# Small steps. Useful connections.

Three steps, and Krusgraph runs inside Claude with your own Fabric permissions.

## Connect your account

Your Microsoft Entra admin grants consent once for your organisation: [grant admin consent](https://login.microsoftonline.com/organizations/adminconsent?client_id=6b92ed27-66e7-4767-8e72-eeb4b66da277). It allows Krusgraph to call Microsoft Fabric and SQL *as each signed-in user*, nothing more. The admin can revoke it at any time under Enterprise applications in Entra.

Already consented? Then there is nothing to do in this step.

## Choose a workspace

You need access to the Fabric workspace you want to use, and that workspace needs a Fabric capacity (a trial is fine). Have the workspace id or name ready; a lakehouse, warehouse or SQL database in it is the source.

No workspace yet? The demo on [/explore](https://krusgraph.com/explore) runs on a synthetic schema and needs no account.

## Open in Claude

In Claude, open **Settings → Connectors → Add custom connector**, give it a name and paste this URL:

```
https://krusgraph.com/mcp
```

Claude asks you to sign in with your Microsoft work account. After that you can say *“List the data sources in workspace …”*, *“Plan a backend over the shop lakehouse”* (nothing is deployed) or *“Create it as shop_api”*.

Claude is the client this is built and documented for. Claude Code and Cursor use the same URL but sign in through a local redirect that is not registered on the Entra app yet; until it is, use Claude. Full usage notes are in the [docs](https://krusgraph.com/docs).

## What will Krusgraph access?

Only what the signed-in user can already reach. The Entra app asks for these delegated permissions, all granted by your admin once and all acting as the user:

| Permission | Used for |
| --- | --- |
| `User.Read` (Microsoft Graph) | sign-in only |
| `Workspace.Read.All`, `Item.Read.All` (Fabric) | listing sources and reading item metadata |
| `GraphQLApi.ReadWrite.All` (Fabric) | creating or updating the one API for GraphQL item you ask for; never deleting |
| `GraphQLApi.Execute.All` (Fabric) | running the read-only queries you ask for |
| `user_impersonation` (Azure SQL Database) | reading table and column names from the SQL analytics endpoint |

What passes through the server: workspace, item, table and column names, and the results of queries you run. Your tokens are exchanged on your behalf and held in memory only. There is no database of our own and nothing is written to disk. Details in the [privacy policy](https://krusgraph.com/privacy).

Two steps stay manual in the Fabric portal because there is no API for them yet, and the connector tells you when they are needed: turning on **introspection** for the GraphQL item, and granting **permissions** on it to other apps.