by merill
Lokka (Microsoft Graph) — Conversational bridge to manage Microsoft 365 tenants via natural language, no complex API cal
Provides a bridge between Microsoft Graph API and natural language interaction, enabling conversational management of Microsoft 365 tenants without complex API calls.
Lokka (Microsoft Graph) is a community-built MCP server published by merill that provides AI assistants with tools and capabilities via the Model Context Protocol. Lokka (Microsoft Graph) — Conversational bridge to manage Microsoft 365 tenants via natural language, no complex API cal It is categorized under cloud infrastructure, developer tools.
You can install Lokka (Microsoft Graph) in your AI client of choice. Use the install panel on this page to get one-click setup for Cursor, Claude Desktop, VS Code, and other MCP-compatible clients. This server runs locally on your machine via the stdio transport.
MIT
Lokka (Microsoft Graph) is released under the MIT license. This is a permissive open-source license, meaning you can freely use, modify, and distribute the software.
Add new capabilities to Claude beyond text generation
Example
Access external data sources, execute code, interact with tools and services
Transform Claude from chatbot to action-taking agent
Provide Claude with access to relevant context and data
Example
Load project documentation, access knowledge bases, query databases
Get more accurate, context-aware responses
Automate multi-step workflows combining AI and external tools
Example
Research → Summarize → Create document → Send notification
Complete complex tasks end-to-end without manual steps
Share your MCP server with the developer community
We evaluated Lokka (Microsoft Graph) against two servers with overlapping tools; this profile had the clearer scope statement.
Lokka (Microsoft Graph) has been reliable for tool-calling workflows; the MCP profile page is a good permalink for internal docs.
Useful MCP listing: Lokka (Microsoft Graph) is the kind of server we cite when onboarding engineers to host + tool permissions.
We wired Lokka (Microsoft Graph) into a staging workspace; the listing’s GitHub and npm pointers saved time versus hunting across READMEs.
According to our notes, Lokka (Microsoft Graph) benefits from clear Model Context Protocol framing — fewer ambiguous “AI plugin” claims.
We evaluated Lokka (Microsoft Graph) against two servers with overlapping tools; this profile had the clearer scope statement.
Lokka (Microsoft Graph) reduced integration guesswork — categories and install configs on the listing matched the upstream repo.
According to our notes, Lokka (Microsoft Graph) benefits from clear Model Context Protocol framing — fewer ambiguous “AI plugin” claims.
Lokka (Microsoft Graph) is among the better-indexed MCP projects we tried; the explainx.ai summary tracks the official description.
We wired Lokka (Microsoft Graph) into a staging workspace; the listing’s GitHub and npm pointers saved time versus hunting across READMEs.
showing 1-10 of 65
Lokka is a model-context-protocol server for the Microsoft Graph and Azure RM APIs that allows you to query and manage your Azure and Microsoft 365 tenants with AI.
<img src="https://github.com/merill/lokka/blob/main/assets/lokka-demo-1.gif?raw=true" alt="Lokka Demo - user create demo" width="500"/>Please see Lokka.dev for how to use Lokka with your favorite AI model and chat client.
Lokka lets you use Claude Desktop, or any MCP Client, to use natural language to accomplish things in your Azure and Microsoft 365 tenant through the Microsoft APIs.
e.g.:
Create a new security group called 'Sales and HR' with a dynamic rule based on the department attribute.Find all the conditional access policies that haven't excluded the emergency access accountShow me all the Intune device configuration policies assigned to the 'Call center' groupWhat was the most expensive service in Azure last month?
Lokka now supports multiple authentication methods to accommodate different deployment scenarios:
For user-based authentication with interactive login, you can use the following configuration:
This is the simplest config and uses the default Lokka app.
{
"mcpServers": {
"Lokka-Microsoft": {
"command": "npx",
"args": ["-y", "@merill/lokka"]
}
}
}
If you wish to use a custom Microsoft Entra app, you can create a new app registration in Microsoft Entra and configure it with the following environment variables:
{
"mcpServers": {
"Lokka-Microsoft": {
"command": "npx",
"args": ["-y", "@merill/lokka"],
"env": {
"TENANT_ID": "<tenant-id>",
"CLIENT_ID": "<client-id>",
"USE_INTERACTIVE": "true"
}
}
}
}
Traditional app-only authentication. You can use either certificate (recommended) or client secret authentication with the following configuration.
See Install Guide for more details on how to create an Entra app.
