mcp-usage-monitoring

Use this skill when asked to monitor, audit, or analyze MCP (Model Context Protocol) server usage in the environment. Triggers on keywords like "MCP usage", "MCP server monitoring", "MCP activity", "Graph MCP", "Sentinel MCP", "Azure MCP", "MCP audit", "tool usage monitoring", "MCP breakdown", "who is using MCP", or when investigating MCP user activity, Graph API calls from MCP servers, or workspace query governance. This skill provides comprehensive MCP server telemetry analysis across Graph MCP, Sentinel MCP, and Azure MCP servers including usage trends, endpoint access patterns, user attribution, cross-server user analysis, sensitive API detection, workspace query governance, and security risk assessment with inline and markdown file reporting.

Jump to install

Repository: SCStelz/security-investigator
Last source activity: April 11, 2026 at 22:29
Detected SKILL.md language: English
Stars: 233
Forks: 64

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/SCStelz/security-investigator --skill mcp-usage-monitoring

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

2 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

ai-agent-activity

Use this skill when asked to report on, summarize, or investigate the RUNTIME ACTIVITY of AI agents (Agent 365 / Copilot Studio / Microsoft 365 Copilot / Work IQ) — who used which agents, what tools/connectors ran, which channels, token usage, prompt/reply content, and what the safety layer (Prompt Shield jailbreak / XPIA) caught. Triggers on keywords like "agent activity", "AI agent usage", "who is using agents", "agent runtime", "agent telemetry", "agent tool usage", "agent session", "jailbreak activity", "prompt injection activity", "Agent 365 activity", "UnifiedAgentObservability", "CloudAppEvents agents", "CopilotActivity". Auto-detects whichever data planes the tenant has — UnifiedAgentObservability (Sentinel Data Lake), CloudAppEvents (Defender), CopilotActivity (governance + fail-close posture) — and proceeds with what is available. Supports tenant-wide, single-agent, and single-user scopes. Runtime/behavioral companion to the config-focused ai-agent-posture skill.

2026-08-13

ai-agent-posture

Use this skill when asked to audit, assess, or report on AI agent security posture across Copilot Studio, Microsoft 365 Copilot, Microsoft Foundry, and third-party agents. Triggers on keywords like "AI agent posture", "agent security audit", "Copilot Studio agents", "agent inventory", "agent access", "broadly accessible agents", "agent tools", "MCP tools on agents", "agent knowledge sources", "XPIA risk", "agent sprawl", "AI agent risk", "agent governance", or when investigating AI agent configurations, access posture, tool permissions, or credential exposure. This skill queries the AgentsInfo table in Advanced Hunting to produce a comprehensive security posture assessment covering agent inventory, access posture, broadly-accessible agent exposure, MCP tool proliferation, knowledge source exposure, XPIA email exfiltration risk, hard-coded credential detection, external endpoint risks, creator governance, and agent sprawl analysis. Supports inline chat and markdown file output.

2026-07-20

detection-authoring

Create, deploy, update, and manage custom detection rules in Microsoft Defender XDR via the Graph API (/beta/security/rules/detectionRules). Covers query adaptation from Sentinel KQL to custom detection format, deployment via PowerShell (Invoke-MgGraphRequest), manifest-driven batch deployment, and lifecycle management (list, enable/disable, delete). Companion script: Deploy-CustomDetections.ps1.

2026-07-16

View all from this repository

MCP Server Usage Monitoring — Instructions

Purpose

This skill monitors and audits Model Context Protocol (MCP) server usage across your Microsoft Sentinel and Defender XDR environment. MCP servers are AI-powered tools that enable language models to interact with Microsoft security services — and like any privileged access channel, they require monitoring.

What this skill tracks:

MCP Server

Telemetry Source

Key Identifier

MCP Server Usage Monitoring — Instructions

Purpose

What this skill tracks:

MCP Server

Telemetry Source

Key Identifier

AppId

Service

Telemetry Table

Notes

e8c77dc2-69b3-43f4-bc51-3213c9d915b4

Microsoft Graph MCP Server for Enterprise

MicrosoftGraphActivityLogs

Read-only Graph API proxy

7b7b3966-1961-47b5-b080-43ca5482e21c

Sentinel Triage MCP ("Microsoft Defender Mcp")

MicrosoftGraphActivityLogs, SigninLogs, AADNonInteractiveUserSignInLogs

Microsoft first-party AppId, same across all tenants. Dedicated AppId — visible in MicrosoftGraphActivityLogs (API calls to /security/* endpoints) and SigninLogs/AADNonInteractiveUserSignInLogs (AppDisplayName = "Microsoft Defender Mcp"). Delegated auth with certificate (ClientAuthMethod=2), full user attribution. Scopes: SecurityAlert.Read.All, SecurityIncident.Read.All, ThreatHunting.Read.All. Target resources: Microsoft Graph, WindowsDefenderATP. No local SPN — display name only visible in SigninLogs. 🔴 Confirmed Feb 2026: Empirical telemetry investigation identified 7b7b3966 as the Triage MCP AppId via MicrosoftGraphActivityLogs + SigninLogs correlation.

