Microsoft have really tightened up the permissions around installing Enterprise Apps in Entra. This is generally a very good move as many account compromises have ended up with the attacker installing an Entra app to provide them with persistent access to the account even after passwords are changed and MFA tokens are rotated. It can however cause friction when you, as a Global Admin, need to install an Enterprise App in Entra and you don’t have an account for the third-party service in question. Here is how to add the two Enterprise Apps, and grant admin consent to the required permissions, for Claude without needing to have a login for Claude.
Log in to the Entra admin centre at https://entra.microsoft.com/
On the main page, one of the cards will be showing your Tenant ID. It’s a UUID thart will look something like df0cfb86-786f-4c28-a140-9b91a8ae2e4c. Make a note of this value.
If you are not seeing it on the card on the main Entra admin centre page, click on Overview in the left-hand sidebar and you’ll see it under your organisation name in the Basic information section.
Use the Tenant ID to construct the following two URLs:
Microsoft 365 MCP Client for Claude:
https://login.microsoftonline.com/{your-tenant-id}/adminconsent?client_id=08ad6f98-a4f8-4635-bb8d-f1a3044760f0Microsoft 365 MCP Server for Claude:
https://login.microsoftonline.com/{your-tenant-id}/adminconsent?client_id=07c030f6-5743-41b7-ba00-0a6e85f37c17Replace {your-tenant-id} with the UUID for your tenancy.
In the same browser that you’re logged into the Entra admin centre, copy and paste the first url into the address bar. This will take you to a permissions consent screen showing all of the permissions that Claude is requesting – it’s a lot.
Tick the checkbox to consent for your organisation and then click Accept. It will then drop you back at a login page on the claude.ai site.
Repeat this for the second url, then go to Entra ID > Enterprise apps and click twice on the Created On column heading to show the newest apps first.
You should see the two M365 MCP Claude apps at the top of the list.
Once you’ve done this, then your end users can use the Claude connector by going to either Organisation Settings > Connectors for team and enterprise plans, or Customise > Connectors for personal plans.
Comments