App only authentication using a PEM-encoded client certificate:
{
"mcpServers": {
"Lokka-Microsoft": {
"command": "npx",
"args": ["-y", "@merill/lokka"],
"env": {
"TENANT_ID": "<tenant-id>",
"CLIENT_ID": "<client-id>",
"CERTIFICATE_PATH": "/path/to/certificate.pem",
"CERTIFICATE_PASSWORD": "<optional-certificate-password>",
"USE_CERTIFICATE": "true"
}
}
}
}
For comfort, in order to convert a PFX client certificate to a PEM-encoded certificate:
openssl pkcs12 -in /path/to/cert.pfx -out /path/to/cert.pem -nodes -clcerts
{
"mcpServers": {
"Lokka-Microsoft": {
"command": "npx",
"args": ["-y", "@merill/lokka"],
"env": {
"TENANT_ID": "<tenant-id>",
"CLIENT_ID": "<client-id>",
"CLIENT_SECRET": "<client-secret>"
}
}
}
}
Token-based authentication where the MCP Client provides access tokens:
{
"mcpServers": {
"Lokka-Microsoft": {
"command": "npx",
"args": ["-y", "@merill/lokka"],
"env": {
"USE_CLIENT_TOKEN": "true"
}
}
}
}
When using client-provided token mode:
USE_CLIENT_TOKEN=trueset-access-token tool to provide a valid Microsoft Graph access tokenget-auth-status tool to verify authentication statusset-access-tokenset-access-token: Set or update access tokens for Microsoft Graph authenticationget-auth-status: Check current authentication status and capabilitiesadd-graph-permission: Request additional Microsoft Graph permission scopes interactivelyLokka now supports controlling the default Microsoft Graph API version used for all requests:
beta version for access to latest featuresUSE_GRAPH_BETA=false to force all requests to use v1.0 versiongraphApiVersion parameter in individual requests (unless USE_GRAPH_BETA=false)When USE_GRAPH_BETA=false, all Graph API calls will use the stable v1.0 version, even if beta is explicitly requested in the graphApiVersion parameter.
See the docs for more information on how to install and configure Lokka.
| Platform | VS Code | VS Code Insiders |
|---|---|---|
| Windows |  |  |
| macOS/Linux |  |  |
Lokka-Microsoft
apiType (string): Type of Microsoft API to query. Options: 'graph' for Microsoft Graph (Entra) or 'azure' for Azure Resource Management.path (string): The Azure or Graph API URL path to call (e.g. '/users', '/groups', '/subscriptions').method (string): HTTP method to use (e.g., get, post, put, patch, delete)apiVersion (string): Azure Resource Management API version (required for apiType Azure)subscriptionId (string): Azure Subscription ID (for Azure Resource Management).queryParams (string): Array of query parameters like $filter, $select, etc. All parameters are strings.body (JSON): The request body (for POST, PUT, PATCH)set-access-token (New in v0.2.0)
accessToken (string): The access token obtained from Microsoft Graph authenticationexpiresOn (string, optional): Token expiration time in ISO formatget-auth-status (New in v0.2.0)
The configuration of the server is done using environment variables. The following environment variables are supported:
| Name | Description | Required |
|---|---|---|
TENANT_ID | The ID of the Microsoft Entra tenant. | Yes (except for client-provided token mode) |
CLIENT_ID | The ID of the application registered in Microsoft Entra. | Yes (except for client-provided token mode) |
CLIENT_SECRET | The client secret of the application registered in Microsoft Entra. | Yes (for client credentials mode only) |
USE_INTERACTIVE | Set to "true" to enable interactive authentication mode. | No |
USE_CLIENT_TOKEN | Set to "true" to enable client-provided token authentication mode. | No |
USE_CERTIFICATE | Set to "true" to enable certificate authentication mode. | No |
CERTIFICATE_PATH | Path to the PEM-encoded certificate file for certificate authentication. | Yes (for certificate mode only) |
CERTIFICATE_PASSWORD | Password for the certificate file (if encrypted). | No |
REDIRECT_URI | Redirect URI for interactive authentication (default: http://localhost:3000). | No |
ACCESS_TOKEN | Initial access token for client-provided token mode. | No |
USE_GRAPH_BETA | Set to "false" to force all Graph API calls to use v1.0 instead of beta (default: true, allows beta). | No |
To use this server with the Claude Desktop app, add the following configuration to the "mcpServers" section of your
claude_desktop_config.json:
{
"mcpServers": {
"Lokka-Microsoft": {
"command": "npx",
"args"
---
Prerequisites
Time Estimate
15-60 minutes depending on server complexity
Steps
Troubleshooting
✓ Do
✗ Don't
💡 Pro Tips
Architecture
Model Context Protocol standardizes how AI hosts (Claude, Cursor) communicate with external tools and data sources through server implementations.
Protocols
Compatibility
✓ Use when
Use when you need Claude to access external data, execute actions, or integrate with tools. Best for extending AI capabilities beyond conversation.
✗ Avoid when
Avoid when native integrations exist (use official APIs directly), for real-time critical systems, or when security/compliance requires zero external dependencies.