253895df-6bd8-4eaf-b101-1381ec4306eb

Sentinel Platform Services App Reg

SigninLogs

Sentinel-hosted MCP platform

04b07795-8ddb-461a-bbee-02f9e1bf7b46

Azure MCP Server (local stdio via DefaultAzureCredential → Azure CLI)

SigninLogs, AADNonInteractiveUserSignInLogs, LAQueryLogs

Shared AppId with Azure CLI. In LAQueryLogs, RequestClientApp is empty (not a unique fingerprint). Azure MCP appends \n| limit N to query text — the only query-level differentiator. Read-only ARM ops don't appear in AzureActivity. 🔄 Updated Feb 2026: Previously documented as AppId 1950a258 (AzurePowerShellCredential) with csharpsdk,LogAnalyticsPSClient — that fingerprint is obsolete; only 1 occurrence found in 30-day lookback.

(none — uses DefaultAzureCredential)

Azure MCP Server (local stdio)

AzureActivity

ARM write operations only; read ops not logged. Claims.appid = 04b07795. Inherits cred from Azure CLI/VS Code

(no AppId — Purview unified audit)

Sentinel Data Lake MCP

CloudAppEvents

RecordType 403; Interface IMcpToolTemplate; tools: query_lake, list_sentinel_workspaces, search_tables

// Unified Daily MCP Activity Trend — all 4 MCP servers in one pass // Configurable: replace 30d with desired lookback (max 30d for AH) let lookback = 30d; // --- Graph MCP (AppId e8c77dc2) --- let graph_mcp = MicrosoftGraphActivityLogs | where TimeGenerated >= ago(lookback) | where AppId == "e8c77dc2-69b3-43f4-bc51-3213c9d915b4" | summarize Calls = count(), Errors = countif(ResponseStatusCode >= 400) by Day = bin(TimeGenerated, 1d) | extend Server = "Graph MCP"; // --- Triage MCP (AppId 7b7b3966) --- let triage_mcp = MicrosoftGraphActivityLogs | where TimeGenerated >= ago(lookback) | where AppId == "7b7b3966-1961-47b5-b080-43ca5482e21c" | summarize Calls = count(), Errors = countif(ResponseStatusCode >= 400) by Day = bin(TimeGenerated, 1d) | extend Server = "Triage MCP"; // --- Data Lake MCP (CloudAppEvents RecordType 379 + InterfaceNotProvided) --- let data_lake_mcp = CloudAppEvents | where TimeGenerated >= ago(lookback) | where ActionType contains "Sentinel" or ActionType contains "KQL" | extend RawData = parse_json(tostring(RawEventData)) | extend RecordType = toint(RawData.RecordType), Interface = tostring(RawData.Interface), FailureReason = tostring(RawData.FailureReason) | where RecordType == 379 and (Interface == "InterfaceNotProvided" or isempty(Interface)) | summarize Calls = count(), Errors = countif(isnotempty(FailureReason) and FailureReason != "") by Day = bin(TimeGenerated, 1d) | extend Server = "Data Lake MCP"; // --- Azure MCP/CLI (AppId 04b07795 — shared with Azure CLI) --- let azure_interactive = SigninLogs | where TimeGenerated >= ago(lookback) | where AppId == "04b07795-8ddb-461a-bbee-02f9e1bf7b46" | project TimeGenerated, ResultType; let azure_noninteractive = AADNonInteractiveUserSignInLogs | where TimeGenerated >= ago(lookback) | where AppId == "04b07795-8ddb-461a-bbee-02f9e1bf7b46" | project TimeGenerated, ResultType; let azure_mcp = union azure_interactive, azure_noninteractive | summarize Calls = count(), Errors = countif(ResultType != "0" and ResultType != "") by Day = bin(TimeGenerated, 1d) | extend Server = "Azure MCP/CLI"; // --- Union all servers --- union graph_mcp, triage_mcp, data_lake_mcp, azure_mcp | extend ErrorRate = iff(Calls > 0, round(100.0 * Errors / Calls, 1), 0.0) | project Server, Day, Calls, Errors, ErrorRate | order by Day asc, Server asc

