# Darrenjrobinson Entra Scim MCP server

Source: https://glimind.com/server/mcp-registry%2Fio.github.darrenjrobinson%2Fentra-scim-mcp
Registry id: `mcp-registry/io.github.darrenjrobinson/entra-scim-mcp`
Status: unknown

## Install

```json
{
  "mcpServers": {
    "darrenjrobinson-entra-scim-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "entra-scim-mcp"
      ]
    }
  }
}
```

Claude Code:

```sh
claude mcp add darrenjrobinson-entra-scim-mcp-server -- npx -y entra-scim-mcp
```

## Tools (18)

- `add_group_members`: Add ≥1 users to a group — auto-chunks at 20 ids per PATCH (API cap), one Operation per PATCH. Idempotent.
- `create_group`: POST a group. Sets mailEnabled, securityEnabled, mailNickname, description via the Entra extension.
- `delete_group`: DELETE a group. Unified groups are recoverable for 30 days via Graph; security groups are not.
- `deprovision_user`: DELETE a user. Soft-deleted for 30 days, restorable only via Graph; also strips every group membership.
- `get_group`: Read a single group (members are NOT returned — list them with list_users filtered on groups.value).
- `get_service_provider_config`: One-shot capability discovery. Static per API version — fetch once and reuse.
- `get_user`: Read a single user by id with optional attribute projection. Neither CSAs nor group membership are ever included.
- `get_user_custom_security_attributes`: Read a user's CSAs, projected by attribute set. attributeSets is required.
- `list_groups`: List groups with the API's restricted filter set. A members.value filter is the only way to read membership.
- `list_resource_types`: Enumerate SCIM resource types (User, Group).
- `list_schemas`: Enumerate SCIM schemas and Entra extensions, with each attribute's type, mutability and default-return.
- `list_users`: List users; supports the API's restricted filter and cursor pagination up to 999 per page.
- `provision_user`: Create a user with the required attribute set enforced (userName, password, displayName, name.givenName, name.familyName).
- `remove_group_member`: Remove a single user from a group (the API allows only one removal per PATCH, with no other ops).
- `update_group`: PATCH group attributes only (membership ops are rejected here; type flags are fixed at creation).
- `update_user`: PATCH a user; blocks remove of mailNickname and enforces [type eq "work"] on address paths.
- `update_user_custom_security_attributes`: PATCH CSAs on a user. remove, or replace with an empty array, deletes an assignment.
- `update_user_lifecycle`: Set lifecycle attrs (e.g. employeeLeaveDateTime) — which Lifecycle Workflows can fire off.

Measured by Glimind (https://glimind.com): MCP handshake + tool list only, no tool is ever called. CC BY 4.0.