|
| 1 | +--- |
| 2 | +title: Use the Microsoft Sentinel MCP connector in ChatGPT or Claude |
| 3 | +titleSuffix: Microsoft Security |
| 4 | +description: Learn how to turn on and use a custom Microsoft Sentinel's Model Context Protocol (MCP) connector in ChatGPT or Claude |
| 5 | +author: poliveria |
| 6 | +ms.topic: how-to |
| 7 | +ms.date: 12/09/2025 |
| 8 | +ms.author: pauloliveria |
| 9 | +ms.service: microsoft-sentinel |
| 10 | +ms.subservice: sentinel-platform |
| 11 | +ms.custom: |
| 12 | + - sfi-ga-nochange |
| 13 | +#customer intent: As a security analyst, I want to use a custom Microsoft Sentinel MCP connector in ChatGPT. |
| 14 | +--- |
| 15 | + |
| 16 | +# Use the Microsoft Sentinel MCP connector in ChatGPT or Claude (preview) |
| 17 | + |
| 18 | +> [!IMPORTANT] |
| 19 | +> This information relates to a prerelease product that may be substantially modified before it's released. Microsoft makes no warranties, expressed or implied, with respect to the information provided here. |
| 20 | +
|
| 21 | +This article shows you how to enable and use a custom Microsoft Sentinel Model Context Protocol (MCP) connector in ChatGPT by OpenAI or Claude by Anthropic. By using this approach, Security Operations Center (SOC) analysts can run security tasks by using Microsoft Sentinel MCP. |
| 22 | + |
| 23 | + |
| 24 | +## Prerequisites |
| 25 | +Before configuring a Microsoft Sentinel MCP connector in ChatGPT or Claude, you must have the following prerequisites: |
| 26 | +- A ChatGPT Pro or a Claude Pro, Max, Team, or Enterprise plan subscription. |
| 27 | +- A Microsoft Entra application, which represents ChatGPT or Claude as a client; for more information, see [Add a Microsoft Entra application](#add-a-microsoft-entra-application). |
| 28 | +- [Microsoft Sentinel data lake](sentinel-lake-onboarding.md). |
| 29 | +- Tenant-level administrative privileges. |
| 30 | + |
| 31 | +> [!IMPORTANT] |
| 32 | +> Use roles with the fewest permissions to help improve security for your organization. Global Administrator is a highly privileged role. Limit its use to emergency scenarios when you can't use an existing role. |
| 33 | +
|
| 34 | +### Add a Microsoft Entra application |
| 35 | +To add a Microsoft Entra application, follow these steps: |
| 36 | +1. Open your tenant's [Microsoft Entra admin center](https://entra.microsoft.com/), go to **App registrations**, and then select **New registration**. |
| 37 | +1. On **Register an application**, enter a friendly user-facing **Name** for the app. |
| 38 | +1. Under **Redirect URIs**, select **Select a platform** and then choose **Web**. |
| 39 | +1. Add any of the following URLs: |
| 40 | + - **For ChatGPT** |
| 41 | + ``` |
| 42 | + https://chatgpt.com/connector_platform_oauth_redirect |
| 43 | + ``` |
| 44 | + - **For Claude** |
| 45 | + ``` |
| 46 | + https://claude.ai/api/mcp/auth_callback |
| 47 | + ``` |
| 48 | +1. Select **Register**. |
| 49 | +1. On your newly registered app's page, go to **Manage** > **API permissions**, and then select **Add a permission**. |
| 50 | +1. On the **APIs my organization uses** tab, search for ` Platform Services`. |
| 51 | +1. Choose **Platform.DelegatedAccess**, and then select **Add permissions**. |
| 52 | +1. Select **Manage** > **Certificates & secrets** and select **New client secret**. |
| 53 | +1. Add a **Description** for your client secret and set an expiration date. Select **Add**. |
| 54 | +1. Copy the **Value** and save it in a secure manner. This value disappears once you navigate away from the page. |
