|
| 1 | +--- |
| 2 | +title: Use the Microsoft Sentinel MCP connector in ChatGPT or Claude |
| 3 | +titleSuffix: Microsoft Security |
| 4 | +description: Learn how to turn on and use a custom Microsoft Sentinel's Model Context Protocol (MCP) connector in ChatGPT or Claude |
| 5 | +author: poliveria |
| 6 | +ms.topic: how-to |
| 7 | +ms.date: 12/09/2025 |
| 8 | +ms.author: pauloliveria |
| 9 | +ms.service: microsoft-sentinel |
| 10 | +ms.subservice: sentinel-platform |
| 11 | + |
| 12 | +#customer intent: As a security analyst, I want to use a custom Microsoft Sentinel MCP connector in ChatGPT. |
| 13 | +--- |
| 14 | + |
| 15 | +# Use the Microsoft Sentinel MCP connector in ChatGPT or Claude (preview) |
| 16 | + |
| 17 | +> [!IMPORTANT] |
| 18 | +> This information relates to a prerelease product that may be substantially modified before it's released. Microsoft makes no warranties, expressed or implied, with respect to the information provided here. |
| 19 | +
|
| 20 | +This article shows you how to enable and use a custom Microsoft Sentinel Model Context Protocol (MCP) connector in ChatGPT by OpenAI or Claude by Anthropic. By using this approach, Security Operations Center (SOC) analysts can run security tasks by using Sentinel MCP. |
| 21 | + |
| 22 | + |
| 23 | +## Prerequisites |
| 24 | +Before configuring a Microsoft Sentinel MCP connector in ChatGPT or Claude, you must have the following prerequisites: |
| 25 | +- A ChatGPT Pro or a Claude Pro, Max, Team, or Enterprise plan subscription |
| 26 | +- A Microsoft Entra application, which represents ChatGPT as a client |
| 27 | +- [Microsoft Sentinel data lake](sentinel-lake-onboarding.md) |
| 28 | +- Tenant-level administrative privileges |
| 29 | + |
| 30 | +To add a Microsoft Entra application, follow these steps: |
| 31 | +1. Open your tenant's [Microsoft Entra admin center](https://entra.microsoft.com/), go to **App registrations**, and then select **New registration**. |
| 32 | +1. On **Register an application**, enter a friendly user-facing **Name** for the app. |
| 33 | +1. Under **Redirect URIs**, select **Select a platform** and then choose **Web**. |
| 34 | +1. Add any of the following URLs: |
| 35 | + - **For ChatGPT** |
| 36 | + ``` |
| 37 | + https://chatgpt.com/connector_platform_oauth_redirect |
| 38 | + ``` |
| 39 | + - **For Claude** |
| 40 | + ``` |
| 41 | + https://claude.ai/api/mcp/auth_callback |
| 42 | + ``` |
| 43 | +1. Select **Register**. |
| 44 | +1. On your newly registered app's page, go to **Manage** > **API permissions**, and then select **Add a permission**. |
| 45 | +1. On the **APIs my organization uses** tab, search for `Sentinel Platform Services`. |
| 46 | +1. Choose **SentinelPlatform.DelegatedAccess**, and then select **Add permissions**. |
| 47 | +1. Select **Manage** > **Certificates & secrets** and select **New client secret**. |
| 48 | +1. Add a **Description** for your client secret and set an expiration date. Select **Add**. |
| 49 | +1. Copy the **Value** and save it in a secure manner. This value disappears once you navigate away from the page. |
| 50 | +1. Go back to your app's **Overview** page and copy its **Application (client) ID**. |
| 51 | +
|
| 52 | +## Create a custom Microsoft Sentinel MCP connector |
| 53 | +
|
| 54 | +
|
| 55 | +To create a custom Microsoft Sentinel connector, follow these steps: |
| 56 | +
|
| 57 | +### [ChatGPT](#tab/chatgpt) |
| 58 | +
|
| 59 | +>[!NOTE] |
| 60 | +>- If you're using the ChatGPT desktop application, you must first complete this connector setup in the ChatGPT web version. |
| 61 | +>- For ChatGPT Enterprise, an administrator can roll out a connector to all users in that ChatGPT organization. |
| 62 | +
|
| 63 | +1. Turn on the ChatGPT developer mode. In ChatGPT, select your account icon, go to **Apps & connectors** > **Advanced Settings**, and toggle **Developer mode**. |
| 64 | +1. Go back to **Apps & connectors** and select **Create Connector**. |
| 65 | +1. Provide the following required details: |
| 66 | + - **Connector name:** For example, `Microsoft Sentinel MCP` |
| 67 | + - **MCP Server URL:** `https://sentinel.microsoft.com/mcp/data-exploration` |
| 68 | + - **Client ID:** The **Application (client) ID** of the Microsoft Entra application you created previously. |
| 69 | +1. When prompted, complete the OAuth consent flow. Once the MCP connector authenticates successfully, it appears in your ChatGPT connector list. |
| 70 | +
|
| 71 | +### [Claude](#tab/claude) |
| 72 | +
|
| 73 | +1. Go to https://claude.ai/customize/connectors, to create a new custom connector. Select the **+** icon and choose **Add a custom connector**. |
| 74 | +1. Provide the following required details: |
| 75 | + - **Connector name:** For example, `Microsoft Sentinel MCP` |
| 76 | + - **MCP Server URL:** `https://sentinel.microsoft.com/mcp/data-exploration` |
| 77 | + - **Client ID:** The **Application (client) ID** of the Microsoft Entra application you created previously. |
| 78 | + - **OAuth Client Secret:** The client secret of the Microsoft Entra application you created previously. |
| 79 | +1. When prompted, complete the OAuth consent flow. Once the MCP connector authenticates successfully by using the Microsoft Entra credentials, it appears in your Claude connector list. |
| 80 | +1. Select the MCP connector and choose **Connect**. |
| 81 | +1. Select **Configure** to determine which tools to allow for your environment. |
| 82 | +
|
| 83 | +## Use the custom Microsoft Sentinel MCP connector in a chat |
| 84 | +
|
| 85 | +To attach and use a Microsoft Sentinel connector, follow these steps: |
| 86 | +
|
| 87 | +### [ChatGPT](tab/#chatgpt-1) |
| 88 | +
|
| 89 | +1. Start a new chat in ChatGPT. |
| 90 | +1. Select the **(+)** icon next to the message box. |
| 91 | +1. Select **More** > **Microsoft Sentinel MCP Connector**. The connector's tools become available automatically, and ChatGPT can begin calling Sentinel operations on your behalf. |
| 92 | +
|
| 93 | +### [Claude](tab/#claude-1) |
| 94 | +
|
| 95 | +Start a new chat in Claude. The connector tools become available automatically, and Claude can begin calling Microsoft Sentinel operations on your behalf. |
| 96 | +
|
| 97 | +>[!NOTE] |
| 98 | +> You can only use the [data exploration tool collection](sentinel-mcp-data-exploration-tool.md). |
| 99 | +
|
| 100 | +
|
| 101 | +## Related content |
| 102 | +- [Get started with Microsoft Sentinel MCP server](sentinel-mcp-get-started.md) |
| 103 | +- [Tool collection in Microsoft Sentinel MCP server](sentinel-mcp-tools-overview.md) |
0 commit comments