// Data Lake MCP — single-pass access pattern delineation + tool/table/workspace inventory // Combines former Q20 (summary) and Q24 (delineation) into one query CloudAppEvents | where Timestamp >= ago(30d) | where ActionType contains "Sentinel" or ActionType contains "KQL" | extend RawData = parse_json(tostring(RawEventData)) | extend Operation = tostring(RawData.Operation), RecordType = toint(RawData.RecordType), ToolName = tostring(RawData.ToolName), Interface = tostring(RawData.Interface), ExecutionDuration = todouble(RawData.ExecutionDuration), FailureReason = tostring(RawData.FailureReason), TablesRead = tostring(RawData.TablesRead), DatabasesRead = tostring(RawData.DatabasesRead), TotalRows = toint(RawData.TotalRows), UserId_raw = tostring(RawData.UserId), InputParams = tostring(RawData.InputParameters) | extend AccessPattern = case( RecordType == 403 and Interface == "IMcpToolTemplate", "MCP Server-Driven", RecordType == 379 and (Interface == "InterfaceNotProvided" or isempty(Interface)), "MCP-Driven (Probable)", RecordType == 379 and Interface has "msglakeexplorer", "Portal (Data Lake Explorer)", RecordType == 379 and Interface has "msgjobmanagement", "Scheduled Jobs", RecordType == 379, "Other Direct KQL", "Other"), IsSuccess = isempty(FailureReason) or FailureReason == "", HasKQLQuery = InputParams has "query" | where Operation contains "Completed" or RecordType == 379 // 'contains' not 'has' — CamelCase | summarize TotalCalls = count(), SuccessCount = countif(IsSuccess), FailureCount = countif(not(IsSuccess)), DistinctTools = dcount(ToolName), Tools = make_set(ToolName, 20), DistinctTables = dcount(TablesRead), Tables = make_set(TablesRead, 30), Workspaces = make_set(DatabasesRead, 5), AvgDurationSec = round(avg(ExecutionDuration), 2), TotalRowsReturned = sum(TotalRows), DistinctUsers = dcount(UserId_raw), Users = make_set(UserId_raw, 10), KQLQueryCount = countif(HasKQLQuery), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by AccessPattern | extend ErrorRate = round(100.0 * FailureCount / TotalCalls, 1) | order by TotalCalls desc

// Breakdown of Data Lake access by Interface — identifies MCP vs Portal vs Jobs // PRIMARY: Uses RecordType 403 / ToolName when available (MCP audit events) // FALLBACK: When RecordType 403 absent, groups by Interface field from RecordType 379 // - InterfaceNotProvided = probable MCP-driven (cross-ref with Q4/Q6 SigninLogs) // - msglakeexplorer@msec-msg = Sentinel Portal Data Lake Explorer // - msgjobmanagement@msec-msg = Scheduled/job-based queries // - ipykernel_launcher.py = Jupyter Notebook // - PowerBIConnector = Power BI // - Microsoft.Medeina.Server = Security Copilot CloudAppEvents | where Timestamp >= ago(30d) | where ActionType contains "Sentinel" or ActionType contains "KQL" | extend RawData = parse_json(tostring(RawEventData)) | extend Operation = tostring(RawData.Operation), RecordType = toint(RawData.RecordType), ToolName = tostring(RawData.ToolName), Interface = tostring(RawData.Interface), ExecutionDuration = todouble(RawData.ExecutionDuration), FailureReason = tostring(RawData.FailureReason), TablesRead = tostring(RawData.TablesRead), UserId_raw = tostring(RawData.UserId) | where Operation contains "Completed" or RecordType == 379 | extend // When RecordType 403 exists, ToolName is the grouping key; otherwise use Interface GroupKey = iff(RecordType == 403, coalesce(ToolName, "unknown_tool"), coalesce(Interface, "InterfaceNotProvided")), IsSuccess = isempty(FailureReason) or FailureReason == "", Source = iff(RecordType == 403, "MCP Tool (RecordType 403)", "Interface (RecordType 379)") | summarize CallCount = count(), SuccessCount = countif(IsSuccess), FailureCount = countif(not(IsSuccess)), AvgDurationSec = round(avg(ExecutionDuration), 2), MaxDurationSec = round(max(ExecutionDuration), 2), TablesAccessed = make_set(TablesRead, 20), DistinctUsers = dcount(UserId_raw), Users = make_set(UserId_raw, 10), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by GroupKey, Source | extend ErrorRate = round(100.0 * FailureCount / CallCount, 1) | order by CallCount desc

