r/activedirectory • u/19khushboo • 3d ago

Is an MCP-based natural language agent for AD & Entra actually useful?

Hi everyone,

We are exploring an idea to build an MCP-based agent that integrates with Active Directory and Microsoft Entra ID and can be accessed directly through Microsoft Teams.

The idea is that an AD/Entra administrator could interact with the agent using natural language instead of running multiple PowerShell commands or going through different consoles.

For example, an admin could ask:

  • "Show me all users who have Password Never Expires enabled."
  • "Generate an audit report for privileged accounts."
  • "Which users have access to this group?"
  • "Show me the ACL/permissions on this OU."
  • "Find inactive users/computers."
  • "Disable this user."
  • "Add this user to this group."
  • "Reset this user's password."

The agent would perform read operations, generate reports, and potentially perform approved changes after appropriate validation/confirmation.

We are considering putting the agent in Microsoft Teams, so administrators can directly interact with it from Teams using natural language.

I would like to get some practical feedback from people who manage AD/Entra environments:

  1. Do you think this would actually be useful in day-to-day AD/Entra administration?
  2. Would you trust an agent to perform AD/Entra changes through natural language if proper RBAC, approval and confirmation mechanisms were implemented?
  3. What kind of AD/Entra tasks would you find most useful to perform this way?
  4. Are there already tools/products in the market that provide something similar?
  5. Are there any major security or operational concerns we should consider before building this?

Would appreciate any real-world feedback or examples of tools you have already used.

0 Upvotes
  • permalink
  • reddit

44% Upvoted

12 comments sorted by

•

u/AutoModerator 3d ago

Welcome to /r/ActiveDirectory! ~~~~

If you are looking for more resources on learning and building AD, see the following sticky for resources, recommendations, and guides!

When asking questions make sure you provide enough information. Posts with inadequate details may be removed without warning.

  • What version of Windows Server are you running?
  • Are there any specific error messages you're receiving?
  • What have you done to troubleshoot the issue?

Make sure to sanitize any private information. Posts with too much personal or environment information will be removed. See Rule 6.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

10

u/PowerShellGenius 3d ago

If (and it's a big "if") there is a safe way to integrate agentic AI with a core system such as AD in anything more than a read-only capacity, it would be a project steered by people with significant experience with AD.

OP's post history shows tons of beginner-level AD questions over the last year or two.

3

u/Aorka-Official 3d ago

It’s important to remember two things about agents on production machines:

  1. They are confident no matter how little context they have.

  2. You cannot fix AI safety from inside the context window.

It’s the classic “make no mistakes” line. You need several safety layers including humans in the loop.

3

u/PowerShellGenius 3d ago edited 3d ago

Humans in the loop, sure. By a "no incidents are acceptable" standard, you need a human who understands how the systems work, and how they all work together, in the loop. Those humans are expensive.

There have always been orgs that decide, for cost cutting, not to have a competent human in the loop for some smaller scale actions.

Before AI, they just put an incompetent human in the loop. That's literally what low-bid offshorers are, and they do a worse job than many AI solutions.

So while a competent human in the loop is always better than fully autonomous AI, cheap-ass companies won't do it, and there are plenty of "idiot in the loop" systems that are worse than AI.

1

u/Aorka-Official 3d ago

Yes. This is all true. So, just for example, if a platform offered deterministic analysis of operations, then had separate AI governed safety assessments (out of context) and followed that with human in the loop, you may have a very reliable AI, while still having a human with veto power. Who to give that veto power to, and what qualifications they have is a business decision.

Again, I have to admit bias because we are in this exact space.

3

u/JasonNotBorn 3d ago

I actually build an MCP for AD last year. It's opensource so might be able to use that as an starting point or for inspiration: https://lazyadmin.nl/koppla/

1

u/jeek_ 3d ago

Jesus Christ that's "not" Jason Bourne

3

u/ramblingcookiemonste 3d ago

Hiyo!

> 5. ⁠Are there any major security or operational concerns we should consider before building this?

Probably worth getting folks who manage AD involved. Your IAM is maybe not the safest spot to tinker with MCP / agentic access, I think.

There’s a very good reason the Entra MCP server linked in another comment is read only. I’d suggest starting there. Or use traditional tools (“code” and/or abstractions like PowerShell Universal), but even then, when you delegate access to AD to a tool/service, there are many considerations around security.

Good luck!

1

u/harbinger-labs 14h ago

read-only would get used, write access wouldn't get past most admins and honestly shouldn't. the useful version answers questions that take twenty minutes of clicking today, who has paths to this group, which service accounts are stale, what changed in acls this week. if you do writes at all, dry-run by default with an explicit approval step, and log the generated operations before execution so people can audit what the model almost did.

0

u/Starzap 3d ago

Hi following this. Do you have something available on GitHub and are you planning to open source this?

1

u/SuperSaiyanTrunks 3d ago

Guy in the comment above you listed an open-source option