Microsoft Teams MCP Server: Cursor IDE Setup (2026)

How do you connect Microsoft Teams to Cursor via MCP? Add a teams-mcp entry to ~/.cursor/mcp.json that runs npx -y @floriscornel/teams-mcp@latest, then run npx @floriscornel/teams-mcp@latest authenticate once from a terminal to complete an OAuth 2.0 device code flow against Microsoft Graph. No Client ID or Client Secret to generate yourself — the package ships with app registration already handled, and the authenticated session is cached locally. Restart Cursor, and it can read channels, chats, and messages, and (if you allow write tools) post replies and send files, all without leaving the editor.

This page covers @floriscornel/teams-mcp, a community-maintained server built directly on the Microsoft Graph API — not Microsoft's own enterprise-hosted endpoint, which is a separate, admin-configured option covered near the end of this guide. If your organization already blocks third-party Graph API tooling at the tenant level, read that section before installing anything.

What You Can Do with Teams MCP in Cursor

Because this runs through Microsoft Graph, anything Graph exposes about Teams — channel membership, message history, chat threads, file attachments — becomes something Cursor can read and reason about mid-conversation, instead of you tabbing over to the Teams client to check.

Prerequisites

Step 1: Add the Server to mcp.json

{
  "mcpServers": {
    "teams-mcp": {
      "command": "npx",
      "args": ["-y", "@floriscornel/teams-mcp@latest"]
    }
  }
}

Step 2: Authenticate

Run this once from a terminal (not from inside Cursor):

npx @floriscornel/teams-mcp@latest authenticate

This kicks off an OAuth 2.0 device code flow: the command prints a short code and a Microsoft sign-in URL, you open that URL in any browser, enter the code, and sign in with your Microsoft 365 account. Authentication metadata is written to ~/.msgraph-mcp-auth.json and the token cache to ~/.teams-mcp-token-cache.json — both on your local machine, not inside the mcp.json file itself.

For a reduced-permission setup, authenticate in read-only mode instead:

npx @floriscornel/teams-mcp@latest authenticate --read-only

Step 3: Restart Cursor and Verify

Restart Cursor, confirm a green status next to teams-mcp in Settings → Tools & Integrations → MCP Tools, then test:

List my Microsoft Teams and show me the channels in the first one

A real list of your actual teams and channels confirms the device code flow completed and the token cache is being read correctly.

Read-Only Mode

If you'd rather not grant Cursor the ability to post messages, reply, delete, or send files on your behalf, set the read-only environment variable instead of (or in addition to) the --read-only authenticate flag:

{
  "mcpServers": {
    "teams-mcp": {
      "command": "npx",
      "args": ["-y", "@floriscornel/teams-mcp@latest"],
      "env": {
        "TEAMS_MCP_READ_ONLY": "true"
      }
    }
  }
}

This is the safer default for a shared or work-monitored machine — Cursor can summarize and search, but every send/reply/delete tool is unavailable rather than merely unused.

Using a Pre-Existing Graph Token

If your organization already issues Microsoft Graph access tokens through another flow (an internal SSO tool, a CI secret store), you can skip the device code step and hand the server a token directly:

{
  "mcpServers": {
    "teams-mcp": {
      "command": "npx",
      "args": ["-y", "@floriscornel/teams-mcp@latest"],
      "env": {
        "AUTH_TOKEN": "${env:MS_GRAPH_TOKEN}"
      }
    }
  }
}

Graph access tokens are short-lived (typically under an hour), so this path only works well if whatever issues MS_GRAPH_TOKEN also refreshes it — otherwise you're back to re-running authenticate by hand whenever it expires. For most individual developers, the cached device-code session from Step 2 is simpler to keep alive than managing a token feed yourself.

Available Tools

The server exposes tools grouped by what they touch:

Full-mode authentication requests the Graph delegated scopes behind these tools, including User.Read, Team.ReadBasic.All, ChannelMessage.Send, Chat.ReadWrite, and Files.ReadWrite.All. In read-only mode, the scopes tied to send/update/delete/file-upload tools are dropped, and those tools simply aren't available to call.

Practical Workflows

Incident summary, cross-tool:

Search Teams for messages mentioning "checkout outage" from today,
summarize the timeline, then draft a postmortem message for #engineering.

Standup prep:

Get my mentions from the last 24 hours across all Teams chats and channels,
and group them by which project they're about.

PR-to-Teams handoff: if you're also running the GitHub MCP server in the same Cursor session, a natural chain is: read a PR's diff and status, then post a summary to the relevant Teams channel in the same prompt — the same "code tool triggers a chat-tool notification" pattern the Slack MCP server guide covers for Slack-based teams.

File retrieval:

Download the file that was shared in the #design channel yesterday
and tell me what's in it.

