How to connect the Microsoft Sentinel data exploration MCP server
To connect the official Microsoft Sentinel data exploration MCP server, add https://sentinel.microsoft.com/mcp/data-exploration to your MCP client as a Streamable HTTP server, then sign in with OAuth when your client prompts you. Microsoft Sentinel data exploration documents setup for VS Code.
Docs reviewed 5 Nov 2026Not a tested connection.
Endpoint https://sentinel.microsoft.com/mcp/data-exploration · Registry com.microsoft/sentinel-data-exploration 1.0.1
Add Microsoft Sentinel data exploration MCP to your client
{
"servers": {
"microsoft-sentinel-data-exploration": {
"type": "http",
"url": "https://sentinel.microsoft.com/mcp/data-exploration"
}
}
}Connect Microsoft Sentinel data exploration MCP step by step
Before you start
- A Microsoft Sentinel data lake. Graph tools also need the data lake onboarded to the Defender portal. learn.microsoft.com/en-uslearn.microsoft.com/en-us
- The signed-in user, managed identity or service principal needs at least the Security Reader, Security Operator or Security Administrator role. Graph data also needs at least read-only access in Microsoft Security Exposure Management. learn.microsoft.com/en-uslearn.microsoft.com/en-us
- The entity analyzer tools also need the Security Copilot Contributor role and consume Security Compute Units. learn.microsoft.com/en-us
Authentication
- Your client → Microsoft Sentinel data exploration MCP
- OAuth sign-in, handled by your MCP client. github.com/microsoftlearn.microsoft.com/en-usmodelcontextprotocol.io/specification
- Microsoft Sentinel data exploration MCP → Microsoft Sentinel data exploration API
- The server acts on your account with the access you approve. learn.microsoft.com/en-uslearn.microsoft.com/en-us
Steps
- Open Microsoft's setup instructions for the Sentinel MCP server
learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-get-started
- Add the Sentinel data exploration collection to your client
Add https://sentinel.microsoft.com/mcp/data-exploration as a remote HTTP MCP server. In Visual Studio Code, run MCP: Add Server, choose HTTP, and enter that URL. Microsoft also documents setup in Security Copilot, Copilot Studio and Microsoft Foundry.
- Allow authentication and sign in with an account that has at least the Security Reader role
- List the server's tools
Your client should list the server's tools. That confirms the connection, not every API permission.
What we observed
- 5 Nov 2026: HTTP 401 with WWW-Authenticate resource_metadata https://sentinel.microsoft.com/mcp/.well-known/oauth-protected-resource/data-exploration, which names the authorization server https://login.microsoftonline.com/organizations/v2.0 (Microsoft Entra ID, work or school accounts).
Microsoft Sentinel data exploration MCP questions
What is the Microsoft Sentinel data exploration MCP server URL?
The official Microsoft Sentinel data exploration MCP server is at https://sentinel.microsoft.com/mcp/data-exploration and uses the Streamable HTTP transport.
How do I authenticate with the Microsoft Sentinel data exploration MCP server?
Sign in with OAuth when your client prompts you.
Which AI clients can use the Microsoft Sentinel data exploration MCP server?
Microsoft Sentinel data exploration's documentation covers VS Code. Other clients that support remote Streamable HTTP MCP servers may also work.
What do I need before connecting Microsoft Sentinel data exploration MCP?
A Microsoft Sentinel data lake. Graph tools also need the data lake onboarded to the Defender portal. The signed-in user, managed identity or service principal needs at least the Security Reader, Security Operator or Security Administrator role. Graph data also needs at least read-only access in Microsoft Security Exposure Management. The entity analyzer tools also need the Security Copilot Contributor role and consume Security Compute Units.
Has this Microsoft Sentinel data exploration MCP guide been tested?
Microsoft Sentinel data exploration's documentation was reviewed on 2026-11-05. It is not a tested connection; your account and permissions decide which tools work.
Sources and review
Microsoft Sentinel data exploration's documentation was checked on the dates shown. This guide follows the MCP Connect connection-guide draft, bound to the exact Registry record it describes. It is not a tested connection: your account and permissions decide which tools work.
Guide source and binding
MCP connection guide (draft 0.1) for com.microsoft/sentinel-data-exploration 1.0.1, bound to /remotes/0 of the Registry record by SHA-256 351fcb41df58….
- learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-data-exploration-tool · checked 5 Nov 2026
- learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-get-started · checked 5 Nov 2026
- learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-use-tool-visual-studio-code · checked 5 Nov 2026
- github.com/microsoft/sentinel-data-exploration-mcp · checked 5 Nov 2026
- registry.modelcontextprotocol.io/v0.1/servers/com.microsoft%2Fsentinel-data-exploration/versions/1.0.1 · checked 5 Nov 2026
- modelcontextprotocol.io/specification/2026-07-28/basic/authorization · checked 5 Nov 2026