// Analyze failed Data Lake queries — identify schema errors, permission issues, etc. // PRIMARY: Filters on ActionType contains "SentinelAITool" (RecordType 403) when available // FALLBACK: When RecordType 403 absent, analyzes all failed RecordType 379 events grouped by Interface CloudAppEvents | where Timestamp >= ago(30d) | where ActionType contains "Sentinel" or ActionType contains "KQL" | extend RawData = parse_json(tostring(RawEventData)) | extend Operation = tostring(RawData.Operation), RecordType = toint(RawData.RecordType), ToolName = tostring(RawData.ToolName), Interface = tostring(RawData.Interface), FailureReason = tostring(RawData.FailureReason), TablesRead = tostring(RawData.TablesRead), UserId_raw = tostring(RawData.UserId) | where Operation contains "Completed" or RecordType == 379 | where isnotempty(FailureReason) and FailureReason != "" | extend AccessPattern = case( RecordType == 403 and Interface == "IMcpToolTemplate", "MCP Server-Driven", RecordType == 379 and (Interface == "InterfaceNotProvided" or isempty(Interface)), "MCP-Driven (Probable)", RecordType == 379 and Interface has "msglakeexplorer", "Portal (Data Lake Explorer)", RecordType == 379 and Interface has "msgjobmanagement", "Scheduled Jobs", RecordType == 379, "Other Direct KQL", "Other"), ErrorCategory = case( FailureReason has "SemanticError", "Schema/Semantic Error", FailureReason has "SyntaxError", "KQL Syntax Error", FailureReason has "Unauthorized" or FailureReason has "403", "Permission Denied", FailureReason has "Timeout", "Query Timeout", FailureReason has "NotFound", "Table/Resource Not Found", "Other Error") | summarize ErrorCount = count(), Tools = make_set(ToolName, 10), Tables = make_set(TablesRead, 10), Users = make_set(UserId_raw, 10), SampleErrors = make_set(substring(FailureReason, 0, 150), 5), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by AccessPattern, ErrorCategory | order by AccessPattern asc, ErrorCount desc

// Detect Azure MCP Server authentication events via Azure CLI AppId. // // 🔄 UPDATED Feb 2026: Azure MCP Server now uses Azure CLI credential (04b07795), // NOT AzurePowerShellCredential (1950a258) as previously documented. // The old AppId 1950a258 + UserAgent 'azsdk-net-Identity' fingerprint is OBSOLETE. // // ⚠️ SHARED APPID: 04b07795 is the Azure CLI AppId — shared with manual 'az' CLI usage. // There is NO unique sign-in fingerprint for Azure MCP Server vs manual Azure CLI. // This query returns ALL Azure CLI sign-ins. Correlate with LAQueryLogs (Query 14) // for query-level attribution via the '\n| limit N' text pattern. // // NOTE: Sign-in events represent TOKEN ACQUISITIONS, not individual API calls. // A cached token serves many Azure MCP calls with no additional sign-in events. // FIX (Feb 2026): Explicit tostring() casts on ResultType, ResultDescription, // ConditionalAccessStatus, AuthenticationRequirement to prevent union type mismatches // between SigninLogs and AADNonInteractiveUserSignInLogs. Removed ResourceId (inconsistent // across tables). Use parse_json() wrapper on DeviceDetail and LocationDetails — these // columns may be stored as string (not dynamic) in Data Lake workspaces, causing // SemanticError on dot-notation access without parse_json(). let azure_mcp_appid = "04b07795-8ddb-461a-bbee-02f9e1bf7b46"; let signinlogs_interactive = SigninLogs | where TimeGenerated >= ago(90d) | where AppId == azure_mcp_appid | extend SignInType = "Interactive" | project TimeGenerated, UserPrincipalName, AppDisplayName, AppId, ResourceDisplayName, IPAddress, ResultType = tostring(ResultType), ResultDescription = tostring(ResultDescription), UserAgent, SignInType, ConditionalAccessStatus = tostring(ConditionalAccessStatus), AuthenticationRequirement = tostring(AuthenticationRequirement), OS = tostring(parse_json(DeviceDetail).operatingSystem), Country = tostring(parse_json(LocationDetails).countryOrRegion); let signinlogs_noninteractive = AADNonInteractiveUserSignInLogs | where TimeGenerated >= ago(90d) | where AppId == azure_mcp_appid | extend SignInType = "Non-Interactive" | project TimeGenerated, UserPrincipalName, AppDisplayName, AppId, ResourceDisplayName, IPAddress, ResultType = tostring(ResultType), ResultDescription = tostring(ResultDescription), UserAgent, SignInType, ConditionalAccessStatus = tostring(ConditionalAccessStatus), AuthenticationRequirement = tostring(AuthenticationRequirement), OS = tostring(parse_json(DeviceDetail).operatingSystem), Country = tostring(parse_json(LocationDetails).countryOrRegion); union signinlogs_interactive, signinlogs_noninteractive | order by TimeGenerated desc

