Skip to main content

Get started with the ShareGate Protect MCP server

How to connect your AI tool to ShareGate Protect using the MCP server to query Microsoft 365 governance data

Use the ShareGate Protect Model Context Protocol (MCP) server to query your Microsoft 365 governance data and take remediation actions, directly from any AI tool that supports MCP.

Ask governance questions in natural language, explore your tenant data, and get real results back from ShareGate Protect without leaving your AI tool.

Note: The MCP server acts on your behalf. It can never do more in ShareGate Protect than your own account allows, and it only takes remediation actions or manages policies if Write Guard is on for your workspace and your workspace admin has consented to Remediation permissions in ShareGate Protect.

Prerequisites

Before connecting, make sure you have:

  • Access to ShareGate Protect

  • An AI tool that supports MCP

  • Remediation consent granted in ShareGate Protect, if you want to take remediation actions or manage policies through the MCP server

What you can do

Once connected, you can ask your AI tool to explore, act on, and automate your Microsoft 365 governance data from ShareGate Protect.

For example, you can:

  • Explore your tenant. Filter and browse sites, groups, teams, OneDrives, users, licenses, and sharing links by activity, ownership, storage, and more.

  • Review governance insights. Retrieve active Protect insights for your workspace, such as inactive sites, overshared content, and external sharing exposure.

  • Track governance metrics. Pull daily measurements for up to 365 days across key governance metrics.

  • Take remediation actions. Delete a sharing link, change a group or team's visibility, manage group owners, remove external guests, archive or delete a site, and more. These are the same actions available in the Protect web app.

  • Create and manage automated policies. Preview, launch, pause, and modify policies through your AI tool, the same as you can from the Policies tab.

  • Review activity. Query the Activity Log to check the status of an action or review past activity. Actions taken through the MCP server appear with the MCP source, so you can tell them apart from manual and policy actions.

  • Work across multiple workspaces. If you manage more than one ShareGate workspace, switch between them mid-conversation or run cross-workspace analysis.

Note: Workspace admins control whether the MCP server can perform remediation actions and manage policies, using the Write Guard setting, or is limited to read-only queries. Even when Write Guard is on, individual write tools stay visible in your AI tool but return an error if your workspace doesn't allow them.

Connect your AI tool

Use the MCP server address that matches your ShareGate Protect workspace region:

  • North America: https://mcp.sharegate.com/mcp

  • Europe: https://mcp.eu.sharegate.com/mcp

Select your AI tool below.

Claude

Adding a custom connector is the simplest way to connect Claude to ShareGate Protect. It requires a Claude Pro or Max personal account or admin access to a Claude organization.

  1. In Claude (Desktop or web), select Customize from the sidebar.

  2. Select Connectors.

  3. Click Add custom connector.

  4. Enter a name and paste the MCP server URL for your region.

  5. Click Connect.

  6. Follow the sign-in steps in your browser.

Note: Enterprise Claude Desktop users may have custom connectors blocked by their admin. If you cannot add a custom connector, use the config file method below.

Claude Desktop (config file)

This method works for any Claude Desktop user, but requires Node.js to be installed on your machine.

  1. Open Claude Desktop.

  2. Go to Settings > Developer > Edit Config. This opens claude_desktop_config.json.

  3. Add the following inside the "mcpServers" section, replacing the MCP URL with the one for your region.

    {
      "mcpServers": {
        "mcp-sg-protect": {
          "command": "npx",
          "args": ["-y", "mcp-remote", "https://mcp.sharegate.com/mcp", "--transport", "http-only"]
        }
      }
    }

  4. Save the file, then fully quit and reopen Claude Desktop.

  5. A browser window opens for sign-in the first time.

Claude Code

Run one command in your terminal, using the MCP URL for your region. After it completes, run /mcp inside Claude Code and sign in from your browser.

claude mcp add --scope user --transport http mcp-sg-protect https://mcp.sharegate.com/mcp

Microsoft Copilot (Copilot Studio)

Connecting ShareGate Protect to Microsoft Copilot requires a Copilot Studio license and a new or existing agent.

