Connect your AI assistant to EcpPro
The EcpPro MCP server lets AI assistants such as Claude, ChatGPT and GitHub Copilot work with your EcpPro portal: look up tenants and users, check licences and subscriptions, and carry out user changes. You sign in with your own Microsoft account, and every action runs with your normal portal permissions.
Before you start
The MCP Access add-on
It must be enabled for your organisation in EcpPro, and your Microsoft 365 admin must grant its two consents on the add-on page.
Your EcpPro account
The assistant can only see and change what you can see and change in the portal. If you're read-only in the portal, you're read-only here too.
Your MCP server address
Open the MCP Access add-on in the EcpPro portal: the address is shown there with a copy button.
https://mcp.ecppro.com/au01/mcp. Use this same address in every assistant below, and name the server ecppro.There's no API key, client ID or secret to copy. Each assistant registers itself automatically and then opens the standard Microsoft sign-in. MFA and Conditional Access apply as usual.
Set up your assistant
Replace au01 with your own instance in each example.
Claude Code Tested
claude mcp add --transport http --scope user ecppro https://mcp.ecppro.com/au01/mcp- Start
claudeand run/mcp. - Select ecppro → Authenticate, and sign in with Microsoft in the browser.
/mcpnow shows connected.
GitHub Copilot CLI Tested
copilot mcp add --transport http ecppro https://mcp.ecppro.com/au01/mcpStart copilot and ask your first question; it opens the Microsoft sign-in the first time. The entry is saved in ~/.copilot/mcp-config.json.
GitHub Copilot in VS Code Being verified
- Open the Command Palette and run MCP: Add Server → HTTP.
- Enter your MCP server address, name it
ecppro, and save it to your user settings. - Sign in when VS Code asks, then use Copilot Chat in Agent mode.
Needs VS Code 1.101 or later. On Copilot Business or Enterprise, your GitHub admin must allow MCP servers.
Claude (claude.ai and Claude Desktop) Tested
- Open Settings → Connectors and choose Add custom connector.
- Name it EcpPro and enter your MCP server address.
- Click Connect and sign in with Microsoft. The EcpPro tools appear in the tools menu of new chats.
ChatGPT desktop app Tested
- Open Plugins (manage plugins, skills and MCPs) and select the MCPs tab.
- Choose Add → Connect to a custom MCP.
- Fill in the form:
Name ecpproType Streamable HTTP URL Your MCP server address, starting with https://Bearer token env var Leave empty Headers / Headers from environment variables Leave empty - Click Save, then sign in with Microsoft when asked.
- In a new chat, ask "what is my EcpPro scope?" to check the connection.
There's no token or header to add. Sign-in happens in the browser with your Microsoft account, and the app keeps the session. Check the URL carefully: it's easy to lose the first letter when pasting.
ChatGPT website Tested
- Settings → Apps & Connectors → Advanced, and turn on Developer mode. On Business and Enterprise plans an admin must allow this.
- Create a connector: name EcpPro, your MCP server address, authentication OAuth.
- Sign in with Microsoft, then turn the connector on from the tools menu in a new chat.
Some ChatGPT plans only allow read-only custom connectors, so the tools that make changes may not be available.
Microsoft Copilot Studio Being verified
- Open your agent → Tools → Add a tool → New tool → Model Context Protocol.
- Enter your MCP server address and choose OAuth 2.0 → Dynamic discovery.
- Create the connection, sign in, and add the tool to the agent.
OpenAI Codex CLI Tested
codex mcp add ecppro --url https://mcp.ecppro.com/au01/mcp
codex mcp login ecpproThe login command opens the Microsoft sign-in. codex mcp list then shows ecppro, and the tools are available in new Codex sessions.
Your first questions
Ask in plain language; the assistant picks the tools.
What is my EcpPro scope?
Shows who you're signed in as, your role, and the customer and tenants you can work with. Start here: it confirms the connection works.
List my tenants and their secure scores.
Lists your tenants with their domains, user counts and Microsoft Secure Score.
Which users at Contoso have a Business Premium licence but haven't signed in for 30 days?
Reads users, licences and sign-in activity for that tenant and answers the question.
Show me the subscriptions for Contoso and when each commitment ends.
Lists subscriptions with quantities, prices and commitment dates.
Disable Jane Smith at Contoso and forward her email to her manager.
Disabling a user shows you a preview first, and nothing happens until you confirm. Email forwarding is a Change tool (see the table below), so check what the assistant plans to do before you agree.
How changes are protected
Your permissions
Every call runs as you. The portal checks your role on each request, exactly as it does on screen.
Preview first
Tools that remove access or change billing return a preview and a confirmation code. Nothing changes yet.
You confirm
The change runs only when the assistant sends the code back. The code works once, for that exact change, and expires after 5 minutes.
Audit trail
Every tool call is recorded against your account in EcpPro.
Read the preview
Assistants can misread names. Check the tenant and user in the preview before you say yes.
Subscription changes go through your normal EcpPro approval and Microsoft commitment rules.