Total MCP API Calls: <sum of API calls across Graph + Triage + Data Lake + Azure> Total Auth Events: <sum of auth events across Triage + Azure + Platform Services> Distinct MCP Users: <deduplicated count or max across channels> Active MCP Servers: <count of server types with >0 activity> Combined MCP Query Share: <MCP queries / total workspace queries %> Sensitive API Rate: <sensitive / total Graph MCP calls %>

name	mcp-usage-monitoring
description	Use this skill when asked to monitor, audit, or analyze MCP (Model Context Protocol) server usage in the environment. Triggers on keywords like "MCP usage", "MCP server monitoring", "MCP activity", "Graph MCP", "Sentinel MCP", "Azure MCP", "MCP audit", "tool usage monitoring", "MCP breakdown", "who is using MCP", or when investigating MCP user activity, Graph API calls from MCP servers, or workspace query governance. This skill provides comprehensive MCP server telemetry analysis across Graph MCP, Sentinel MCP, and Azure MCP servers including usage trends, endpoint access patterns, user attribution, cross-server user analysis, sensitive API detection, workspace query governance, and security risk assessment with inline and markdown file reporting.
threat_pulse_domains	["admin"]
drill_down_prompt	Run MCP usage monitoring report — Graph/Sentinel/Azure MCP activity, user attribution

name	mcp-usage-monitoring
description	Use this skill when asked to monitor, audit, or analyze MCP (Model Context Protocol) server usage in the environment. Triggers on keywords like "MCP usage", "MCP server monitoring", "MCP activity", "Graph MCP", "Sentinel MCP", "Azure MCP", "MCP audit", "tool usage monitoring", "MCP breakdown", "who is using MCP", or when investigating MCP user activity, Graph API calls from MCP servers, or workspace query governance. This skill provides comprehensive MCP server telemetry analysis across Graph MCP, Sentinel MCP, and Azure MCP servers including usage trends, endpoint access patterns, user attribution, cross-server user analysis, sensitive API detection, workspace query governance, and security risk assessment with inline and markdown file reporting.
threat_pulse_domains	["admin"]
drill_down_prompt	Run MCP usage monitoring report — Graph/Sentinel/Azure MCP activity, user attribution

Endpoint URL	Collection	Monitored
`https://sentinel.microsoft.com/mcp/data-exploration`	Data Exploration (Data Lake MCP)	✅ Phase 3
`https://sentinel.microsoft.com/mcp/triage`	Triage (Triage MCP)	✅ Phase 2
`https://sentinel.microsoft.com/mcp/security-copilot-agent-creation`	Security Copilot Agent Creation	❌ See Landscape

AppId	Service	Telemetry Table	Notes
`80ccca67-54bd-44ab-8625-4b79c4dc7775`	M365 Security & Compliance Center (Sentinel Portal)	`LAQueryLogs`	`ASI_Portal`, `ASI_Portal_Connectors` — Sentinel Portal backend, NOT an MCP server
`95a5d94c-a1a0-40eb-ac6d-48c5bdee96d5`	Azure Portal — AppInsightsPortalExtension	`LAQueryLogs`	Azure Portal blade for Log Analytics Usage dashboards/workbooks. `RequestClientApp` = `AppInsightsPortalExtension`. Executes billing/usage queries (e.g., `Usage \| where IsBillable`). NOT MCP, NOT VS Code — runs when user opens Workspace Usage Dashboard in browser. No SPN or app registration in tenant (platform-level first-party app). Not in merill/microsoft-info known apps list.
`de8c33bb-995b-4d4a-9d04-8d8af5d59601`	PowerPlatform-AzureMonitorLogs-Connector	`AADNonInteractiveUserSignInLogs`, `LAQueryLogs`	Logic Apps → Log Analytics (NOT MCP)
`fc780465-2017-40d4-a0c5-307022471b92`	Sentinel Engine (analytics rules, UEBA, Advanced Hunting backend)	`LAQueryLogs`	Built-in scheduled query engine (NOT MCP). Also serves as the execution backend for Advanced Hunting — `RequestClientApp = "M365D_AdvancedHunting"` indicates AH queries from Triage MCP, Defender portal, or Security Copilot that hit connected LA tables (see Query 7). Separate from analytics rules (`RequestClientApp` empty or other values).

