Use Microsoft Sentinel MCP tools in Microsoft Foundry (preview)

Important

This information relates to a prerelease product that may be substantially modified before it's released. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.

This article shows you how to add Microsoft Sentinel's Model Context Protocol (MCP) collection of security tools or your own custom tools to your AI agents in Microsoft Foundry.

For information about how to get started with MCP tools, see the following articles:

Add a Microsoft Sentinel tool collection

To add a Microsoft Sentinel tool collection in Microsoft Foundry, follow these steps:

Go to Microsoft Foundry's agent builder then select Build > Agent.
Enter a name for your agent.
On the Tools panel, select Add a new tool to ground your agent instructions with relevant security data from Microsoft Sentinel.
On the Select a tool pop-up window, search for Sentinel and choose any available Microsoft Sentinel tool collection (for example, Microsoft Sentinel – Data exploration).
Select Connect.

Your agent is now connected with Sentinel's available collection of tools. You can start prompting your agent and use the tools to deliver outcomes.

Add a custom tool collection

Custom tools let you build deterministic workflows by prescribing exactly what data agents can reason over. To add your custom tool collection in Microsoft Foundry, follow these steps:

Step 1: Register an app in Azure portal

Open your tenant's Azure portal then go to App registrations > New registration.
On the Register an application page, enter a friendly user-facing Name for the app, then select Register.
On your newly registered app's page, go to Manage > API permissions, then select Add a permission.
On the flyout panel that appears, go to the APIs my organization uses tab and search for Sentinel Platform Services.
Choose SentinelPlatform.DelegatedAccess, then select Add permissions.
Back on your app's page, go to Manage > Certificates & secrets, then select the Client secrets tab.
Select New client secret. On the flyout panel that appears, add a Description, then select Add.

Tip

Create a single app for all Sentinel custom tools, but create separate client secrets for each custom collection you want to add to your agent.

Important

Once the client secret is added, copy and save its Value, which you use in the next steps.
Go back to the Azure portal's Overview page and copy and save the following values for the next steps:
- Application (client) ID
- Directory (tenant) ID

Step 2: Add your custom MCP tool

Add the custom MCP tool to your agent in Microsoft Foundry by following these steps:

Go to Microsoft Foundry and select an existing agent or a newly created agent.
On the agent's page, go to the Tools section then select Add > + Add a new tool.
In the Add a new tool pop-up window, select Custom > Model Context Protocol (MCP), and then select Create.
Add the following values:
- Name: Enter a friendly name for your tool
- Remote MCP server endpoint: Paste the endpoint you copied from your custom tool collection; it should have the following format:
```
https://sentinel.microsoft.com/mcp/custom/<name of your custom collection>
```
- Authentication: OAuth Identity Passthrough
- Client ID: Use the Application (client) ID value you saved previously
- Client secret: Use the secret value you saved previously
- Token URL and Refresh URL: Use the following format and replace <tenant ID> with the Directory (tenant) ID value you saved previously:
```
https://login.microsoftonline.com/<tenant ID>/oauth2/v2.0/token
```
- Authorization URL: Use the following format and replace <tenant ID> with the Directory (tenant) ID value you saved previously:
```
https://login.microsoftonline.com/<tenant ID>/oauth2/v2.0/authorize
```
- Scope: Use the following:
```
4500ebfb-89b6-4b14-a480-7f749797bfcd/.default,offline_access
```
Select Connect. Your tool is created successfully and a redirect URL is generated. Copy and save the redirect URL.

Step 3: Authenticate Microsoft Foundry to use your custom tool

To authenticate Microsoft Foundry with the custom tool, complete the following steps:

Go back to your tenant's Azure portal and into the app you just added then select Add a redirect URI.
Select + Add a platform > Web.
In the Redirect URIs text box, add the redirect URL you copied then select Configure.
Go back to Microsoft Foundry and use a prompt that matches the tool you created. On your first attempt, select Open consent to give consent to your signed in user account.
In the consent pop-up window, select Allow access.