What the assistant can do
Read looks only Change makes a change Confirm makes a change only after you confirm a preview
You and your scope
| Tool | Type | What it does |
|---|---|---|
ecppro_core_my_scope | Read | Who you are, your role, and where you can work |
ecppro_core_me | Read | Your Microsoft sign-in details |
ecppro_core_ping · version · list_tools | Read | Connection check, server version, tool list |
Search and documentation
| Tool | Type | What it does |
|---|---|---|
ecppro_entities_search | Read | Find a tenant, tenant group, user or contact by name |
ecppro_docs_search | Read | Search EcpPro help documentation |
ecppro_documents_search | Read | Search documents stored in EcpPro |
Tenants, users and groups
| Tool | Type | What it does |
|---|---|---|
ecppro_tenants_list | Read | Tenants with domains, user counts and secure score |
ecppro_users_list | Read | Users in a tenant, with search and licence filters |
ecppro_users_refresh | Change | Refresh a user's details from Microsoft 365 |
ecppro_groups_list · list_members | Read | Groups and their members |
ecppro_users_list_group_memberships | Read | A user's groups |
ecppro_users_change_group_membership | Confirm | Add a user to or remove them from groups |
ecppro_users_enable | Change | Enable a user's sign-in |
ecppro_users_disable | Confirm | Disable a user's sign-in |
Licences, subscriptions and billing
| Tool | Type | What it does |
|---|---|---|
ecppro_tenant_licenses_list | Read | Licences a tenant owns and how many are used |
ecppro_users_list_licenses · get_license_disabled_plans | Read | A user's licences and switched-off services |
ecppro_users_update_licenses | Confirm | Assign or remove a user's licences |
ecppro_subscriptions_list | Read | Subscriptions, quantities, prices and commitment dates |
ecppro_billing_list_unbilled_services | Read | Services not yet billed |
Mailbox and calendar
| Tool | Type | What it does |
|---|---|---|
ecppro_users_get_mailbox_settings · get_focused_inbox | Read | Mailbox settings, forwarding and Focused Inbox |
ecppro_users_set_email_forward · cancel_email_forward | Change | Start or stop email forwarding, now or on a schedule |
ecppro_users_set_focused_inbox · set_gal_visibility | Change | Focused Inbox, and whether the user shows in the address book |
ecppro_users_get_mailbox_delegates | Read | Who has access to a mailbox |
ecppro_users_add_mailbox_delegate · update_mailbox_delegate | Change | Give or change mailbox access |
ecppro_users_remove_mailbox_delegate | Confirm | Remove mailbox access |
ecppro_users_get_calendar_permissions | Read | Who can see or edit a calendar |
ecppro_users_add_calendar_permission | Change | Share a calendar |
ecppro_users_remove_calendar_permission | Confirm | Remove calendar access |
Workflows and action items
| Tool | Type | What it does |
|---|---|---|
ecppro_workflows_list_available · list_runs · get_run | Read | Available workflows and the progress of runs |
ecppro_workflows_launch | Confirm | Start an offboarding, user, licensing or subscription workflow |
ecppro_action_items_list · get · waiting_count | Read | Action items waiting for you |
Common issues
Still stuck? Email support [at] ecppro.com with the assistant you use and the exact message you see.
Connecting and signing in
Microsoft says "Need admin approval" when I sign in
Your organisation hasn't granted the consents yet. A Microsoft 365 Global Admin grants both from the MCP Access add-on page in EcpPro. Once the page shows both as granted, sign in again.
Sign-in is blocked by my organisation's policy
A Conditional Access policy is stopping the sign-in (Microsoft shows error AADSTS53003). Ask your IT admin to allow the EcpPro MCP Authenticator app for your account.
I signed in with the wrong account
Use your work account, the one you use for the EcpPro portal. Remove the EcpPro connection from your assistant, add it again, and pick the right account when Microsoft asks.
"Access denied", or a message about the MCP Access add-on
The add-on isn't enabled for your organisation, or its consents aren't granted yet. Email support [at] ecppro.com with your organisation's name.
404, or "can't connect" straight after saving
The address is wrong. It must start with https:// and end in /mcp; a missing first letter (ttps://) is a common paste slip. Copy it again from the MCP Access add-on page.
My assistant asks for a bearer token, API key or header
Leave those fields empty. EcpPro uses Microsoft sign-in, so there's nothing to paste. The assistant opens the sign-in itself after you save the server.
"Connection expired" or 401
Your sign-in has run out. Authenticate again from your assistant's MCP or connector settings.
The browser didn't open for sign-in
The assistant prints the sign-in link instead. Open it yourself in a browser on the same computer.
Using the tools
The EcpPro tools don't appear, or new tools are missing
Assistants keep a copy of the tool list. Reconnect EcpPro in the assistant's MCP or connector settings, or restart the assistant, and the list refreshes.
The assistant says a tool call was "denied", "blocked by a hook" or "blocked by policy"
Something on your computer or in your organisation stopped the call before it reached EcpPro: a hook in the assistant's settings, a security tool, or an admin policy for that assistant. EcpPro never saw the request. Check the assistant's hooks and policies, or ask your IT admin.
GitHub Copilot doesn't offer MCP servers at all
On Copilot Business and Enterprise, MCP servers are off until a GitHub admin turns on the MCP servers policy for your organisation.
ChatGPT only shows the read tools
Some ChatGPT plans allow custom connectors to read only. The tools that make changes need a plan that allows full connectors, or a different assistant.
A change says "not allowed"
Your portal role doesn't allow that change. It's the same rule as on screen in the portal.
The assistant asks me for a GUID
Ask it "what is my EcpPro scope?" first. That gives it the customer and tenants you work with, so it can look up the rest itself.
The confirmation code didn't work
Each code works once, for that exact change, and expires after 5 minutes. Ask the assistant to make the change again to get a new preview and code.
Questions or access requests?
Email our support team with the assistant you use, or get in touch to enable the MCP Access add-on for your organisation.