Collection	Endpoint URL	Purpose	Monitored by This Skill
Data Exploration	`https://sentinel.microsoft.com/mcp/data-exploration`	`query_lake`, `search_tables`, `list_sentinel_workspaces`, entity analyzer	✅ Phase 3 (CloudAppEvents)
Triage	`https://sentinel.microsoft.com/mcp/triage`	Incident triage, Advanced Hunting, entity investigation	✅ Phase 2 (MicrosoftGraphActivityLogs + SigninLogs — AppId `7b7b3966`)
Security Copilot Agent Creation	`https://sentinel.microsoft.com/mcp/security-copilot-agent-creation`	Create Microsoft Security Copilot agents for complex workflows	❌ Not yet monitored

AppId	Service	Telemetry Table	Notes
`aebc6443-996d-45c2-90f0-388ff96faa56`	Visual Studio Code	`SigninLogs`	VS Code as MCP client → Sentinel
`9ba5f2e4-6bbf-4df2-b19b-7f1bcb926818`	PowerPlatform-sentinelmcp-Connector	`SigninLogs`	Copilot Studio → Sentinel MCP
`04b07795-8ddb-461a-bbee-02f9e1bf7b46`	Azure CLI (DefaultAzureCredential)	`SigninLogs`, `AADNonInteractiveUserSignInLogs`, `LAQueryLogs`	Primary Azure MCP Server credential path (field-tested Feb 2026). `RequestClientApp` is empty in LAQueryLogs. Azure MCP appends `\n\| limit N` to query text. Shared AppId with manual `az` CLI — disambiguate via query text pattern or session correlation. 🔄 Previously documented as `1950a258` (AzurePowerShellCredential) — that path is obsolete

Server	Type	Endpoint / Repo	Purpose	Telemetry Surface
Power BI Remote MCP	Microsoft-hosted	`https://api.fabric.microsoft.com/v1/mcp/powerbi`	Query Power BI datasets, reports, and workspaces remotely via SSE transport	🟡 `PowerBIActivity` table (if ingested into Sentinel), Fabric audit logs
Power BI Modeling MCP	Local (stdio)	microsoft/powerbi-modeling-mcp	Local Power BI model operations (DAX queries, schema exploration)	❌ Local only — no Azure telemetry

Server	Type	Endpoint / Repo	Purpose	Telemetry Surface
Fabric RTI MCP Server	Local (stdio)	microsoft/fabric-rti-mcp	Query Azure Data Explorer clusters and Fabric Real-Time Intelligence Eventhouses via KQL	🟡 ADX audit logs, Fabric audit events
Azure MCP Server — Kusto namespace	Local (stdio)	Part of Azure MCP Server (`azmcp --namespace kusto`)	Manage ADX clusters, databases, tables, and queries via ARM	✅ Already covered (Azure ARM operations — Phase 4)
Kusto Query MCP	Copilot Studio built-in	Copilot Studio catalog	KQL query execution from Copilot Studio agents	🟡 CloudAppEvents (Copilot Studio workload)

Server	Type	Repo	Purpose	Telemetry Surface
Playwright MCP	Local (stdio)	microsoft/playwright-mcp (26.9k ⭐)	Browser automation via accessibility tree — enables LLMs to interact with web pages	❌ Local only — no Azure telemetry
GitHub MCP Server	Local (stdio)	github/github-mcp-server	GitHub repo operations (issues, PRs, code search) via PAT	❌ GitHub audit logs only, not in Sentinel
Microsoft Learn Docs MCP	Cloud-hosted	Certified Copilot Studio connector	Search and fetch official Microsoft Learn documentation	❌ Public docs, no security data

Category	MCP Servers	Security Relevance
Microsoft 365	Outlook Mail, Outlook Calendar, 365 User Profile, Teams, Word, 365 Copilot (Search)	🔴 High — email, calendar, user profile access
SharePoint & OneDrive	SharePoint and OneDrive, SharePoint Lists	🟠 Medium — file and data access
Administration	365 Admin Center	🔴 High — administrative control plane
Dataverse	Dataverse MCP	🟠 Medium — business data access
Dynamics 365	Sales, Finance, Supply Chain, Service, ERP, Contact Center (6 sub-variants)	🟡 Low-Medium — business application data
Fabric	Fabric MCP	🟠 Medium — analytics data access
Office 365 Outlook	Contact Management, Email Management, Meeting Management	🔴 High — email and contact data
Meta-Server	MCP Management MCP	🟠 Medium — manages other MCP servers via Dataverse/Graph

