId in('e8c77dc2-69b3-43f4-bc51-3213c9d915b4','aebc6443-996d-45c2-90f0-388ff96faa56')";
});



// Code snippets are only available for the latest major version. Current major version is $v1.*

// Dependencies
import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
	  graphserviceprincipals "github.com/microsoftgraph/msgraph-sdk-go/serviceprincipals"
	  //other-imports
)


requestFilter := "appId in('e8c77dc2-69b3-43f4-bc51-3213c9d915b4','aebc6443-996d-45c2-90f0-388ff96faa56')"

requestParameters := &graphserviceprincipals.ServicePrincipalsRequestBuilderGetQueryParameters{
	Select: [] string {"id","appId","displayName"},
	Filter: &requestFilter,
}
configuration := &graphserviceprincipals.ServicePrincipalsRequestBuilderGetRequestConfiguration{
	QueryParameters: requestParameters,
}

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
servicePrincipals, err := graphClient.ServicePrincipals().Get(context.Background(), configuration)


// Code snippets are only available for the latest version. Current version is 6.x

GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);

ServicePrincipalCollectionResponse result = graphClient.servicePrincipals().get(requestConfiguration -> {
	requestConfiguration.queryParameters.select = new String []{"id", "appId", "displayName"};
	requestConfiguration.queryParameters.filter = "appId in('e8c77dc2-69b3-43f4-bc51-3213c9d915b4','aebc6443-996d-45c2-90f0-388ff96faa56')";
});


const options = {
	authProvider,
};

const client = Client.init(options);

let servicePrincipals = await client.api('/servicePrincipals')
	.filter('appId in(\'e8c77dc2-69b3-43f4-bc51-3213c9d915b4\',\'aebc6443-996d-45c2-90f0-388ff96faa56\')')
	.select('id,appId,displayName')
	.get();


<?php
use Microsoft\Graph\GraphServiceClient;
use Microsoft\Graph\Generated\ServicePrincipals\ServicePrincipalsRequestBuilderGetRequestConfiguration;


$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);

$requestConfiguration = new ServicePrincipalsRequestBuilderGetRequestConfiguration();
$queryParameters = ServicePrincipalsRequestBuilderGetRequestConfiguration::createQueryParameters();
$queryParameters->select = ["id","appId","displayName"];
$queryParameters->filter = "appId in('e8c77dc2-69b3-43f4-bc51-3213c9d915b4','aebc6443-996d-45c2-90f0-388ff96faa56')";
$requestConfiguration->queryParameters = $queryParameters;


$result = $graphServiceClient->servicePrincipals()->get($requestConfiguration)->wait();


Import-Module Microsoft.Graph.Applications

Get-MgServicePrincipal -Property "id,appId,displayName" -Filter "appId in('e8c77dc2-69b3-43f4-bc51-3213c9d915b4','aebc6443-996d-45c2-90f0-388ff96faa56')"


# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
from msgraph.generated.service_principals.service_principals_request_builder import ServicePrincipalsRequestBuilder
from kiota_abstractions.base_request_configuration import RequestConfiguration
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
query_params = ServicePrincipalsRequestBuilder.ServicePrincipalsRequestBuilderGetQueryParameters(
		select = ["id","appId","displayName"],
		filter = "appId in('e8c77dc2-69b3-43f4-bc51-3213c9d915b4','aebc6443-996d-45c2-90f0-388ff96faa56')",
)

request_configuration = RequestConfiguration(
query_parameters = query_params,
)

result = await graph_client.service_principals.get(request_configuration = request_configuration)

Confirmación de los permisos concedidos a los clientes mcp

Valide los permisos de Microsoft MCP Server que se concedieron a cada cliente MCP.

GET https://graph.microsoft.com/v1.0/oauth2PermissionGrants?$select=id,clientId,resourceId,scope&$filter=clientId eq '{mcp-client-servicePrincipal}' and resourceId eq '{mcp-server-servicePrincipal}'


// Code snippets are only available for the latest version. Current version is 5.x

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Oauth2PermissionGrants.GetAsync((requestConfiguration) =>
{
	requestConfiguration.QueryParameters.Select = new string []{ "id","clientId","resourceId","scope" };
	requestConfiguration.QueryParameters.Filter = "clientId eq '{mcp-client-servicePrincipal}' and resourceId eq '{mcp-server-servicePrincipal}'";
});