Teams MCP vs. Slack/Discord MCP: What's Different

If you've already set up the Slack MCP server or the Discord MCP server, the Teams setup will look familiar in shape but differs in a few specifics worth knowing before you assume the patterns transfer directly:

Microsoft's Own Hosted Server (Enterprise Alternative)

Separately from the community server above, Microsoft maintains an official, first-party Teams MCP server as part of its microsoft/mcp catalog. It's delivered as a hosted HTTP endpoint scoped to a specific Microsoft Entra tenant — the server URL embeds the tenant's GUID, authentication runs against Microsoft Entra ID for the calling user, and there's no local package to run at all. It's built for tenant-wide deployment by an IT admin rather than a one-developer npx install, and it includes server-side filtering, pagination, and token-optimization features aimed at large tenants with heavy Teams message volume.

If you're evaluating this for a team rather than your own machine, that's the path to look at — it's a different setup process than everything above, configured by whoever administers your organization's Microsoft 365 tenant, not something you wire into your personal mcp.json.

When Not to Use This

Don't run full-mode (write-enabled) Teams MCP unattended in an agent loop that posts to channels without a human reading the message first — a hallucinated summary posted to a company-wide channel is a much more visible mistake than a bad code suggestion. Default to TEAMS_MCP_READ_ONLY=true for anything except sessions where you're actively watching what gets sent.

Troubleshooting

authenticate command hangs or the browser never opens
Device code flow doesn't open a browser for you automatically — copy the printed URL and code and open them manually if your terminal doesn't launch one. Confirm you're signing in with the same Microsoft 365 account you intend to use with Teams.

Server connects but every call returns a permissions error
Full-mode tools need scopes like ChannelMessage.Send and Chat.ReadWrite granted during authentication. If you ran authenticate --read-only, re-run without that flag to request the full scope set, or accept that write tools won't be available.

"Cannot find module" or npx fails outright
Confirm Node.js 18+ is installed and on PATH. npx -y will attempt to download the package fresh if it's not cached, so a flaky network connection during that first run can look like a broken install.

Works from the terminal, but Cursor shows the server as disconnected
Cursor spawns the command/args pair itself — if authenticate was run under a different user account or shell environment than the one Cursor launches from, the token cache files (~/.msgraph-mcp-auth.json, ~/.teams-mcp-token-cache.json) may not be visible to the process Cursor starts. Re-run authenticate from the same environment Cursor uses.

Tenant admin has blocked this before I even installed it
If your organization enforces Graph API access policies or an MCP allowlist at the tenant level, a community server like this one may be blocked regardless of local config — check with your IT/security team, or push for the officially hosted Microsoft server described above instead.

Token expired mid-session
AUTH_TOKEN-based setups (the pre-existing-Graph-token path) don't auto-refresh; regenerate the token and update the environment variable. The default device-code-authenticated path handles its own token refresh via the local cache and shouldn't need this.

Frequently Asked Questions

Q: What is the Microsoft Teams MCP server for Cursor?
A: It's a Model Context Protocol server — most commonly the community-maintained @floriscornel/teams-mcp package — that connects to Microsoft Graph and exposes your Teams channels, chats, and messages as tools Cursor's AI can call directly, instead of you copying context between the Teams client and your editor.

Q: Do I need to register an Azure/Entra app myself?
A: No, not for the default setup. @floriscornel/teams-mcp ships with its own pre-registered application and authenticates via device code flow against your Microsoft 365 account. Microsoft's separate, enterprise-hosted server is admin-configured differently and is the path to look at if you need tenant-wide deployment instead.

Q: Is this Microsoft's official MCP server?
A: No — this guide's primary path is a community-maintained server built on the public Microsoft Graph API. Microsoft does maintain its own first-party, tenant-scoped hosted server as part of the microsoft/mcp catalog, covered separately above, which is configured by a tenant admin rather than an individual developer.

Q: Can it read direct messages, or only channels?
A: Both, within what your own Microsoft 365 account can already see. Chat tools (list_chats, get_chat_messages, send_chat_message) cover 1:1 and group chats; channel tools cover team channels. It only sees chats and channels your authenticated identity is already a member of.

Q: How do I stop it from being able to post messages?
A: Set TEAMS_MCP_READ_ONLY=true in the server's env block, or authenticate with --read-only from the start. Either way, the send/reply/update/delete/file-upload tools are removed from what's available rather than merely being unused.

Q: Will my IT department see this as a security risk?
A: It's worth checking before connecting a work account. The server authenticates as you, using the standard Microsoft Graph delegated-permission model, so it can only do what your account can already do — but organizations that manage MCP access via enterprise allowlists or Graph API access policies may restrict or block third-party tools like this at the tenant level regardless of your local config.

Q: Does authentication expire, and do I need to redo it often?
A: The device-code-authenticated session refreshes itself from the local token cache and shouldn't require re-running authenticate under normal use. The separate AUTH_TOKEN path (using a token issued elsewhere) does not auto-refresh and needs manual regeneration once that token expires.

Related Guides

Official docs cited