# How to connect the Microsoft Sentinel data exploration MCP server

To connect the official Microsoft Sentinel data exploration MCP server, add https://sentinel.microsoft.com/mcp/data-exploration to your MCP client as a Streamable HTTP server, then sign in with OAuth when your client prompts you. Microsoft Sentinel data exploration documents setup for VS Code.

- Endpoint: https://sentinel.microsoft.com/mcp/data-exploration
- Transport: Streamable HTTP
- Registry: com.microsoft/sentinel-data-exploration 1.0.1
- Publisher documentation reviewed: 2026-11-05 (not a tested connection)
- Guide page: https://apitracker.io/mcp-guides/microsoft-sentinel-mcp

## Before you start

- A Microsoft Sentinel data lake. Graph tools also need the data lake onboarded to the Defender portal.
- The signed-in user, managed identity or service principal needs at least the Security Reader, Security Operator or Security Administrator role. Graph data also needs at least read-only access in Microsoft Security Exposure Management.
- The entity analyzer tools also need the Security Copilot Contributor role and consume Security Compute Units.

## Steps

1. **Open Microsoft's setup instructions for the Sentinel MCP server** <https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-get-started>
2. **Add the Sentinel data exploration collection to your client** Add https://sentinel.microsoft.com/mcp/data-exploration as a remote HTTP MCP server. In Visual Studio Code, run MCP: Add Server, choose HTTP, and enter that URL. Microsoft also documents setup in Security Copilot, Copilot Studio and Microsoft Foundry.
3. **Allow authentication and sign in with an account that has at least the Security Reader role**
4. **List the server's tools**

## Questions

### What is the Microsoft Sentinel data exploration MCP server URL?

The official Microsoft Sentinel data exploration MCP server is at https://sentinel.microsoft.com/mcp/data-exploration and uses the Streamable HTTP transport.

### How do I authenticate with the Microsoft Sentinel data exploration MCP server?

Sign in with OAuth when your client prompts you.

### Which AI clients can use the Microsoft Sentinel data exploration MCP server?

Microsoft Sentinel data exploration's documentation covers VS Code. Other clients that support remote Streamable HTTP MCP servers may also work.

### What do I need before connecting Microsoft Sentinel data exploration MCP?

A Microsoft Sentinel data lake. Graph tools also need the data lake onboarded to the Defender portal. The signed-in user, managed identity or service principal needs at least the Security Reader, Security Operator or Security Administrator role. Graph data also needs at least read-only access in Microsoft Security Exposure Management. The entity analyzer tools also need the Security Copilot Contributor role and consume Security Compute Units.

### Has this Microsoft Sentinel data exploration MCP guide been tested?

Microsoft Sentinel data exploration's documentation was reviewed on 2026-11-05. It is not a tested connection; your account and permissions decide which tools work.

## Sources

- https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-data-exploration-tool (checked 2026-11-05)
- https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-get-started (checked 2026-11-05)
- https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-use-tool-visual-studio-code (checked 2026-11-05)
- https://github.com/microsoft/sentinel-data-exploration-mcp (checked 2026-11-05)
- https://registry.modelcontextprotocol.io/v0.1/servers/com.microsoft%2Fsentinel-data-exploration/versions/1.0.1 (checked 2026-11-05)
- https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization (checked 2026-11-05)

Guide JSON: https://github.com/apideck-libraries/mcp-connect/blob/626f6a146170ded34891b30dca3af26f09e07466/proposals/connection-guide/0.1/reviewed/guides/microsoft-sentinel-mcp.json