Fabric Core MCP and Microsoft Graph MCP: what they actually do today

Two remote MCP servers for Fabric and Entra admins: setup, tools, scopes, an end-to-end example, and where direct REST APIs are still the better choice.

MCP (Model Context Protocol) is an open protocol that lets an AI agent discover and call tools exposed by a server. For admins, that means a chat prompt in VS Code can turn into real API calls, under your own identity.

Microsoft now ships two remote MCP servers relevant to Fabric and Entra admins. They have different auth, different risk and different jobs.

	Fabric Core MCP	Microsoft MCP Server for Enterprise
Endpoint	`https://api.fabric.microsoft.com/v1/mcp/core`	`https://mcp.svc.cloud.microsoft/enterprise`
Transport	Streamable HTTP	HTTP
Auth	Entra ID sign-in, scope `https://api.fabric.microsoft.com/.default`	Entra ID, delegated `MCP.*` scopes
Setup	No tenant provisioning documented	One-time tenant provisioning
Can write?	Yes (workspaces, items, roles)	No: every documented scope is `Read`
Backs onto	Fabric REST API	Microsoft Graph

Docs read: the Fabric pages were last updated 2026-09-29 and the Graph page 2026-05-20. Both are young, so check them before relying on any detail here.

Fabric Core MCP

Setup (VS Code + GitHub Copilot)

Command palette → MCP: Add Server → HTTP → paste the URL → name it fabric → sign in. Or add it to .vscode/mcp.json:

{
  "servers": {
    "fabric": {
      "type": "http",
      "url": "https://api.fabric.microsoft.com/v1/mcp/core"
    }
  }
}

Verify in Copilot Chat with List all my Fabric workspaces. You need at least Viewer on one workspace.

What the server can do

The tools reference lists 29 tools. All of them are resource management:

search_catalog
workspaces   list_workspaces  get_workspace  create_workspace  update_workspace  delete_workspace
roles        add_workspace_role  list_workspace_roles  get_workspace_role
             update_workspace_role  delete_workspace_role
items        list_items  get_item  create_item  update_item  delete_item
             get_item_definition  update_item_definition  bulk_move_items
folders      create_folder  list_folders  get_folder  update_folder  delete_folder  move_folder
capacity     list_capacities
operations   get_operation_state  get_operation_result
help         get_knowledge

Two things the quickstart alone does not tell you:

It is not only scaffolding. create_item and update_item_definition cover item types such as notebooks and pipelines, so the server can create and edit item definitions. It can also delete workspaces and items, permanently.
It cannot touch data. The overview says these tools are not general-purpose for querying or modifying lakehouse tables. No loading, no SQL, no running pipelines or notebooks.

The quickstart examples stay with the first group of tasks:

Create a workspace called Sales Analytics Dev
Create a lakehouse named CustomerData in the Dev workspace
List all role assignments for the Finance workspace

Microsoft MCP Server for Enterprise (Graph)

One-time tenant provisioning

You need the Application Administrator or Cloud Application Administrator role.

Install-Module Microsoft.Entra.Beta -Force -AllowClobber   # v1.0.13 or later

Connect-Entra -Scopes 'Application.ReadWrite.All', 'Directory.Read.All', 'DelegatedPermissionGrant.ReadWrite.All'

Grant-EntraBetaMCPServerPermission -ApplicationName VisualStudioCode

This registers the MCP server in your tenant and grants all its permissions to VS Code.

Verify, connect, disable

# Both service principals exist?
GET https://graph.microsoft.com/v1.0/servicePrincipals?$select=id,appId,displayName
    &$filter=appId in('e8c77dc2-69b3-43f4-bc51-3213c9d915b4','aebc6443-996d-45c2-90f0-388ff96faa56')

# Which scopes exist? Look for isEnabled = true
GET https://graph.microsoft.com/v1.0/servicePrincipals(appId='e8c77dc2-69b3-43f4-bc51-3213c9d915b4')/oauth2PermissionScopes

# Disable (Microsoft-owned, so it cannot be deleted)
PATCH https://graph.microsoft.com/v1.0/servicePrincipals(appId='e8c77dc2-69b3-43f4-bc51-3213c9d915b4')
{ "accountEnabled": false }

e8c77dc2… is the MCP server and aebc6443… is VS Code. For connecting, use the install link on the Graph page, or add the server URL to mcp.json the same way as above. Custom MCP clients need their own app registration, with scopes managed through Grant-EntraBetaMCPServerPermission -ApplicationId … -Scopes … and Revoke-EntraBetaMCPServerPermission.

Scopes and limits

Scopes follow MCP.{GraphScope}. All 41 listed are read scopes:

MCP.User.Read.All                 MCP.Group.Read.All
MCP.Policy.Read.ConditionalAccess MCP.AuditLog.Read.All
MCP.SecurityIncident.Read.All     MCP.RoleManagement.Read.Directory
MCP.UserAuthenticationMethod.Read.All  ... and 34 more

The docs state that only delegated permissions are supported and app-only workflows are not. They do not use the words “read-only”, but with no write scope in the list, that is the practical result today.

Typical questions: Who has an eligible Global Administrator assignment? Which Conditional Access policies exist? Show failed sign-ins.

Using them together

The Fabric server’s role tools want principal IDs. The Graph server resolves names and emails to those IDs. The prompt:

Add the Marketing team to Sales Analytics Dev as Viewers. Create the workspace and a lakehouse CustomerData first.

You (Copilot Chat, Entra sign-in)
  │
  ├─► Graph MCP   → find group "Marketing"          → group object ID   (read)
  │
  └─► Fabric MCP  → create_workspace "Sales Analytics Dev"              (write)
                  → create_item  Lakehouse "CustomerData"               (write)
                  → add_workspace_role  group ID, Viewer                (write)
                  → list_workspace_roles                                (verify)

Check one detail first: the tool reference describes add_workspace_role as granting access to a user, while the quickstart prompt uses a team. Confirm group assignment works in your tenant before you rely on it.

Limitations and cautions

Your permissions, your blast radius. Both servers act as the signed-in identity. An admin session means admin-level calls, including workspace deletion.
Approval prompts are the safety net. Microsoft warns that autonomous or misconfigured clients can take destructive actions, and that “do not delete” safeguards are not part of the MCP standard. Read each proposed tool call and do not auto-approve write tools.
Delegated-only means interactive. A person must sign in. Scheduled jobs, pipelines and service principals are out.
Data leaves the Fabric boundary. Prompts and results pass through your MCP client and model. Compliance is your responsibility.
Both are young. The Graph provisioning module is a beta.

MCP or REST?

Task	Use
Ad hoc admin work, exploring a tenant	MCP
Read-only audit and governance questions	Graph MCP
One-off dev workspace with a few role assignments	Both together
Scheduled or repeatable provisioning	Fabric REST API, with a service principal
Unattended reporting or Entra automation	Microsoft Graph API, app-only
Loading data, running pipelines and notebooks	Not this server. Use the local Fabric MCP server (OneLake files, Data Factory) or your normal tooling

The local server runs on your machine and offers API docs, OneLake file access and Data Factory workflows, which is the closer fit when you are building content. It still sends data through your MCP client and model.

Rule of thumb: MCP to explore and to scaffold interactively. Direct APIs, in version-controlled code, for anything that must run again.