Category	Namespaces	Security-Relevant Tools
AI & ML	`foundry`, `search`, `speech`	AI Foundry model access, Search index queries
Identity	`role`	⚠️ RBAC role assignments — view and manage
Security	`keyvault`, `appconfig`, `confidentialledger`	🔴 Key Vault secrets/keys/certs, App Configuration
Databases	`cosmos`, `mysql`, `postgres`, `redis`, `sql`	Database access and management
Storage	`storage`, `fileshares`, `storagesync`, `managedlustre`	Blob, file, and storage account access
Compute	`appservice`, `functionapp`, `aks`	App Service, Functions, Kubernetes
Networking	`eventhubs`, `servicebus`, `eventgrid`, `communication`, `signalr`	Messaging and event services
DevOps	`bicepschema`, `deploy`, `monitor`, `workbooks`, `grafana`	Infrastructure deployment, monitoring
Governance	`policy`, `quota`, `resourcehealth`, `cloudarchitect`	Policy management, resource health
Other	`marketplace`, `virtualdesktop`, `loadtesting`, `acr`	VDI, container registry, load testing

Priority	Server	Why	How to Monitor
🔴 P1	Copilot Studio built-in M365 MCPs	Email, Teams, admin center access	`ai-agent-posture` skill + CloudAppEvents
🔴 P1	Security Copilot Agent Creation	Creates autonomous security agents	CloudAppEvents for agent creation events
🟠 P2	Power BI Remote MCP	Dataset query access via API	`PowerBIActivity` table if available
🟠 P2	Sentinel Custom MCP Tools	User-defined tools, same audit surface	Already visible in Phase 3 CloudAppEvents
🟡 P3	Fabric RTI MCP	ADX/Eventhouse data access	ADX diagnostic logs
🟡 P3	Kusto Query MCP (Copilot Studio)	KQL from Copilot Studio agents	CloudAppEvents (Copilot Studio workload)
⚪ P4	Playwright, GitHub, Learn Docs MCPs	Local/public, minimal telemetry	Not monitorable from Sentinel

Parameter	Small Env (default)	Large Env
`make_set(..., N)` for users	10	5
`make_set(..., N)` for endpoints	20–30	10
`make_set(..., N)` for errors	5	3
`take` on governance tables	25	15
`take` on endpoint rankings	25	15
`take` on error analysis	50	20

Dimension	Max Points	Green (0-5)	Yellow (6-12)	Red (13-20)
User Diversity	20	1-2 known users	3-5 users or 1 unknown	>5 users or unknown users
Endpoint Sensitivity	20	0% sensitive endpoints	1-30% sensitive	>30% calls to sensitive APIs
Error Rate	20	<1% errors	1-5% errors	>5% errors
Volume Anomaly	20	Within ±50% of daily avg	50-200% spike	>200% spike vs avg
Off-Hours Activity	20	<5% off-hours	5-20% off-hours	>20% calls outside business hours

Score	Meaning	Action
0–25	Healthy	✅ Normal MCP usage, no concerns
26–50	Elevated	🟡 Review — minor anomalies detected
51–75	Concerning	🟠 Investigate — multiple risk signals present
76–100	Critical	🔴 Immediate review — significant security risk

Field	Description	Example
`ToolName`	MCP tool invoked	`query_lake`, `list_sentinel_workspaces`, `search_tables`, `analyze_url_entity`
`Interface`	Execution interface — distinguishes MCP from direct	`IMcpToolTemplate` (MCP) vs `KqsService` (direct)
`ExecutionDuration`	Duration in seconds (as string)	`"2.4731712"`
`FailureReason`	Error message if failed	`"SemanticError: 'DeviceDetail' column does not exist"`
`TablesRead`	Tables accessed by the query	`"SigninLogs"`
`DatabasesRead`	Log Analytics workspace name	`"la-yourworkspace"`
`TotalRows`	Rows returned	`100`
`InputParameters`	Full tool input including KQL query text and workspaceId	JSON string with `query` and `workspaceId` keys

Signal	Azure MCP Server (Current)	Azure CLI (Manual)	Notes
AppId (SigninLogs)	`04b07795`	`04b07795`	Shared — not a unique differentiator
AADClientId (LAQueryLogs)	`04b07795`	`04b07795`	Shared
RequestClientApp (LAQueryLogs)	Empty (`""`)	Empty (`""`)	Shared — not a unique differentiator. Empty `RequestClientApp` is also used by 4+ other AADClientIds
Query text pattern (LAQueryLogs)	Appends `\n\| limit N` to all queries	No standard suffix	✅ Best differentiator — Azure MCP `monitor_workspace_log_query` always appends a limit operator
AzureActivity (Claims.appid)	`04b07795` (write ops only)	`04b07795`	Shared; read ops not logged. Use Q14 `HasLimitSuffix` for query-level differentiation

