MCP SERVER

Microsoft Sentinel MCP server

Hosted MCP server with tool collections for data exploration, Security Copilot agent creation and incident triage over the Microsoft Sentinel data lake, authenticated with Entra.

Security & identitymcpsecurity

Visit project

Claim this listing

About Microsoft Sentinel MCP server

Hosted MCP server with tool collections for data exploration, Security Copilot agent creation and incident triage over the Microsoft Sentinel data lake, authenticated with Entra. Details were read from the publisher’s repository; nothing was installed or executed.

How to connect

What is the endpoint and how does it run?

Hosted remote server over Streamable HTTP at https://sentinel.microsoft.com/mcp/data-exploration.

How do I add Microsoft Sentinel MCP server to Claude Code, Cursor or Claude Desktop?

One command, any client (npm)

npx ruagentic add microsoft-sentinel-mcp-server

Claude Code

claude mcp add --transport http microsoft-sentinel https://sentinel.microsoft.com/mcp/data-exploration

Cursor, Windsurf and other clients that accept a URL (mcp.json)

{
  "mcpServers": {
    "microsoft-sentinel": {
      "url": "https://sentinel.microsoft.com/mcp/data-exploration"
    }
  }
}

Claude Desktop (claude_desktop_config.json, via the mcp-remote bridge)

{
  "mcpServers": {
    "microsoft-sentinel": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://sentinel.microsoft.com/mcp/data-exploration"
      ]
    }
  }
}

Snippets are generated from the published endpoint; the server name microsoft-sentinel is only a label you can change. Add the credentials the publisher documents.

Project website Documentation

REMOTE ENDPOINThttps://sentinel.microsoft.com/mcp/data-explorationUse this URL in a compatible client. Follow the provider’s authentication instructions.

Questions and answers

What is Microsoft Sentinel MCP server?

Microsoft Sentinel MCP server is an MCP server in the Security & identity category. Hosted MCP server with tool collections for data exploration, Security Copilot agent creation and incident triage over the Microsoft Sentinel data lake, authenticated with Entra.

How do I connect to Microsoft Sentinel MCP server?

Hosted remote server over Streamable HTTP at https://sentinel.microsoft.com/mcp/data-exploration. The listing page has ready-made snippets for Claude Code, Cursor and Claude Desktop.

Where is Microsoft Sentinel MCP server published?

Its homepage is https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-overview. RUAGENTIC read these details from Publisher documentation on September 9, 2026 and did not install or run the project.

Sources and checks

View the source

Source information collected September 9, 2026.

Badge and embed

Show this listing on your website or README. The badge and the card link back to this page.

Markdown badge

[![Listed on RUAGENTIC](https://ruagentic.com/badge/microsoft-sentinel-mcp-server.svg)](https://ruagentic.com/tools/microsoft-sentinel-mcp-server)

HTML badge

<a href="https://ruagentic.com/tools/microsoft-sentinel-mcp-server"><img src="https://ruagentic.com/badge/microsoft-sentinel-mcp-server.svg" alt="Listed on RUAGENTIC" height="28"></a>

Markdown card

[![Microsoft Sentinel MCP server on RUAGENTIC](https://ruagentic.com/embed/microsoft-sentinel-mcp-server.svg)](https://ruagentic.com/tools/microsoft-sentinel-mcp-server)

HTML embed

<iframe src="https://ruagentic.com/embed/microsoft-sentinel-mcp-server" width="480" height="150" style="border:0;max-width:100%" loading="lazy" title="Microsoft Sentinel MCP server on RUAGENTIC"></iframe>