  1. In Copilot Studio, open your agent or create a new one.

  2. Go to the Tools tab and click Add a tool.

  3. Select Model Context Protocol.

  4. Enter the MCP information and server URL for your region.

  5. For Authentication, select OAuth 2.0 with the Dynamic discovery type.

  6. Connect using the Connection - Not connected button or using the Manage your connection page, and follow the steps to connect the MCP.

To make the agent available in Microsoft 365 or Microsoft Teams, publish it and add the relevant channels. Each user who connects for the first time will be prompted to sign in with their ShareGate account.

GitHub Copilot in Visual Studio Code

You can connect ShareGate Protect to GitHub Copilot when using agent mode in Visual Studio Code.

  1. Switch Copilot Chat to Agent mode using the dropdown next to the chat input.

  2. Open the Command Palette (Cmd/Ctrl+Shift+P) and run MCP: Open User Configuration. This opens or creates ~/.vscode/mcp.json.

  3. Add the following inside the file, replacing the URL with the one for your region:

{
  "servers": {
    "mcp-sg-protect": {
      "type": "http",
      "url": "https://mcp.sharegate.com/mcp"
    }
  }
}

  1. Save the file. Visual Studio Code prompts you to sign in, and a browser window opens to log in to ShareGate Home.

ChatGPT

You can connect ShareGate Protect to ChatGPT with a ChatGPT Business or Enterprise plan.

Business or Enterprise (admin setup): Admins can add ShareGate Protect as an app for all users.

Go to Workspace settings > Apps > Create, fill in the MCP server URL, and publish the app.

Developer mode: If developer mode is enabled for your account, go to Settings > Apps > Create app and enter the MCP server URL for your region.

Note: On Business and Enterprise plans, developer mode may require your organization's admin to enable it first.

Sign in for the first time

The first time you connect from any AI tool, two prompts appear in your browser:

  1. ShareGate Home login: Enter the credentials for the ShareGate account you want to use.

  2. Authorize access: A one-time security prompt appears when a new redirect URL is detected on your client registration. Only approve this if you are actively setting up the MCP connection.

To confirm the connection is working, ask your AI tool to "list my ShareGate workspaces."

Security and data handling

Authentication

You sign in through the ShareGate login page in your browser, using the OAuth 2.1 standard with Proof Key for Code Exchange (PKCE). Your AI tool never sees your password.

After you sign in, your AI tool receives an access token and a refresh token. These tokens work only with the ShareGate Protect MCP server, for the workspaces your account can access. They don't give your AI tool direct access to your Microsoft 365 tenant. Tokens expire, and you can remove access at any time.

What ShareGate stores

ShareGate doesn't store access or refresh tokens. ShareGate keeps only your AI tool's registration details, and a record of your consent when you connect from a hosted AI tool such as ChatGPT or Microsoft Copilot.

Where your AI tool stores tokens

  • Hosted AI tools, such as ChatGPT and Microsoft Copilot: the vendor stores tokens in its cloud, not on your workstation.

  • Local AI tools, such as Claude Desktop, Claude Code, and Visual Studio Code: the AI tool stores tokens on your workstation, often as local files in your user profile. The AI tool and your workstation security, such as disk encryption and endpoint controls, determine how they're protected.

Data sent to your AI tool

Protect data returned by MCP tools, such as users, sites, and sharing information, is sent over HTTPS to the AI tool that made the request. The AI tool and its model provider then handle that data under their own retention, training, and data residency policies.

As part of your General Data Protection Regulation (GDPR) assessment, we recommend reviewing the AI vendor's data processing agreement (DPA) and enterprise settings, such as zero data retention or opting out of model training.

You only see data you already have access to in ShareGate Protect, and every request is scoped to your workspace.

Remove access

You can remove ShareGate Protect's data access at any time by:

  • Removing the MCP connection from your AI tool.

  • Disconnecting ShareGate Protect from your tenant by removing the ShareGate Protect app registration in Microsoft Entra.

Did this answer your question?