// Code snippets are only available for the latest major version. Current major version is $v1.*

// Dependencies
import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
	  graphoauth2permissiongrants "github.com/microsoftgraph/msgraph-sdk-go/oauth2permissiongrants"
	  //other-imports
)


requestFilter := "clientId eq '{mcp-client-servicePrincipal}' and resourceId eq '{mcp-server-servicePrincipal}'"

requestParameters := &graphoauth2permissiongrants.Oauth2PermissionGrantsRequestBuilderGetQueryParameters{
	Select: [] string {"id","clientId","resourceId","scope"},
	Filter: &requestFilter,
}
configuration := &graphoauth2permissiongrants.Oauth2PermissionGrantsRequestBuilderGetRequestConfiguration{
	QueryParameters: requestParameters,
}

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
oauth2PermissionGrants, err := graphClient.Oauth2PermissionGrants().Get(context.Background(), configuration)


// Code snippets are only available for the latest version. Current version is 6.x

GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);

OAuth2PermissionGrantCollectionResponse result = graphClient.oauth2PermissionGrants().get(requestConfiguration -> {
	requestConfiguration.queryParameters.select = new String []{"id", "clientId", "resourceId", "scope"};
	requestConfiguration.queryParameters.filter = "clientId eq '{mcp-client-servicePrincipal}' and resourceId eq '{mcp-server-servicePrincipal}'";
});


const options = {
	authProvider,
};

const client = Client.init(options);

let oauth2PermissionGrants = await client.api('/oauth2PermissionGrants')
	.filter('clientId eq \'{mcp-client-servicePrincipal}\' and resourceId eq \'{mcp-server-servicePrincipal}\'')
	.select('id,clientId,resourceId,scope')
	.get();


<?php
use Microsoft\Graph\GraphServiceClient;
use Microsoft\Graph\Generated\Oauth2PermissionGrants\Oauth2PermissionGrantsRequestBuilderGetRequestConfiguration;


$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);

$requestConfiguration = new Oauth2PermissionGrantsRequestBuilderGetRequestConfiguration();
$queryParameters = Oauth2PermissionGrantsRequestBuilderGetRequestConfiguration::createQueryParameters();
$queryParameters->select = ["id","clientId","resourceId","scope"];
$queryParameters->filter = "clientId eq '{mcp-client-servicePrincipal}' and resourceId eq '{mcp-server-servicePrincipal}'";
$requestConfiguration->queryParameters = $queryParameters;


$result = $graphServiceClient->oauth2PermissionGrants()->get($requestConfiguration)->wait();


Import-Module Microsoft.Graph.Identity.SignIns

Get-MgOauth2PermissionGrant -Property "id,clientId,resourceId,scope" -Filter "clientId eq '{mcp-client-servicePrincipal}' and resourceId eq '{mcp-server-servicePrincipal}'"


# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
from msgraph.generated.oauth2_permission_grants.oauth2_permission_grants_request_builder import Oauth2PermissionGrantsRequestBuilder
from kiota_abstractions.base_request_configuration import RequestConfiguration
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
query_params = Oauth2PermissionGrantsRequestBuilder.Oauth2PermissionGrantsRequestBuilderGetQueryParameters(
		select = ["id","clientId","resourceId","scope"],
		filter = "clientId eq '{mcp-client-servicePrincipal}' and resourceId eq '{mcp-server-servicePrincipal}'",
)

request_configuration = RequestConfiguration(
query_parameters = query_params,
)

result = await graph_client.oauth2_permission_grants.get(request_configuration = request_configuration)

Haga clic en Instalar Microsoft MCP Server for Enterprise para abrir la página de instalación de MCP de VS Code.
Seleccione Instalar en VS Code y autentíquese con una cuenta de administrador.
Abra Copilot Chat en modo agente y haga una pregunta específica del inquilino, como "¿Cuántos usuarios hay en mi inquilino?"
1. Revise la respuesta del servidor MCP, que incluye:
  1. Herramientas que se invocaron para comprender la intención.
  2. Llamada a la API REST de Microsoft Graph que se ejecutó.
  3. Una respuesta de lenguaje natural que resume los datos del inquilino.

