merill/lokka

Lokka is a model-context-protocol server for the Microsoft Graph and Azure RM APIs that allows you to query and manage your Azure and Microsoft 365 tenants with AI.
Please see Lokka.dev for how to use Lokka with your favorite AI model and chat client.
Lokka lets you use Claude Desktop, or any MCP Client, to use natural language to accomplish things in your Azure and Microsoft 365 tenant through the Microsoft APIs.
e.g.:
- Create a new security group called 'Sales and HR' with a dynamic rule based on the department attribute.
- Find all the conditional access policies that haven't excluded the emergency access account
- Show me all the Intune device configuration policies assigned to the 'Call center' group
- What was the most expensive service in Azure last month?
Authentication Methods
Lokka now supports multiple authentication methods to accommodate different deployment scenarios:
Interactive Auth
For user-based authentication with interactive login, you can use the following configuration:
This is the simplest config and uses the default Lokka app.
Interactive auth with custom app
If you wish to use a custom Microsoft Entra app, you can create a new app registration in Microsoft Entra and configure it with the following environment variables:
App-Only Auth
Traditional app-only authentication. You can use either certificate (recommended) or client secret authentication with the following configuration.
See Install Guide for more details on how to create an Entra app.
App-Only Auth with Certificate
App only authentication using a PEM-encoded client certificate:
For comfort, in order to convert a PFX client certificate to a PEM-encoded certificate:
App-Only Auth with Client Secret
Client-Provided Token
Token-based authentication where the MCP Client provides access tokens:
When using client-provided token mode:
1. Start the MCP server with USE_CLIENT_TOKEN=true
2. Use the set-access-token tool to provide a valid Microsoft Graph access token
3. Use the get-auth-status tool to verify authentication status
4. Refresh tokens as needed using set-access-token
New Tools
Token Management Tools
- **set-access-token**: Set or update access tokens for Microsoft Graph authentication
- **get-auth-status**: Check current authentication status and capabilities
- **add-graph-permission**: Request additional Microsoft Graph permission scopes interactively
Graph API Version Control
Lokka now supports controlling the default Microsoft Graph API version used for all requests:
- **Default behavior**: Uses beta version for access to latest features
- **Production mode**: Set USE_GRAPH_BETA=false to force all requests to use v1.0 version
- **Per-request override**: You can still specify graphApiVersion parameter in individual requests (unless USE_GRAPH_BETA=false)
When USE_GRAPH_BETA=false, all Graph API calls will use the stable v1.0 version, even if beta is explicitly requested in the graphApiVersion parameter.
Getting started
See the docs for more information on how to install and configure Lokka.
- Introduction
- Install guide
- Developer guide
One-click install for VS Code
| Platform | VS Code | VS Code Insiders |
| - | - | - |
| Windows | | |
| macOS/Linux | | |
Components
Tools
1. Lokka-Microsoft
- Call Microsoft Graph & Azure APIs. Supports querying Azure and Microsoft 365 tenants. Updates are also supported if permissions are provided.