Authentication & Connection Tools ​

These two tools answer questions you ask before doing real work: who am I authenticated as, and which Entra tenants are configured. They never modify anything and are always safe to call.

Roles and access ​

InfraScout recognizes five roles, assigned in your Entra ID app registration rather than inside the product. Each role grants a level of capability, and they fall into two independent dimensions: which actions you can take, and whether you can connect an AI client over MCP at all.

  • Users — read-only access to the web dashboard. Cannot connect over MCP.
  • MCPUser — the read-only Users capability plus permission to connect an AI client over MCP.
  • Operator — run assessments and session-scoped actions in the dashboard. Cannot connect over MCP.
  • MCPOperator — the full Operator capability plus MCP connect. A single MCPOperator assignment is all an operator needs to drive assessments through an AI client.
  • Admin — full administrative access, including MCP connect.

To connect an AI client such as Claude, a user needs exactly one MCP-capable role: MCPUser, MCPOperator, or Admin. Plain Users and Operator can use the dashboard but cannot open an MCP session. Entra assigns a single role per user; auth_whoami reports that one effective role, and when several are present the most capable one is shown.

auth_whoami ​

Returns the authenticated caller's identity as carried in the access token — tenant ID, user ID, effective role, and group memberships. Use it to confirm your AI client is connected to the right InfraScout tenant and operating with the role you expect. The reported role is your single effective role: when more than one role is present, the most capable one wins (see Roles and access).

Beyond identity, auth_whoami also reports the health of your session token: when it expires, how much time remains, whether a refresh token is available, the granted scopes, and whether the grant is delegated (signed-in user) or app-only. Because of this, it is the first tool to reach for when an AI client unexpectedly loses access — a near-zero expires_in_seconds with no refresh token explains a connection that silently went stale.

Use cases. Verify connectivity right after configuring an MCP client. Confirm you are operating against the intended tenant when you have access to multiple. Check whether you hold a role with the Operator or Admin capability a session-scoped action requires. Diagnose a sudden loss of access by inspecting token expiry and refresh-token availability.

Parameters. None.

Example prompt.

"Use the auth_whoami tool to show me my InfraScout identity."

entra_connection_list ​

Lists every Entra ID tenant connection configured for your InfraScout tenant — connection ID, friendly name, type, target Entra tenant ID, and whether the connection is enabled. Credentials are never returned.

You rarely need to call this directly. Every mscloud_* tool resolves the default connection automatically when connection_id is omitted. Reach for entra_connection_list only when the user explicitly asks which tenants are configured, or when you need to target a specific non-default tenant — typically a multi-tenant or GDAP scenario.

Use cases. Show which customer tenants an MSP has connected. Pick a non-default connection_id for a tool call that should run against a specific tenant. Confirm a newly added connection is live before running an assessment against it.

Parameters. None.

Example prompt.

"Which Entra tenants are connected to InfraScout right now?"

Each entry returns the connection_id, friendly name, target entra_tenant_id, an enabled flag, and a type — default for the tenant's primary connection and gdap for delegated admin connections to customer tenants.

TIP

For setup of a new Entra connection, see Connecting Entra ID. For the high-level capability map across the connected tenant, see Microsoft Cloud Tools.