| 55 | +1. Go back to your app's **Overview** page and copy its **Application (client) ID**. |
| 56 | +
|
| 57 | +## Create and use a custom Microsoft MCP connector |
| 58 | +
|
| 59 | +
|
| 60 | +To create and use a custom Microsoft connector, follow these steps: |
| 61 | +
|
| 62 | +### [ChatGPT](#tab/chatgpt) |
| 63 | +
|
| 64 | +>[!NOTE] |
| 65 | +>- If you're using the ChatGPT desktop application, you must first complete this connector setup in the ChatGPT web version. |
| 66 | +>- For ChatGPT Enterprise, an administrator can roll out a connector to all users in that ChatGPT organization. |
| 67 | +
|
| 68 | +**To create a custom connector:** |
| 69 | +
|
| 70 | +1. Turn on the ChatGPT developer mode. In ChatGPT, select your account icon, go to **Apps & connectors** > **Advanced Settings**, and toggle **Developer mode**. |
| 71 | +1. Go back to **Apps & connectors** and select **Create Connector**. |
| 72 | +1. Provide the following required details: |
| 73 | + - **Connector name:** For example, `Microsoft MCP` |
| 74 | + - **MCP Server URL:** `https://.microsoft.com/mcp/data-exploration` |
| 75 | + - **Client ID:** The **Application (client) ID** of the Microsoft Entra application you created previously. |
| 76 | +1. When prompted, complete the OAuth consent flow. Once the MCP connector authenticates successfully, it appears in your ChatGPT connector list. |
| 77 | +
|
| 78 | +**To attach and use the connector:** |
| 79 | +1. Start a new chat in ChatGPT. |
| 80 | +1. Select the **(+)** icon next to the message box. |
| 81 | +1. Select **More** > **Microsoft MCP Connector**. The connector's tools become available automatically, and ChatGPT can begin calling Microsoft Sentinel operations on your behalf. |
| 82 | +
|
| 83 | +### [Claude](#tab/claude) |
| 84 | +
|
| 85 | +**To create a custom connector:** |
| 86 | +
|
| 87 | +1. Go to https://claude.ai/customize/connectors, to create a new custom connector. Select the **+** icon and choose **Add a custom connector**. |
| 88 | +1. Provide the following required details: |
| 89 | + - **Connector name:** For example, `Microsoft Sentinel MCP` |
| 90 | + - **MCP Server URL:** `https://sentinel.microsoft.com/mcp/data-exploration` |
| 91 | + - **Client ID:** The **Application (client) ID** of the Microsoft Entra application you created previously. |
| 92 | + - **OAuth Client Secret:** The client secret of the Microsoft Entra application you created previously. |
| 93 | +1. When prompted, complete the OAuth consent flow. Once the MCP connector authenticates successfully by using the Microsoft Entra credentials, it appears in your Claude connector list. |
| 94 | +1. Select the MCP connector and choose **Connect**. |
| 95 | +1. Select **Configure** to determine which tools to allow for your environment. |
| 96 | +
|
| 97 | +**To attach and use the connector:** |
| 98 | +
|
| 99 | +Start a new chat in Claude. The connector tools become available automatically, and Claude can begin calling Microsoft Sentinel operations on your behalf. |
| 100 | +
|
| 101 | +>[!NOTE] |
| 102 | +> You can only use the [data exploration tool collection](sentinel-mcp-data-exploration-tool.md). |
| 103 | +
|
| 104 | +--- |
| 105 | +
|
| 106 | +
|
| 107 | +## Related content |
| 108 | +- [Get started with Microsoft Sentinel MCP server](sentinel-mcp-get-started.md) |
| 109 | +- [Tool collection in Microsoft Sentinel MCP server](sentinel-mcp-tools-overview.md) |
![learn-build-service-prod[bot]](https://avatars.githubusercontent.com/in/237442?v=4&size=40){kind=avatar}
0 commit comments