Action	Status
Rewriting a pre-authored query from scratch	❌ PROHIBITED
Removing `parse_json()` / `tostring()` wrappers from queries	❌ PROHIBITED
Substituting column names without schema verification	❌ PROHIBITED
Using `has` instead of `contains` for CamelCase fields	❌ PROHIBITED
Executing a query not from this section without completing the Pre-Flight Checklist	❌ PROHIBITED

Access Pattern	RecordType	Interface	Operation	What It Represents
MCP Server-driven	403	`IMcpToolTemplate`	`SentinelAIToolRunStarted`, `SentinelAIToolRunCompleted`	Tool calls via Sentinel Data Lake MCP (e.g., `query_lake`, `list_sentinel_workspaces`, `search_tables`)
Direct KQL	379	`Microsoft.SentinelGraph.AIPrimitives.Core.Services.KqsService`	`KQLQueryCompleted`	KQL queries executed directly via Sentinel Graph / Data Lake Explorer (no MCP intermediary)

Tier	Data Source	MCP Sources	Non-MCP Sources
Analytics Tier	`LAQueryLogs`	AH backend `fc780465` / `M365D_AdvancedHunting` (captures AH queries from Triage MCP, Defender portal, Security Copilot that hit connected LA tables; shared surface, see Query 7)	Sentinel Portal (`80ccca67`), Sentinel Engine analytics (`fc780465`, non-AH), Logic Apps (`de8c33bb`)
Data Lake Tier	`CloudAppEvents`	Data Lake MCP (RecordType 403, `IMcpToolTemplate`)	Direct KQL (RecordType 379, `KqsService`)
Graph API	`MicrosoftGraphActivityLogs`	Graph MCP (`e8c77dc2`)	—
Azure MCP	`SigninLogs`, `AADNonInteractiveUserSignInLogs`, `LAQueryLogs`	Azure MCP Server (`04b07795`, empty `RequestClientApp`, query text `\n	limit N` suffix)

mcp-usage-monitoring

Source facts

Install options

Review the source files

More from this repository

More from this repository

MCP Server Usage Monitoring — Instructions

Purpose

MCP Server Usage Monitoring — Instructions

Purpose

📑 TABLE OF CONTENTS

⚠️ CRITICAL WORKFLOW RULES - READ FIRST ⚠️

Known AppIds Reference

MCP Servers & AI Agents

Sentinel MCP Collection Endpoints

Client Applications

Portal & Platform Applications (Non-MCP — for context)

Extended Microsoft MCP Server Landscape (Reference)

Sentinel MCP Collections (Microsoft-Hosted)

Power BI MCP Servers

Fabric & Azure Data Explorer MCP Servers

Developer & Productivity MCP Servers

Copilot Studio Built-in MCP Servers (19+ servers)

Azure MCP Server — Full Tool Surface

Monitoring Expansion Priorities

⛔ MANDATORY: Sentinel Workspace Selection

When invoked from another skill (e.g., incident-investigation):

When invoked standalone (direct user request):

Output Modes

Mode 1: Inline Chat Summary (Default)

Mode 2: Markdown File Report

Markdown Rendering Notes

Scalability & Token Management

Guardrails for Large Environments

Indicators You're Hitting Token Limits

Quick Start (TL;DR)

MCP Usage Score Formula

Scoring Dimensions

Interpretation Scale

Sensitivity Classification

Off-Hours Definition

Execution Workflow

Phase 1: Graph MCP Server Analysis

Phase 2: Sentinel Triage MCP Analysis

Phase 3: Sentinel Data Lake MCP Analysis

Phase 4: Azure MCP Server Authentication & Queries

Phase 5: Workspace Query Governance

Phase 6: Cross-Server User Analysis

Phase 7: Score Computation & Report Generation

Sample KQL Queries

Query 1: Unified Daily MCP Activity Trend

Query 2: Graph MCP — Endpoint & Activity Summary

Query 3: Sentinel MCP — Authentication Events

Query 4: Sentinel MCP — Client App Breakdown

Query 5: Sentinel Triage MCP — API Call Activity (Dedicated AppId)

Query 6: Sentinel Triage MCP — Authentication Events (SigninLogs)

Query 7: LAQueryLogs — Advanced Hunting Downstream Queries (Supplementary Signal)

Query 8: All Workspace Query Sources — Complete Governance View

Query 9: Graph MCP — Caller Attribution (User vs SPN)

Query 10: Data Lake MCP — Access Pattern Summary

Query 11: Data Lake MCP — Interface Breakdown

Query 12: Data Lake MCP — Error Analysis

Query 13: Azure MCP Server — Authentication Events (SigninLogs)

Query 14: Azure MCP Server — Workspace Queries (LAQueryLogs)

Query 15: Top MCP Users — Cross-Server Breadth

Report Template

Inline Chat Report Structure