Blog Post

Microsoft Sentinel Blog
1 MIN READ

Microsoft Sentinel MCP Server with external AI models (Claude) for natural language investigations

mcasgrain's avatar
mcasgrain
Icon for Microsoft rankMicrosoft
Apr 01, 2026

Security teams are increasingly exploring how AI assistants support them in investigating incidents, asking questions, and exploring their data. At the same time, controlling how data is accessed rem...
Updated Apr 22, 2026
Version 4.0
BenStegink's avatar
BenStegink
Steel Contributor
Apr 02, 2026

I have the same problem as pvshetty1​ in that "Platform Services" isn't listed under APIs my organization users.

Amol_Dixit's avatar
Amol_Dixit
Icon for Microsoft rankMicrosoft
Apr 06, 2026

Thanks for reporting BenStegink​. We have fixed the documentation to include correct permissions. Please let us know if you hit any other issues.

  • BenStegink's avatar
    BenStegink
    Steel Contributor
    Apr 06, 2026

    Amol_Dixit​ I'm still having additional issues getting it working. Once I configured all the API permissions and try to connecting from Claude I get the OAth consent flow for the AI permissions. Once I accept for the org (I'm a global admin). I get the following error in Claude:


    If I try to go through the connection again, I just get stuck in a loop of having to go through the OAuth flow follow by a failure in Claude


    If I look in Entra, I'm seeing successful logins, so it looks like everything is successful. So there appears to be some issue with the handoff back to Claude. I feel like if this was a widespread issue, more people would be commenting about it, but I also can't find where the issue might be after pouring over this.