> **Building with AI coding agents?** Install the authstack plugin with one command. This equips your agent with accurate Scalekit implementation patterns. > > **Recommended** (the `-y` flags skip prompts, so the command runs without an interactive terminal): > ```bash > npx -y @scalekit-inc/cli setup -y > ``` > > Global: > ```bash > npm install -g @scalekit-inc/cli > scalekit setup -y > ``` > > Supports Claude Code, Cursor, GitHub Copilot, Codex + skills for other Agent Skills-compatible agents in `~/.agents/skills`. > Skills: integrate-agentkit, implement-saaskit, add-mcp-oauth, implement-sso, implement-scim. > [Full setup guide](https://docs.scalekit.com/dev-kit/build-with-ai/) --- # Connect AI agents to Microsoft Entra ID The Microsoft Entra ID connector lets your AI agent act in each user's Microsoft Entra ID account. Each user signs in to Microsoft Entra ID once, and Scalekit stores and refreshes their tokens, so your agent never handles credentials. It comes with 82 tools. **Authentication:** OAuth 2.0 **Categories:** Developer Tools, Monitoring **Tools:** 82: 61 read, 20 write, 1 destructive **Users sign in with:** OAuth **OAuth app:** Your own Microsoft Entra ID app **Built by:** Scalekit connector **Try it:** [Playground in the Scalekit dashboard](https://app.scalekit.com/ws/signup?sk_intent=playground&provider=MICROSOFTENTRAID) ## Setup 1. ### Install the SDK **Node.js** ```bash npm install @scalekit-sdk/node dotenv ``` **Python** ```bash pip install scalekit-sdk-python python-dotenv ``` 2. ### Set your credentials Add your Scalekit credentials to your `.env` file. Find values in **[app.scalekit.com](https://app.scalekit.com)** > **Developers** > **API Credentials**. ```sh title=".env" SCALEKIT_ENVIRONMENT_URL= SCALEKIT_CLIENT_ID= SCALEKIT_CLIENT_SECRET= ``` 3. ### Create the Microsoft Entra ID connection In **AgentKit > Connections**, create a Microsoft Entra ID connection and copy its redirect URI. The name you give it is the `connection_name` your code passes. See [Configure connections](/agentkit/connections/). 4. ### Register an OAuth app Microsoft Entra ID connections use your own OAuth app. Register one with Microsoft Entra ID and add the redirect URI you copied. Then enter the app's Client ID and Client Secret on the Microsoft Entra ID connection. 5. ### Authorize a user and make your first call **Node.js** (`quickstart.mts`) ```typescript import { ScalekitClient } from '@scalekit-sdk/node' import 'dotenv/config' import { createInterface } from 'node:readline/promises' const scalekit = new ScalekitClient( process.env.SCALEKIT_ENVIRONMENT_URL, process.env.SCALEKIT_CLIENT_ID, process.env.SCALEKIT_CLIENT_SECRET, ) const actions = scalekit.actions const connector = 'microsoftentraid' const identifier = 'user_123' // Generate an authorization link for the user const { link } = await actions.getAuthorizationLink({ connectionName: connector, identifier }) console.log('Authorize Microsoft Entra ID:', link) const rl = createInterface({ input: process.stdin, output: process.stdout }) await rl.question('Press Enter after authorizing...') rl.close() // Make your first call const result = await actions.executeTool({ connector, identifier, toolName: 'microsoftentraid_administrative_units_list', toolInput: {}, }) console.log(result) ``` ```bash npx tsx quickstart.mts ``` **Python** (`quickstart.py`) ```python import os from scalekit import ScalekitClient from dotenv import load_dotenv load_dotenv() scalekit_client = ScalekitClient( env_url=os.getenv("SCALEKIT_ENVIRONMENT_URL"), client_id=os.getenv("SCALEKIT_CLIENT_ID"), client_secret=os.getenv("SCALEKIT_CLIENT_SECRET"), ) actions = scalekit_client.actions connection_name = "microsoftentraid" identifier = "user_123" # Generate an authorization link for the user link_response = actions.get_authorization_link( connection_name=connection_name, identifier=identifier, ) print("Authorize Microsoft Entra ID:", link_response.link) input("Press Enter after authorizing...") # Make your first call result = actions.execute_tool( tool_input={}, tool_name="microsoftentraid_administrative_units_list", connection_name=connection_name, identifier=identifier, ) print(result) ``` ```bash python quickstart.py ``` Each user signs in once. See [Authorize a user](/agentkit/tools/authorize/) for the full flow and statuses. ## Tools Pass the exact name to `execute_tool`, with an input like each tool's example. To ask for a tool that's missing, use the [request form](https://scalekitsupport.portal.usepylon.com/forms/request-a-connector-tool). **Node.js** ```typescript const result = await actions.executeTool({ toolName: 'microsoftentraid_administrative_unit_members_list', toolInput: { administrative_unit_id: '', }, connector: 'microsoftentraid', identifier: 'user_123', }) ``` **Python** ```python result = actions.execute_tool( tool_name="microsoftentraid_administrative_unit_members_list", tool_input={ "administrative_unit_id": "", }, connection_name="microsoftentraid", identifier="user_123", ) ``` `result.data` is the app's response as JSON, and `result.execution_id` (`executionId` in Node.js) is the ID of the call. ### `microsoftentraid_administrative_unit_members_list` List Administrative Unit Members · Read-only List the users, groups and devices that belong to an administrative unit. Returns directory objects with @odata.type, id and displayName. Use administrative_unit_members_list to see who a scoped admin can manage. Use administrative_units_list to find the unit ID. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `administrative_unit_id` (`string`, required): Object ID (GUID) of the administrative unit. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{"administrative_unit_id":""}` ### `microsoftentraid_administrative_units_list` List Administrative Units · Read-only List the administrative units that scope delegated administration in the tenant. Returns administrativeUnit objects (id, displayName, description, visibility, membershipType). Use administrative_units_list to find units for scoped role assignments. Use administrative_unit_members_list for the members of one. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `$filter` (`string`, optional): OData $filter expression to narrow administrative units. Example: startswith(displayName,'EMEA'). Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{}` ### `microsoftentraid_application_federated_credentials_list` List Application Federated Credentials · Read-only List the federated identity credentials of an application registration (workload identity federation). Returns federatedIdentityCredential objects (id, name, issuer, subject, audiences). Use application_federated_credentials_list to audit trusted external identity providers such as GitHub Actions. Use application_federated_credential_create to add one. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `application_id` (`string`, required): Object ID (GUID) of the application registration. This is the 'id' property, not the appId (client ID). - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{"application_id":""}` ### `microsoftentraid_application_get` Get Application · Read-only Get one application registration by object ID. Returns the application's properties such as appId, displayName, signInAudience, web redirect URIs, requiredResourceAccess, keyCredentials and passwordCredentials metadata. Use application_get for a known app registration. Use applications_list to find it first. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `application_id` (`string`, required): Object ID (GUID) of the application registration. This is the 'id' property, not the appId (client ID). - `$select` (`string`, optional): Comma-separated list of application properties to return. Example: id,appId,displayName,signInAudience,createdDateTime,web,requiredResourceAccess,passwordCredentials,keyCredentials. Graph returns only a default subset of properties unless you list the ones you need here. Example input: `{"application_id":""}` ### `microsoftentraid_application_owners_list` List Application Owners · Read-only List the owners of an application registration. Returns directory objects (users or service principals) with id, displayName and userPrincipalName. Use application_owners_list to find who manages an app registration. Use application_owner_add to add one. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `application_id` (`string`, required): Object ID (GUID) of the application registration. This is the 'id' property, not the appId (client ID). - `$count` (`boolean`, optional): Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter. - `$select` (`string`, optional): Comma-separated list of owner properties to return. Example: id,displayName,userPrincipalName,mail. Graph returns only a default subset of properties unless you list the ones you need here. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{"application_id":""}` ### `microsoftentraid_applications_list` List Applications · Read-only List application registrations in the Microsoft Entra tenant. Returns application objects (id, appId, displayName, signInAudience, createdDateTime by default) plus @odata.nextLink when more pages exist. Use applications_list to find app registrations. Use service_principals_list for the enterprise application (tenant instance) of an app. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `$count` (`boolean`, optional): Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter. - `$filter` (`string`, optional): OData $filter expression to narrow applications. Example: displayName eq 'Payroll Portal'. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual. - `$orderby` (`string`, optional): OData $orderby expression to sort results. Example: displayName. Sorting combined with a filter may need advanced query support. - `$search` (`string`, optional): Free-text search over applications, written as "property:term" with the double quotes included. Example: "displayName:Payroll". Requires advanced query support, which this tool enables by sending ConsistencyLevel: eventual. - `$select` (`string`, optional): Comma-separated list of application properties to return. Example: id,appId,displayName,signInAudience,createdDateTime. Graph returns only a default subset of properties unless you list the ones you need here. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{}` ### `microsoftentraid_authentication_strength_policies_list` List Authentication Strength Policies · Read-only List the authentication strength policies (built-in and custom) that Conditional Access can require. Returns authenticationStrengthPolicy objects (id, displayName, policyType, allowedCombinations). Use authentication_strength_policies_list to see which MFA method combinations satisfy each strength. Needs the Policy.Read.All scope. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `$filter` (`string`, optional): OData $filter expression to narrow authentication strength policies. Example: policyType eq 'custom'. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual. Example input: `{}` ### `microsoftentraid_conditional_access_policies_list` List Conditional Access Policies · Read-only List the Conditional Access policies of the tenant. Returns conditionalAccessPolicy objects (id, displayName, state, conditions, grantControls, sessionControls). Use conditional_access_policies_list to audit access rules. Use conditional_access_policy_get for one policy. Needs the Policy.Read.All scope. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `$filter` (`string`, optional): OData $filter expression to narrow policies. Example: state eq 'enabled'. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual. Example input: `{}` ### `microsoftentraid_conditional_access_policy_get` Get Conditional Access Policy · Read-only Get one Conditional Access policy by ID. Returns the policy with its state, conditions (users, applications, locations, platforms), grantControls and sessionControls. Use conditional_access_policy_get after conditional_access_policies_list to inspect one policy. Needs the Policy.Read.All scope. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `policy_id` (`string`, required): ID (GUID) of the Conditional Access policy. Example input: `{"policy_id":""}` ### `microsoftentraid_device_get` Get Device · Read-only Get one device by directory object ID. Returns the device's properties such as displayName, operatingSystem, trustType, isCompliant, isManaged and registrationDateTime. Use device_get for one known device. Use devices_list to find it first. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `device_object_id` (`string`, required): Object ID (GUID) of the device; this is the id property, not deviceId. - `$select` (`string`, optional): Comma-separated list of device properties to return. Example: id,deviceId,displayName,operatingSystem,trustType,isCompliant,isManaged,registrationDateTime. Graph returns only a default subset of properties unless you list the ones you need here. Example input: `{"device_object_id":""}` ### `microsoftentraid_devices_list` List Devices · Read-only List devices registered or joined in the Microsoft Entra tenant. Returns device objects (id, deviceId, displayName, operatingSystem, operatingSystemVersion, trustType, isCompliant, isManaged, approximateLastSignInDateTime). Use devices_list to inventory devices or find non-compliant ones. Use device_get for one device. Use user_owned_devices_list for a user's devices. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `$count` (`boolean`, optional): Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter. - `$filter` (`string`, optional): OData $filter expression to narrow devices. Example: operatingSystem eq 'Windows' and isCompliant eq false. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual. - `$orderby` (`string`, optional): OData $orderby expression to sort results. Example: displayName. Sorting combined with a filter may need advanced query support. - `$search` (`string`, optional): Free-text search over devices, written as "property:term" with the double quotes included. Example: "displayName:LAPTOP". Requires advanced query support, which this tool enables by sending ConsistencyLevel: eventual. - `$select` (`string`, optional): Comma-separated list of device properties to return. Example: id,deviceId,displayName,operatingSystem,trustType,isCompliant,approximateLastSignInDateTime. Graph returns only a default subset of properties unless you list the ones you need here. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{}` ### `microsoftentraid_directory_audit_get` Get Directory Audit Entry · Read-only Get one directory audit entry by ID. Returns the full directoryAudit object including initiatedBy, targetResources and modifiedProperties. Use directory_audit_get after directory_audits_list to see the complete record of one change. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `audit_id` (`string`, required): ID of the audit event, from the id property of directory_audits_list. Example input: `{"audit_id":""}` ### `microsoftentraid_directory_audits_list` List Directory Audit Logs · Read-only List directory audit events, which record changes made to users, groups, applications, roles and policies in the tenant. Returns directoryAudit objects (id, activityDisplayName, activityDateTime, category, result, initiatedBy, targetResources). Use directory_audits_list to see who changed what. Use sign_ins_list for authentication events. Needs the AuditLog.Read.All scope. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `$filter` (`string`, optional): OData $filter expression to narrow audit events. Example: activityDateTime ge 2026-10-01T00:00:00Z and category eq 'UserManagement'. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual. - `$orderby` (`string`, optional): OData $orderby expression to sort results. Example: activityDateTime desc. Sorting combined with a filter may need advanced query support. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{}` ### `microsoftentraid_directory_role_get` Get Directory Role · Read-only Get one activated directory role by object ID or role template ID. Returns the directoryRole (id, displayName, description, roleTemplateId). Use directory_role_get for a known role. Use directory_roles_list to enumerate activated roles. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `directory_role_id` (`string`, required): Object ID (GUID) of the directory role, or its roleTemplateId. Example input: `{"directory_role_id":""}` ### `microsoftentraid_directory_role_members_list` List Directory Role Members · Read-only List the users and service principals that hold an activated directory role (for example Global Administrator). Returns directory objects (id, displayName, userPrincipalName, @odata.type) for each member. Use directory_role_members_list to audit privileged access. Use role_assignments_list to also see scoped and PIM-managed assignments. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `directory_role_id` (`string`, required): Object ID (GUID) of the directory role from directory_roles_list, or roleTemplateId of the role. - `$select` (`string`, optional): Comma-separated list of member properties to return. Example: id,displayName,userPrincipalName,mail. Graph returns only a default subset of properties unless you list the ones you need here. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{"directory_role_id":""}` ### `microsoftentraid_directory_role_templates_list` List Directory Role Templates · Read-only List all directory role templates, including roles that are not yet activated in the tenant. Returns directoryRoleTemplate objects (id, displayName, description). Use directory_role_templates_list to find the template ID of a built-in role. Use role_definitions_list for full role definitions with permissions. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `$select` (`string`, optional): Comma-separated list of role template properties to return. Example: id,displayName,description. Graph returns only a default subset of properties unless you list the ones you need here. Example input: `{}` ### `microsoftentraid_directory_roles_list` List Activated Directory Roles · Read-only List the directory roles that are activated in the tenant. Returns directoryRole objects (id, displayName, description, roleTemplateId). Use directory_roles_list to find the role object ID before listing its members. Use directory_role_templates_list for roles that are not yet activated. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `$select` (`string`, optional): Comma-separated list of role properties to return. Example: id,displayName,description,roleTemplateId. Graph returns only a default subset of properties unless you list the ones you need here. Example input: `{}` ### `microsoftentraid_domain_get` Get Domain · Read-only Get one tenant domain by its name. Returns the domain (id, isVerified, isDefault, isAdminManaged, authenticationType, passwordValidityPeriodInDays). Use domain_get for one known domain. Use domains_list to enumerate. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `domain_id` (`string`, required): Fully qualified domain name, which is the id of the domain. Example input: `{"domain_id":""}` ### `microsoftentraid_domain_verification_dns_records_list` List Domain Verification DNS Records · Read-only List the DNS records required to verify ownership of a domain. Returns domainDnsRecord objects (id, recordType, label, ttl, text or mailExchange). Use domain_verification_dns_records_list when onboarding a custom domain. Use domain_get to check isVerified. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `domain_id` (`string`, required): Fully qualified domain name to verify. Example input: `{"domain_id":""}` ### `microsoftentraid_domains_list` List Domains · Read-only List the domains associated with the tenant. Returns domain objects (id which is the domain name, isVerified, isDefault, authenticationType, supportedServices). Use domains_list to see verified and unverified domains. Use domain_verification_dns_records_list for the DNS records needed to verify one. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `$filter` (`string`, optional): OData $filter expression to narrow domains. Example: isVerified eq true. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual. Example input: `{}` ### `microsoftentraid_group_app_role_assignments_list` List Group App Role Assignments · Read-only List the enterprise applications and app roles that are assigned to a group. Returns appRoleAssignment objects (id, appRoleId, resourceId, resourceDisplayName). Use group_app_role_assignments_list to see which apps a group grants access to. Use user_app_role_assignments_list for a single user. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `group_id` (`string`, required): Object ID (GUID) of the group. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{"group_id":""}` ### `microsoftentraid_group_get` Get Group · Read-only Get one group from the Microsoft Entra tenant by object ID. Returns the group's properties such as displayName, description, mail, groupTypes, securityEnabled and membershipRule. Use group_get for a known group. Use groups_list to find the group first. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `group_id` (`string`, required): Object ID (GUID) of the group. - `$select` (`string`, optional): Comma-separated list of group properties to return. Example: id,displayName,description,mail,securityEnabled,groupTypes,membershipRule. Graph returns only a default subset of properties unless you list the ones you need here. Example input: `{"group_id":""}` ### `microsoftentraid_group_member_of_list` List Group Memberships · Read-only List the groups and administrative units that a group is a direct member of. Returns directory objects with @odata.type, id and displayName. Use group_member_of_list to find parent groups. Use group_members_list for the group's own members. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `group_id` (`string`, required): Object ID (GUID) of the group. - `$count` (`boolean`, optional): Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter. - `$select` (`string`, optional): Comma-separated list of group properties to return. Example: id,displayName. Graph returns only a default subset of properties unless you list the ones you need here. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{"group_id":""}` ### `microsoftentraid_group_members_list` List Group Members · Read-only List the direct members of a group (users, devices, service principals, contacts and nested groups). Returns directory objects with @odata.type, id, displayName and, for users, userPrincipalName and mail. Use group_members_list for direct members. Use group_transitive_members_list to expand nested groups. Use group_owners_list for owners. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `group_id` (`string`, required): Object ID (GUID) of the group. - `$count` (`boolean`, optional): Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter. - `$select` (`string`, optional): Comma-separated list of member properties to return. Example: id,displayName,userPrincipalName,mail. Graph returns only a default subset of properties unless you list the ones you need here. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{"group_id":""}` ### `microsoftentraid_group_owners_list` List Group Owners · Read-only List the owners of a group. Returns directory objects (users or service principals) with id, displayName and userPrincipalName. Use group_owners_list to see who manages a group. Use group_members_list for members. Use group_owner_add to add an owner. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `group_id` (`string`, required): Object ID (GUID) of the group. - `$count` (`boolean`, optional): Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter. - `$select` (`string`, optional): Comma-separated list of owner properties to return. Example: id,displayName,userPrincipalName,mail. Graph returns only a default subset of properties unless you list the ones you need here. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{"group_id":""}` ### `microsoftentraid_group_transitive_members_list` List Group Transitive Members · Read-only List all members of a group, expanding nested groups. Returns directory objects with @odata.type, id, displayName and, for users, userPrincipalName and mail. Use group_transitive_members_list for the effective membership. Use group_members_list for direct members only. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `group_id` (`string`, required): Object ID (GUID) of the group. - `$count` (`boolean`, optional): Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter. - `$select` (`string`, optional): Comma-separated list of member properties to return. Example: id,displayName,userPrincipalName,mail. Graph returns only a default subset of properties unless you list the ones you need here. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{"group_id":""}` ### `microsoftentraid_groups_list` List Groups · Read-only List groups in the Microsoft Entra tenant, including Microsoft 365 groups and security groups. Returns group objects (id, displayName, description, mail, groupTypes, securityEnabled by default) plus @odata.nextLink when more pages exist. Use groups_list to browse or search groups. Use group_get for one group by ID. Use group_members_list to list who is in a group. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `$count` (`boolean`, optional): Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter. - `$filter` (`string`, optional): OData $filter expression to narrow groups. Example: securityEnabled eq true and startswith(displayName,'Eng'). Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual. - `$orderby` (`string`, optional): OData $orderby expression to sort results. Example: displayName. Sorting combined with a filter may need advanced query support. - `$search` (`string`, optional): Free-text search over groups, written as "property:term" with the double quotes included. Example: "displayName:Security". Requires advanced query support, which this tool enables by sending ConsistencyLevel: eventual. - `$select` (`string`, optional): Comma-separated list of group properties to return. Example: id,displayName,description,mail,securityEnabled,groupTypes. Graph returns only a default subset of properties unless you list the ones you need here. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{}` ### `microsoftentraid_me_get` Get Signed-in User · Read-only Get the profile of the user who authorized this connection. Returns the signed-in user's id, displayName, userPrincipalName and mail, plus any properties requested with $select. Use me_get to confirm which account the connection runs as. Use user_get for any other user. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `$select` (`string`, optional): Comma-separated list of user properties to return. Example: id,displayName,userPrincipalName,mail,jobTitle. Graph returns only a default subset of properties unless you list the ones you need here. Example input: `{}` ### `microsoftentraid_named_location_get` Get Named Location · Read-only Get one Conditional Access named location by ID. Returns the namedLocation with its type and either its IP ranges or its countries and regions. Use named_location_get after named_locations_list to inspect one location. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `named_location_id` (`string`, required): ID (GUID) of the named location. Example input: `{"named_location_id":""}` ### `microsoftentraid_named_locations_list` List Named Locations · Read-only List the named locations (IP ranges and countries) used by Conditional Access policies. Returns namedLocation objects (id, displayName, @odata.type, and ipRanges or countriesAndRegions). Use named_locations_list to review trusted networks and country rules. Use conditional_access_policies_list for the policies that reference them. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `$filter` (`string`, optional): OData $filter expression to narrow named locations. Example: isTrusted eq true. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual. Example input: `{}` ### `microsoftentraid_oauth2_permission_grants_list` List OAuth2 Permission Grants · Read-only List delegated permission grants (OAuth2 consents) across the tenant. Returns oAuth2PermissionGrant objects (id, clientId, consentType, principalId, resourceId, scope). Use oauth2_permission_grants_list for a tenant-wide consent audit; filter by clientId to narrow to one app. Use service_principal_oauth2_permission_grants_list for one app. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `$filter` (`string`, optional): OData $filter expression to narrow grants. Example: clientId eq '5e6f7a8b-9c0d-4e1f-8a2b-3c4d5e6f7a8b'. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{}` ### `microsoftentraid_organization_get` Get Organization · Read-only Get the tenant's organization details. Returns the organization object (id which is the tenant ID, displayName, verifiedDomains, assignedPlans, technicalNotificationMails, onPremisesSyncEnabled). Use organization_get for tenant-level facts such as tenant ID and verified domains. Use domains_list for domain verification status. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `$select` (`string`, optional): Comma-separated list of organization properties to return. Example: id,displayName,verifiedDomains,onPremisesSyncEnabled. Graph returns only a default subset of properties unless you list the ones you need here. Example input: `{}` ### `microsoftentraid_provisioning_logs_list` List Provisioning Logs · Read-only List provisioning log events, which record users and groups synced to or from connected applications by the Entra provisioning service. Returns provisioningObjectSummary objects (id, activityDateTime, provisioningAction, sourceSystem, targetSystem, provisioningStatusInfo). Use provisioning_logs_list to debug app provisioning failures. Use directory_audits_list for other directory changes. Needs the AuditLog.Read.All scope. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `$filter` (`string`, optional): OData $filter expression to narrow provisioning events. Example: provisioningAction eq 'create' and activityDateTime ge 2026-10-01T00:00:00Z. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{}` ### `microsoftentraid_risk_detections_list` List Risk Detections · Read-only List risk detection events raised by Microsoft Entra ID Protection, such as leaked credentials or anonymous IP sign-ins. Returns riskDetection objects (id, riskEventType, riskLevel, riskState, detectedDateTime, userPrincipalName, ipAddress). Use risk_detections_list to see why users were flagged. Use risky_users_list for the per-user risk state. Needs Entra ID P2 and the IdentityRiskEvent.Read.All scope. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `$filter` (`string`, optional): OData $filter expression to narrow risk detections. Example: riskLevel eq 'high' and detectedDateTime ge 2026-10-01T00:00:00Z. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual. - `$orderby` (`string`, optional): OData $orderby expression to sort results. Example: detectedDateTime desc. Sorting combined with a filter may need advanced query support. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 500). When more results exist the response includes @odata.nextLink. Example input: `{}` ### `microsoftentraid_risky_users_list` List Risky Users · Read-only List users that Microsoft Entra ID Protection flags as at risk. Returns riskyUser objects (id, userPrincipalName, riskLevel, riskState, riskLastUpdatedDateTime). Use risky_users_list to triage compromised accounts. Use risk_detections_list for the underlying events. Needs Entra ID P2 and the IdentityRiskyUser.Read.All scope. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `$filter` (`string`, optional): OData $filter expression to narrow risky users. Example: riskLevel eq 'high' and riskState eq 'atRisk'. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual. - `$orderby` (`string`, optional): OData $orderby expression to sort results. Example: riskLastUpdatedDateTime desc. Sorting combined with a filter may need advanced query support. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 500). When more results exist the response includes @odata.nextLink. Example input: `{}` ### `microsoftentraid_role_assignments_list` List Role Assignments · Read-only List Microsoft Entra directory role assignments, including scoped assignments. Returns unifiedRoleAssignment objects (id, principalId, roleDefinitionId, directoryScopeId). Use role_assignments_list to audit who holds which role, filtering by principalId or roleDefinitionId. Use directory_role_members_list for a simple membership view. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `$expand` (`string`, optional): Set to principal to inline the user or service principal that holds each assignment. - `$filter` (`string`, optional): OData $filter expression to narrow role assignments. Example: roleDefinitionId eq '62e90394-69f5-4237-9190-012177145e10'. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{}` ### `microsoftentraid_role_definition_get` Get Role Definition · Read-only Get one Microsoft Entra role definition including its permissions. Returns the unifiedRoleDefinition with displayName, isBuiltIn and rolePermissions (allowedResourceActions). Use role_definition_get to inspect what a role allows. Use role_definitions_list to find role IDs. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `role_definition_id` (`string`, required): ID (GUID) of the role definition; for built-in roles this equals the role template ID. Example input: `{"role_definition_id":""}` ### `microsoftentraid_role_definitions_list` List Role Definitions · Read-only List Microsoft Entra role definitions, both built-in and custom. Returns unifiedRoleDefinition objects (id, displayName, description, isBuiltIn, isEnabled). Use role_definitions_list to find a roleDefinitionId for role_assignment_create or role_assignments_list. Use role_definition_get to see the permissions of one role. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `$filter` (`string`, optional): OData $filter expression to narrow role definitions. Example: isBuiltIn eq false. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual. - `$select` (`string`, optional): Comma-separated list of role definition properties to return. Example: id,displayName,description,isBuiltIn. Graph returns only a default subset of properties unless you list the ones you need here. Example input: `{}` ### `microsoftentraid_role_eligibility_schedule_instances_list` List Eligible Role Assignments · Read-only List Privileged Identity Management (PIM) eligible directory role assignments that are currently in effect. Returns unifiedRoleEligibilityScheduleInstance objects (id, principalId, roleDefinitionId, directoryScopeId, startDateTime, endDateTime). Use role_eligibility_schedule_instances_list to find who can activate a privileged role. Use role_assignments_list for active assignments. Needs Entra ID P2 or ID Governance licensing. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `$filter` (`string`, optional): OData $filter expression to narrow eligibility instances. Example: principalId eq '8c1e4f2a-3b5d-4c6e-9f70-1a2b3c4d5e6f'. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{}` ### `microsoftentraid_service_principal_app_role_assigned_to_list` List Service Principal App Role Assignees · Read-only List the users, groups and service principals that are assigned an app role on an enterprise application. Returns appRoleAssignment objects (id, appRoleId, principalId, principalDisplayName, principalType). Use service_principal_app_role_assigned_to_list to audit who can access an app. Use service_principal_app_role_assignments_list for roles this principal holds on other resources. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `service_principal_id` (`string`, required): Object ID (GUID) of the service principal. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{"service_principal_id":""}` ### `microsoftentraid_service_principal_app_role_assignments_list` List Service Principal App Role Assignments · Read-only List the app roles that a service principal has been granted on other resource applications, such as Microsoft Graph application permissions. Returns appRoleAssignment objects (id, appRoleId, resourceId, resourceDisplayName). Use service_principal_app_role_assignments_list to audit application permissions granted to an app. Use service_principal_app_role_assigned_to_list for who is assigned to this app. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `service_principal_id` (`string`, required): Object ID (GUID) of the service principal. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{"service_principal_id":""}` ### `microsoftentraid_service_principal_get` Get Service Principal · Read-only Get one service principal by object ID. Returns the service principal's properties such as appId, displayName, appRoles, oauth2PermissionScopes, servicePrincipalType and accountEnabled. Use service_principal_get for a known enterprise application. Use service_principals_list to find it first. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `service_principal_id` (`string`, required): Object ID (GUID) of the service principal. - `$select` (`string`, optional): Comma-separated list of service principal properties to return. Example: id,appId,displayName,servicePrincipalType,accountEnabled,appRoles,oauth2PermissionScopes,appOwnerOrganizationId. Graph returns only a default subset of properties unless you list the ones you need here. Example input: `{"service_principal_id":""}` ### `microsoftentraid_service_principal_member_of_list` List Service Principal Memberships · Read-only List the groups and directory roles a service principal is a direct member of. Returns directory objects (groups, directoryRoles) with @odata.type, id and displayName. Use service_principal_member_of_list to find privileged roles held by an app. Use user_member_of_list for users. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `service_principal_id` (`string`, required): Object ID (GUID) of the service principal. - `$count` (`boolean`, optional): Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter. - `$select` (`string`, optional): Comma-separated list of directory object properties to return. Example: id,displayName. Graph returns only a default subset of properties unless you list the ones you need here. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{"service_principal_id":""}` ### `microsoftentraid_service_principal_oauth2_permission_grants_list` List Service Principal Delegated Grants · Read-only List the delegated permission grants (OAuth2 consents) given to an application. Returns oAuth2PermissionGrant objects (id, clientId, consentType, principalId, resourceId, scope). Use service_principal_oauth2_permission_grants_list to audit delegated consent for one app. Use oauth2_permission_grants_list to query grants tenant-wide. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `service_principal_id` (`string`, required): Object ID (GUID) of the service principal. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{"service_principal_id":""}` ### `microsoftentraid_service_principal_owners_list` List Service Principal Owners · Read-only List the owners of a service principal. Returns directory objects (users or service principals) with id, displayName and userPrincipalName. Use service_principal_owners_list to see who manages an enterprise app. Use application_owners_list for the app registration. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `service_principal_id` (`string`, required): Object ID (GUID) of the service principal. - `$count` (`boolean`, optional): Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter. - `$select` (`string`, optional): Comma-separated list of owner properties to return. Example: id,displayName,userPrincipalName,mail. Graph returns only a default subset of properties unless you list the ones you need here. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{"service_principal_id":""}` ### `microsoftentraid_service_principals_list` List Service Principals · Read-only List service principals (enterprise applications and managed identities) in the Microsoft Entra tenant. Returns servicePrincipal objects (id, appId, displayName, servicePrincipalType, accountEnabled by default) plus @odata.nextLink when more pages exist. Use service_principals_list to find enterprise applications, for example by appId. Use applications_list for app registrations. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `$count` (`boolean`, optional): Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter. - `$filter` (`string`, optional): OData $filter expression to narrow service principals. Example: appId eq '00000003-0000-0000-c000-000000000000'. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual. - `$orderby` (`string`, optional): OData $orderby expression to sort results. Example: displayName. Sorting combined with a filter may need advanced query support. - `$search` (`string`, optional): Free-text search over service principals, written as "property:term" with the double quotes included. Example: "displayName:Salesforce". Requires advanced query support, which this tool enables by sending ConsistencyLevel: eventual. - `$select` (`string`, optional): Comma-separated list of service principal properties to return. Example: id,appId,displayName,servicePrincipalType,accountEnabled. Graph returns only a default subset of properties unless you list the ones you need here. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{}` ### `microsoftentraid_sign_in_get` Get Sign-in Log Entry · Read-only Get one sign-in log entry by ID. Returns the full signIn object including device detail, location, applied Conditional Access policies and risk details. Use sign_in_get after sign_ins_list to see the complete record of one sign-in. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `sign_in_id` (`string`, required): ID of the sign-in event, from the id property of sign_ins_list. Example input: `{"sign_in_id":""}` ### `microsoftentraid_sign_ins_list` List Sign-in Logs · Read-only List interactive and non-interactive user sign-in events from the Microsoft Entra sign-in logs, newest first. Returns signIn objects (id, createdDateTime, userPrincipalName, appDisplayName, ipAddress, status, conditionalAccessStatus, riskLevelDuringSignIn, location). Use sign_ins_list to investigate sign-in activity; filter by userPrincipalName, appId or createdDateTime. Use directory_audits_list for configuration changes. Needs Entra ID P1 or P2 and the AuditLog.Read.All scope. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `$filter` (`string`, optional): OData $filter expression to narrow sign-in events. Example: createdDateTime ge 2026-10-01T00:00:00Z and userPrincipalName eq 'ada.lovelace@contoso.com'. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual. - `$orderby` (`string`, optional): OData $orderby expression to sort results. Example: createdDateTime desc. Sorting combined with a filter may need advanced query support. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 1000). When more results exist the response includes @odata.nextLink. Example input: `{}` ### `microsoftentraid_subscribed_skus_list` List Subscribed SKUs · Read-only List the license SKUs the tenant has purchased, with consumed and available units. Returns subscribedSku objects (id, skuId, skuPartNumber, consumedUnits, prepaidUnits, servicePlans). Use subscribed_skus_list to find skuId values for user_assign_license and to track license consumption. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: none. Example input: `{}` ### `microsoftentraid_user_app_role_assignments_list` List User App Role Assignments · Read-only List the enterprise applications and app roles that are assigned to a user. Returns appRoleAssignment objects (id, appRoleId, resourceId, resourceDisplayName, createdDateTime). Use user_app_role_assignments_list to audit which applications a user can access. Use service_principal_app_role_assigned_to_list for the reverse view. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `user_id` (`string`, required): Object ID (GUID) or user principal name (UPN) of the user. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{"user_id":""}` ### `microsoftentraid_user_authentication_methods_list` List User Authentication Methods · Read-only List the authentication methods registered for a user, such as password, Authenticator app, FIDO2 key or phone. Returns authenticationMethod objects with their @odata.type and id; secret values are never returned. Use user_authentication_methods_list to audit MFA registration. Needs the UserAuthenticationMethod.Read.All scope. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `user_id` (`string`, required): Object ID (GUID) or user principal name (UPN) of the user. Example input: `{"user_id":""}` ### `microsoftentraid_user_direct_reports_list` List User Direct Reports · Read-only List the users and contacts who report to a user. Returns directory objects (id, displayName, userPrincipalName, mail) for each direct report. Use user_direct_reports_list to walk down the reporting chain. Use user_manager_get to walk up. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `user_id` (`string`, required): Object ID (GUID) or user principal name (UPN) of the user. - `$count` (`boolean`, optional): Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter. - `$select` (`string`, optional): Comma-separated list of user properties to return. Example: id,displayName,userPrincipalName,mail. Graph returns only a default subset of properties unless you list the ones you need here. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{"user_id":""}` ### `microsoftentraid_user_get` Get User · Read-only Get one user from the Microsoft Entra tenant by object ID or user principal name. Returns the user's profile properties, and any extra properties requested with $select such as signInActivity, accountEnabled or assignedLicenses. Use user_get for a known user. Use users_list to find the user first. Use user_manager_get for the user's manager. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `user_id` (`string`, required): Object ID (GUID) or user principal name (UPN) of the user. - `$select` (`string`, optional): Comma-separated list of user properties to return. Example: id,displayName,userPrincipalName,mail,accountEnabled,jobTitle,department,signInActivity. Graph returns only a default subset of properties unless you list the ones you need here. Example input: `{"user_id":""}` ### `microsoftentraid_user_license_details_list` List User License Details · Read-only List the licenses assigned to a user. Returns licenseDetails objects (id, skuId, skuPartNumber, servicePlans). Use user_license_details_list to see a user's licenses. Use subscribed_skus_list for tenant-wide license counts. Use user_assign_license to change licenses. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `user_id` (`string`, required): Object ID (GUID) or user principal name (UPN) of the user. Example input: `{"user_id":""}` ### `microsoftentraid_user_manager_get` Get User Manager · Read-only Get the manager of a user. Returns the manager's directory object (id, displayName, userPrincipalName, mail), or a 404 error when no manager is set. Use user_manager_get to walk up the reporting chain. Use user_direct_reports_list to walk down. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `user_id` (`string`, required): Object ID (GUID) or user principal name (UPN) of the user. - `$select` (`string`, optional): Comma-separated list of user properties to return. Example: id,displayName,userPrincipalName,mail. Graph returns only a default subset of properties unless you list the ones you need here. Example input: `{"user_id":""}` ### `microsoftentraid_user_member_of_list` List User Group and Role Memberships · Read-only List the groups, directory roles and administrative units a user is a direct member of. Returns directory objects (groups, directoryRoles, administrativeUnits) with their @odata.type, id and displayName. Use user_member_of_list to see a user's direct memberships. Use user_transitive_member_of_list to include memberships inherited through nested groups. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `user_id` (`string`, required): Object ID (GUID) or user principal name (UPN) of the user. - `$count` (`boolean`, optional): Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter. - `$select` (`string`, optional): Comma-separated list of directory object properties to return. Example: id,displayName. Graph returns only a default subset of properties unless you list the ones you need here. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{"user_id":""}` ### `microsoftentraid_user_oauth2_permission_grants_list` List User OAuth2 Permission Grants · Read-only List the delegated permission grants (OAuth2 consents) a user has given to applications. Returns oAuth2PermissionGrant objects (id, clientId, consentType, resourceId, scope). Use user_oauth2_permission_grants_list to see what apps a user consented to. Use oauth2_permission_grants_list to query grants tenant-wide. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `user_id` (`string`, required): Object ID (GUID) or user principal name (UPN) of the user. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{"user_id":""}` ### `microsoftentraid_user_owned_devices_list` List User Owned Devices · Read-only List the devices a user owns. Returns device objects (id, displayName, operatingSystem, trustType, isCompliant). Use user_owned_devices_list for devices a user owns. Use user_registered_devices_list for devices registered to the user. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `user_id` (`string`, required): Object ID (GUID) or user principal name (UPN) of the user. - `$count` (`boolean`, optional): Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter. - `$select` (`string`, optional): Comma-separated list of device properties to return. Example: id,displayName,operatingSystem,trustType,isCompliant. Graph returns only a default subset of properties unless you list the ones you need here. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{"user_id":""}` ### `microsoftentraid_user_registered_devices_list` List User Registered Devices · Read-only List the devices registered to a user. Returns device objects (id, displayName, operatingSystem, trustType, isCompliant). Use user_registered_devices_list for devices registered to the user. Use user_owned_devices_list for devices the user owns. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `user_id` (`string`, required): Object ID (GUID) or user principal name (UPN) of the user. - `$count` (`boolean`, optional): Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter. - `$select` (`string`, optional): Comma-separated list of device properties to return. Example: id,displayName,operatingSystem,trustType,isCompliant. Graph returns only a default subset of properties unless you list the ones you need here. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{"user_id":""}` ### `microsoftentraid_user_transitive_member_of_list` List User Transitive Memberships · Read-only List every group, directory role and administrative unit a user belongs to, including through nested groups. Returns directory objects (groups, directoryRoles, administrativeUnits) with their @odata.type, id and displayName. Use user_transitive_member_of_list for effective access. Use user_member_of_list for direct memberships only. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `user_id` (`string`, required): Object ID (GUID) or user principal name (UPN) of the user. - `$count` (`boolean`, optional): Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter. - `$select` (`string`, optional): Comma-separated list of directory object properties to return. Example: id,displayName. Graph returns only a default subset of properties unless you list the ones you need here. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{"user_id":""}` ### `microsoftentraid_users_list` List Users · Read-only List users in the Microsoft Entra tenant, optionally filtered, searched, sorted or limited to selected properties. Returns user objects (id, displayName, givenName, surname, mail, userPrincipalName and jobTitle by default) plus @odata.nextLink when more pages exist. Use users_list to browse or search the directory. Use user_get when you already know the user's ID or user principal name. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `$count` (`boolean`, optional): Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter. - `$expand` (`string`, optional): Related objects to expand inline in each result. Example: manager. - `$filter` (`string`, optional): OData $filter expression to narrow users. Example: accountEnabled eq true and department eq 'Sales'. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual. - `$orderby` (`string`, optional): OData $orderby expression to sort results. Example: displayName. Sorting combined with a filter may need advanced query support. - `$search` (`string`, optional): Free-text search over users, written as "property:term" with the double quotes included. Example: "displayName:Ada". Requires advanced query support, which this tool enables by sending ConsistencyLevel: eventual. - `$select` (`string`, optional): Comma-separated list of user properties to return. Example: id,displayName,userPrincipalName,mail,accountEnabled,jobTitle,department. Graph returns only a default subset of properties unless you list the ones you need here. - `$skiptoken` (`string`, optional): Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response. - `$top` (`integer`, optional): Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink. Example input: `{}` ### `microsoftentraid_application_add_password` Add Application Client Secret · Write Create a new client secret (password credential) for an application registration. Returns the passwordCredential including keyId and the secretText value, which is shown only once. Use application_add_password to rotate or issue a client secret. Use application_remove_password to delete one by keyId. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `application_id` (`string`, required): Object ID (GUID) of the application registration. This is the 'id' property, not the appId (client ID). - `display_name` (`string`, optional): Friendly name for the secret. - `end_date_time` (`string`, optional): Expiry of the secret as an ISO 8601 UTC timestamp. Graph caps the lifetime at 2 years; leave empty to use the tenant default lifetime. Example input: `{"application_id":""}` ### `microsoftentraid_application_create` Create Application · Write Create a new application registration in the Microsoft Entra tenant. Returns the created application object including its id (object ID) and appId (client ID). Use application_create to register an app. Use service_principal_create afterwards to instantiate it in the tenant. Use application_add_password to create a client secret. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `display_name` (`string`, required): Display name of the application. - `description` (`string`, optional): Free-text description of the application. - `identifier_uris` (`array`, optional): Application ID URIs that identify the app as a resource, for example api://. - `notes` (`string`, optional): Notes relevant to the management of the application. - `sign_in_audience` (`string`, optional): Which accounts can sign in to the application: AzureADMyOrg (this tenant only), AzureADMultipleOrgs (any organizational directory), AzureADandPersonalMicrosoftAccount, or PersonalMicrosoftAccount. One of: `AzureADMyOrg`, `AzureADMultipleOrgs`, `AzureADandPersonalMicrosoftAccount`, `PersonalMicrosoftAccount`. - `web_redirect_uris` (`array`, optional): Redirect URIs for a web application. Each must be an absolute https URL (http only for localhost). Example input: `{"display_name":""}` ### `microsoftentraid_application_federated_credential_create` Create Application Federated Credential · Write Create a federated identity credential so an external identity provider can authenticate as the application without a secret. Returns the created federatedIdentityCredential including its id. Use application_federated_credential_create for workload identity federation. Use application_federated_credentials_list to review existing ones. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `application_id` (`string`, required): Object ID (GUID) of the application registration. This is the 'id' property, not the appId (client ID). - `audiences` (`array`, required): Audiences that can appear in the external token. Use ["api://AzureADTokenExchange"] for Entra ID. - `issuer` (`string`, required): URL of the external identity provider issuer. It must match the iss claim of the external token. - `name` (`string`, required): Unique name of the credential within the application (3-120 characters, URL-friendly). - `subject` (`string`, required): Identifier of the external workload; must match the sub claim of the external token. - `description` (`string`, optional): Description of the credential. Example input: `{"application_id":"","audiences":[],"issuer":"","name":"","subject":""}` ### `microsoftentraid_application_owner_add` Add Application Owner · Write Add a user or service principal as an owner of an application registration. Returns an empty body on success (HTTP 204). Use application_owner_add to grant management rights on an app registration. Use application_owners_list to review owners. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `application_id` (`string`, required): Object ID (GUID) of the application registration. This is the 'id' property, not the appId (client ID). - `owner_id` (`string`, required): Object ID (GUID) of the user or service principal to add as owner. Example input: `{"application_id":"","owner_id":""}` ### `microsoftentraid_application_remove_password` Remove Application Client Secret · Write Delete a client secret from an application registration by its keyId. Returns an empty body on success (HTTP 204). Use application_remove_password to retire a leaked or expired secret. Read the keyId from application_get. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `application_id` (`string`, required): Object ID (GUID) of the application registration. This is the 'id' property, not the appId (client ID). - `key_id` (`string`, required): keyId (GUID) of the password credential to remove, as listed in passwordCredentials on the application. Example input: `{"application_id":"","key_id":""}` ### `microsoftentraid_application_update` Update Application · Write Update properties of an application registration; only the fields you provide change. Returns an empty body on success (HTTP 204). Use application_update to rename an app or change its redirect URIs or sign-in audience. Use application_create to register a new app. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `application_id` (`string`, required): Object ID (GUID) of the application registration. This is the 'id' property, not the appId (client ID). - `description` (`string`, optional): New description. - `display_name` (`string`, optional): New display name. - `identifier_uris` (`array`, optional): Replacement list of application ID URIs. This replaces the whole list. - `notes` (`string`, optional): New notes. - `sign_in_audience` (`string`, optional): New sign-in audience. One of: `AzureADMyOrg`, `AzureADMultipleOrgs`, `AzureADandPersonalMicrosoftAccount`, `PersonalMicrosoftAccount`. - `web_redirect_uris` (`array`, optional): Replacement list of redirect URIs for a web application. This replaces the whole list. Example input: `{"application_id":""}` ### `microsoftentraid_directory_role_member_add` Add Directory Role Member · Write Add a user or service principal to an activated directory role. Returns an empty body on success (HTTP 204). Use directory_role_member_add to grant a built-in admin role. Use role_assignment_create for scoped assignments. Needs the RoleManagement.ReadWrite.Directory scope. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `directory_role_id` (`string`, required): Object ID (GUID) of the activated directory role, from directory_roles_list. - `member_id` (`string`, required): Object ID (GUID) of the user or service principal to add. Example input: `{"directory_role_id":"","member_id":""}` ### `microsoftentraid_group_create` Create Group · Write Create a security group or a Microsoft 365 group in the Microsoft Entra tenant. Returns the created group object including its new id. Use group_create to add a group. Use group_update to change an existing group. Use group_owner_add to assign owners afterwards. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `display_name` (`string`, required): Name displayed in the address book for the group. - `mail_enabled` (`boolean`, required): Set true for a Microsoft 365 group or mail-enabled group, false for a security-only group. - `mail_nickname` (`string`, required): Mail alias for the group, unique in the organization. Required by Graph even for groups with mail disabled. - `security_enabled` (`boolean`, required): Set true for a security group that can be used to control access to resources. - `description` (`string`, optional): Description of the group. - `group_types` (`array`, optional): Group type flags. Use ["Unified"] for a Microsoft 365 group, ["DynamicMembership"] for dynamic membership, or leave empty for a plain security group. - `member_ids` (`array`, optional): Object IDs (GUIDs) of users to add as members when the group is created (up to 20). - `membership_rule` (`string`, optional): Dynamic membership rule. Only used when group_types contains DynamicMembership. - `membership_rule_processing_state` (`string`, optional): Whether dynamic membership processing is On or Paused. Only used with a membership rule. One of: `On`, `Paused`. - `owner_ids` (`array`, optional): Object IDs (GUIDs) of users to set as owners when the group is created. - `visibility` (`string`, optional): Group join policy and visibility. One of: `Private`, `Public`, `HiddenMembership`. Example input: `{"display_name":"","mail_enabled":true,"mail_nickname":"","security_enabled":true}` ### `microsoftentraid_group_owner_add` Add Group Owner · Write Add a user or service principal as an owner of a group. Returns an empty body on success (HTTP 204). Use group_owner_add to grant group management rights. Use group_owner_remove to revoke them. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `group_id` (`string`, required): Object ID (GUID) of the group. - `owner_id` (`string`, required): Object ID (GUID) of the user or service principal to add as owner. Example input: `{"group_id":"","owner_id":""}` ### `microsoftentraid_group_update` Update Group · Write Update properties of a group; only the fields you provide change. Returns an empty body on success (HTTP 204). Use group_update to rename a group or change its description or visibility. Use group_create to add a new group. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `group_id` (`string`, required): Object ID (GUID) of the group. - `description` (`string`, optional): New description for the group. - `display_name` (`string`, optional): New display name for the group. - `mail_nickname` (`string`, optional): New mail alias for the group. - `membership_rule` (`string`, optional): New dynamic membership rule. Only valid on dynamic groups. - `membership_rule_processing_state` (`string`, optional): Turn dynamic membership processing On or Paused. One of: `On`, `Paused`. - `visibility` (`string`, optional): New visibility of a Microsoft 365 group. One of: `Private`, `Public`, `HiddenMembership`. Example input: `{"group_id":""}` ### `microsoftentraid_oauth2_permission_grant_create` Create OAuth2 Permission Grant · Write Grant delegated permissions (admin consent or consent for one user) from a client application to a resource application. Returns the created oAuth2PermissionGrant including its id. Use oauth2_permission_grant_create to grant admin consent without the portal. Use oauth2_permission_grants_list to check existing grants first. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `client_id` (`string`, required): Object ID (GUID) of the client service principal that is granted access (not its appId). - `consent_type` (`string`, required): AllPrincipals grants consent on behalf of the whole organization. Principal grants it for a single user, which requires principal_id. One of: `AllPrincipals`, `Principal`. - `resource_id` (`string`, required): Object ID (GUID) of the resource service principal being accessed, for example the Microsoft Graph service principal in your tenant. - `scope` (`string`, required): Space-separated list of delegated permission scopes to grant. Example: User.Read Group.Read.All. - `principal_id` (`string`, optional): Object ID (GUID) of the user who consents. Required when consent_type is Principal, omit otherwise. Example input: `{"client_id":"","consent_type":"AllPrincipals","resource_id":"","scope":""}` ### `microsoftentraid_role_assignment_create` Create Role Assignment · Write Assign a Microsoft Entra directory role to a user, group or service principal, optionally scoped to an administrative unit or app. Returns the created unifiedRoleAssignment including its id. Use role_assignment_create to grant an admin role with optional scoping. Use role_definitions_list to find the role ID. Needs the RoleManagement.ReadWrite.Directory scope. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `directory_scope_id` (`string`, required): Scope of the assignment. Use / for the whole tenant, /administrativeUnits/ for an administrative unit, or / for an app-scoped role. Leave empty for tenant-wide. - `principal_id` (`string`, required): Object ID (GUID) of the user, group or service principal that receives the role. - `role_definition_id` (`string`, required): ID (GUID) of the role definition to assign. Example input: `{"directory_scope_id":"","principal_id":"","role_definition_id":""}` ### `microsoftentraid_service_principal_app_role_assigned_to_create` Assign App Role to Principal · Write Assign a user, group or service principal to an app role on an enterprise application. Returns the created appRoleAssignment including its id. Use service_principal_app_role_assigned_to_create to grant app access. Use the default access role ID 00000000-0000-0000-0000-000000000000 when the app defines no roles. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `app_role_id` (`string`, required): ID (GUID) of the app role to assign, from the appRoles list of the service principal. Use 00000000-0000-0000-0000-000000000000 for the default access role. - `principal_id` (`string`, required): Object ID (GUID) of the user, group or service principal receiving the assignment. - `resource_id` (`string`, required): Object ID (GUID) of the service principal that exposes the app role; normally the same value as service_principal_id. - `service_principal_id` (`string`, required): Object ID (GUID) of the service principal. Example input: `{"app_role_id":"","principal_id":"","resource_id":"","service_principal_id":""}` ### `microsoftentraid_service_principal_create` Create Service Principal · Write Create a service principal, which instantiates an application registration as an enterprise application in the tenant. Returns the created service principal including its id. Use service_principal_create after application_create, or to add a multi-tenant app from another tenant. Use service_principal_update to change an existing one. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `app_id` (`string`, required): appId (client ID, a GUID) of the application to instantiate. - `account_enabled` (`boolean`, optional): Whether the service principal account is enabled. Defaults to true on the server when omitted. - `app_role_assignment_required` (`boolean`, optional): When true, users and groups must be assigned an app role before they can sign in to the app. - `tags` (`array`, optional): Custom tags. Use ["WindowsAzureActiveDirectoryIntegratedApp"] to show the app under Enterprise applications in the portal. Example input: `{"app_id":""}` ### `microsoftentraid_service_principal_update` Update Service Principal · Write Update properties of a service principal; only the fields you provide change. Returns an empty body on success (HTTP 204). Use service_principal_update to disable an enterprise app or require assignment. Use service_principal_create to add a new one. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `service_principal_id` (`string`, required): Object ID (GUID) of the service principal. - `account_enabled` (`boolean`, optional): Set false to block the application from signing in. - `app_role_assignment_required` (`boolean`, optional): When true, users and groups must be assigned an app role before they can sign in. - `display_name` (`string`, optional): New display name. - `notes` (`string`, optional): New notes. - `tags` (`array`, optional): Replacement list of tags. This replaces the whole list. Example input: `{"service_principal_id":""}` ### `microsoftentraid_user_assign_license` Assign User License · Write Add or remove licenses for a user in one call. Returns the updated user object including assignedLicenses. Use user_assign_license to grant or revoke SKUs. Use subscribed_skus_list to find skuId values. The user needs a usageLocation first. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `user_id` (`string`, required): Object ID (GUID) or user principal name (UPN) of the user. - `add_license_sku_ids` (`array`, optional): SKU IDs (GUIDs) of the licenses to add. Pass an empty array to add none. Find IDs with subscribed_skus_list. - `remove_license_sku_ids` (`array`, optional): SKU IDs (GUIDs) of the licenses to remove. Pass an empty array to remove none. Example input: `{"user_id":""}` ### `microsoftentraid_user_create` Create User · Write Create a new cloud user in the Microsoft Entra tenant. Returns the created user object including its new id. Use user_create to add a member account. Use user_update to change an existing user. Use user_assign_license afterwards to license the user. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `account_enabled` (`boolean`, required): Whether the account is enabled. Set true for a user who can sign in immediately. - `display_name` (`string`, required): Name displayed in the address book for the user, usually first and last name. - `mail_nickname` (`string`, required): Mail alias for the user. It is the part of the email address before the @ sign. - `password` (`string`, required): Initial password for the user. It must satisfy the tenant's password complexity policy. - `user_principal_name` (`string`, required): User principal name (UPN) in the form alias@domain. The domain must be a verified domain of the tenant. - `city` (`string`, optional): City in which the user is located. - `company_name` (`string`, optional): Name of the company the user is associated with. - `country` (`string`, optional): Country or region in which the user is located. - `department` (`string`, optional): Name of the department in which the user works. - `force_change_password_next_sign_in` (`boolean`, optional): Set true to require the user to change the password at the next sign-in. Leave empty to use the tenant default behavior. - `given_name` (`string`, optional): First name of the user. - `job_title` (`string`, optional): Job title of the user. - `mobile_phone` (`string`, optional): Primary cellular telephone number of the user. - `office_location` (`string`, optional): Office location in the user's place of business. - `surname` (`string`, optional): Last name of the user. - `usage_location` (`string`, optional): Two-letter ISO 3166 country code. Required before a license can be assigned to the user. Example input: `{"account_enabled":true,"display_name":"","mail_nickname":"","password":"","user_principal_name":""}` ### `microsoftentraid_user_revoke_sign_in_sessions` Revoke User Sign-in Sessions · Write Invalidate all refresh tokens and session cookies for a user, forcing a new sign-in. Returns {"value": true} on success. Use user_revoke_sign_in_sessions after a suspected account compromise or offboarding. Use user_update with account_enabled false to block sign-in entirely. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `user_id` (`string`, required): Object ID (GUID) or user principal name (UPN) of the user. Example input: `{"user_id":""}` ### `microsoftentraid_user_set_manager` Set User Manager · Write Assign a manager to a user, replacing any existing manager. Returns an empty body on success (HTTP 204). Use user_set_manager to change the reporting line. Use user_manager_get to read the current manager. Read only: no. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `manager_id` (`string`, required): Object ID (GUID) of the user who becomes the manager. - `user_id` (`string`, required): Object ID (GUID) or user principal name (UPN) of the user. Example input: `{"manager_id":"","user_id":""}` ### `microsoftentraid_user_update` Update User · Write Update properties of a user in the Microsoft Entra tenant; only the fields you provide change. Returns an empty body on success (HTTP 204). Use user_update to disable an account or edit profile fields. Use user_create to add a new user. Use user_set_manager to change the manager. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `user_id` (`string`, required): Object ID (GUID) or user principal name (UPN) of the user to update. - `account_enabled` (`boolean`, optional): Set false to block the user from signing in, true to re-enable the account. - `city` (`string`, optional): New city. - `company_name` (`string`, optional): New company name. - `country` (`string`, optional): New country or region. - `department` (`string`, optional): New department name. - `display_name` (`string`, optional): New display name for the user. - `given_name` (`string`, optional): New first name. - `job_title` (`string`, optional): New job title. - `mobile_phone` (`string`, optional): New mobile phone number. - `office_location` (`string`, optional): New office location. - `surname` (`string`, optional): New last name. - `usage_location` (`string`, optional): Two-letter ISO 3166 country code, required before assigning a license. Example input: `{"user_id":""}` ### `microsoftentraid_group_owner_remove` Remove Group Owner · Destructive Remove an owner from a group. Returns an empty body on success (HTTP 204). Use group_owner_remove to revoke group management rights. Use group_owners_list to find owner IDs. Read only: no. Destructive: yes. Idempotent (safe to retry): yes. Inputs: - `group_id` (`string`, required): Object ID (GUID) of the group. - `owner_id` (`string`, required): Object ID (GUID) of the owner to remove. Example input: `{"group_id":"","owner_id":""}` ## Related Other Developer Tools connectors ([all 117](/agentkit/connectors/?category=developer-tools)): - [GitHub](/agentkit/connectors/github/): Scalekit connector, OAuth, 217 tools - [Datadog](/agentkit/connectors/datadog/): Scalekit connector, API key, 105 tools - [Linear](/agentkit/connectors/linear/): Scalekit connector, OAuth, 62 tools --- ## More Scalekit documentation | Resource | What it contains | When to use it | |----------|-----------------|----------------| | [/llms.txt](/llms.txt) | Structured index with routing hints per product area | Start here — find which documentation set covers your topic before loading full content | | [/llms-full.txt](/llms-full.txt) | Complete documentation for all Scalekit products in one file | Use when you need exhaustive context across multiple products or when the topic spans several areas | | [sitemap-0.xml](https://docs.scalekit.com/sitemap-0.xml) | Full URL list of every documentation page | Use to discover specific page URLs you can fetch for targeted, page-level answers |