Inicie sesión en el Centro de administración Microsoft Entra con una cuenta que pueda registrar aplicaciones (los roles Administrador de aplicaciones o Administrador de aplicaciones en la nube son suficientes).
Registre una aplicación y tenga en cuenta la siguiente configuración:
1. Nombre de la aplicación.
2. Tipos de cuenta admitidos (inquilino único).
3. Plataforma y URI de redireccionamiento para el cliente MCP.
Registre el identificador de aplicación (cliente) y el identificador de directorio (inquilino) para una configuración posterior.
Para conceder permisos:
1. Seleccione Permisos delegados y agregue los ámbitos que coincidan con el escenario (por ejemplo, agregue MCP.User.Read.All para contar usuarios en el inquilino).
2. Conceda el consentimiento del administrador para los permisos delegados que agregó.
Pruebe el cliente MCP para confirmar que puede conectarse a Microsoft MCP Server for Enterprise y completar las operaciones necesarias.

Administrar ámbitos para clientes MCP personalizados mediante Microsoft Entra PowerShell:

Grant-EntraBetaMCPServerPermission -ApplicationId "<MCP_Client_Application_Id>" -Scopes "<Scope1>", "<Scope2>", "<...>"
Revoke-EntraBetaMCPServerPermission -ApplicationId "<MCP_Client_Application_Id>" -Scopes "<Scope1>", "<Scope2>", "<...>"

Visualización de los ámbitos de servidor MCP admitidos

El servidor MCP solo admite permisos delegados para escenarios interactivos del usuario. No se admiten los permisos de solo aplicación ni los flujos de trabajo de solo aplicación. Use una de las siguientes opciones (requiere al menos el DelegatedPermissionGrant.Read.All permiso delegado) para inspeccionar los ámbitos de MCP disponibles y centrarse en los ámbitos donde isEnabled es true.

Microsoft Graph: enumeración de ámbitos MCP

GET https://graph.microsoft.com/v1.0/servicePrincipals(appId='e8c77dc2-69b3-43f4-bc51-3213c9d915b4')/oauth2PermissionScopes

Lista de ámbitos del servidor MCP

La nomenclatura de los ámbitos MCP sigue el patrón MCP.{microsoft-graph-scope-name}. Por ejemplo, el ámbito User.Read.All de Microsoft Graph se expone como MCP.User.Read.All en el servidor MCP. Para comprender lo que permite cada ámbito, consulte la referencia de permisos de Microsoft Graph.

MCP. AccessReview.Read.All
MCP. AdministrativeUnit.Read.All
MCP. Application.Read.All
MCP. AuditLog.Read.All
MCP. AuthenticationContext.Read.All
MCP. Device.Read.All
MCP. DirectoryRecommendations.Read.All
MCP. Domain.Read.All
MCP. EntitlementManagement.Read.All
MCP. GroupMember.Read.All
MCP. HealthMonitoringAlert.Read.All
MCP. IdentityRiskEvent.Read.All
MCP. IdentityRiskyServicePrincipal.Read.All
MCP. IdentityRiskyUser.Read.All
MCP. LicenseAssignment.Read.All
MCP. LifecycleWorkflows.Read.All
MCP. LifecycleWorkflows-CustomExt.Read.All
MCP. LifecycleWorkflows-Reports.Read.All
MCP. LifecycleWorkflows-Workflow.Read.All
MCP. LifecycleWorkflows-Workflow.ReadBasic.All
MCP. NetworkAccess.Read.All
MCP. NetworkAccess-Reports.Read.All
MCP. Organization.Read.All
MCP. Policy.Read.All
MCP. Policy.Read.ConditionalAccess
MCP. ProvisioningLog.Read.All
MCP. Reports.Read.All
MCP. RoleAssignmentSchedule.Read.Directory
MCP. RoleEligibilitySchedule.Read.Directory
MCP. RoleManagement.Read.Directory
MCP. Synchronization.Read.All
MCP. User.Read.All
MCP. UserAuthenticationMethod.Read.All
MCP. GroupSettings.Read.All

Deshabilitación del servidor MCP para empresas

Dado que MCP Server for Enterprise es un servicio propiedad de Microsoft, no puede eliminarlo del inquilino. Sin embargo, puede deshabilitarlo si es necesario.

Microsoft Graph: deshabilitación del servidor MCP

PATCH https://graph.microsoft.com/v1.0/servicePrincipals(appId='e8c77dc2-69b3-43f4-bc51-3213c9d915b4')
{
  "accountEnabled": false
}

Comentarios

¿Le ha resultado útil esta página?

Last updated on 2026-03-21