The Microsoft Entra ID connector lets your AI agent act in each user's Microsoft Entra ID account. Each user signs in to Microsoft Entra ID once, and Scalekit stores and refreshes their tokens, so your agent never handles credentials. It comes with 82 tools.
- Tools
- 82
- What they doRead · write · destructive
- 61 · 20 · 161 read20 write1 destructive
- Users sign in with
- OAuth
- OAuth app
- Your own Microsoft Entra ID app
Setup
Install the SDK
Terminal window npm install @scalekit-sdk/node dotenvTerminal window pip install scalekit-sdk-python python-dotenvSet your credentials
Add your Scalekit credentials to your
.envfile. Find values in app.scalekit.com > Developers > API Credentials..env SCALEKIT_ENVIRONMENT_URL=<your-environment-url>SCALEKIT_CLIENT_ID=<your-client-id>SCALEKIT_CLIENT_SECRET=<your-client-secret>Create the Microsoft Entra ID connection
In AgentKit > Connections, create a Microsoft Entra ID connection and copy its redirect URI. The name you give it is the
connection_nameyour code passes. See Configure connections.Register an OAuth app
Microsoft Entra ID connections use your own OAuth app. Register one with Microsoft Entra ID and add the redirect URI you copied.
Then enter the app's Client ID and Client Secret on the Microsoft Entra ID connection.
Authorize a user and make your first call
quickstart.mts import { ScalekitClient } from '@scalekit-sdk/node'import 'dotenv/config'import { createInterface } from 'node:readline/promises'const scalekit = new ScalekitClient(process.env.SCALEKIT_ENVIRONMENT_URL,process.env.SCALEKIT_CLIENT_ID,process.env.SCALEKIT_CLIENT_SECRET,)const actions = scalekit.actionsconst connector = 'microsoftentraid'const identifier = 'user_123'// Generate an authorization link for the userconst { link } = await actions.getAuthorizationLink({ connectionName: connector, identifier })console.log('Authorize Microsoft Entra ID:', link)const rl = createInterface({ input: process.stdin, output: process.stdout })await rl.question('Press Enter after authorizing...')rl.close()// Make your first callconst result = await actions.executeTool({connector,identifier,toolName: 'microsoftentraid_administrative_units_list',toolInput: {},})console.log(result)Terminal window npx tsx quickstart.mtsquickstart.py import osfrom scalekit import ScalekitClientfrom dotenv import load_dotenvload_dotenv()scalekit_client = ScalekitClient(env_url=os.getenv("SCALEKIT_ENVIRONMENT_URL"),client_id=os.getenv("SCALEKIT_CLIENT_ID"),client_secret=os.getenv("SCALEKIT_CLIENT_SECRET"),)actions = scalekit_client.actionsconnection_name = "microsoftentraid"identifier = "user_123"# Generate an authorization link for the userlink_response = actions.get_authorization_link(connection_name=connection_name,identifier=identifier,)print("Authorize Microsoft Entra ID:", link_response.link)input("Press Enter after authorizing...")# Make your first callresult = actions.execute_tool(tool_input={},tool_name="microsoftentraid_administrative_units_list",connection_name=connection_name,identifier=identifier,)print(result)Terminal window python quickstart.pyEach user signs in once. See Authorize a user for the full flow and statuses.
Tools
Pass the exact name toexecute_toolmicrosoftentraid_administrative_unit_members_listList the users, groups and devices that belong to an administrative unit.Read-onlyList Administrative Unit Members
List the users, groups and devices that belong to an administrative unit. Returns directory objects with @odata.type, id and displayName. Use administrative_unit_members_list to see who a scoped admin can manage. Use administrative_units_list to find the unit ID.
Inputs
administrative_unit_idstringrequired- Object ID (GUID) of the administrative unit.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_administrative_units_listList the administrative units that scope delegated administration in the tenant.Read-onlyList Administrative Units
List the administrative units that scope delegated administration in the tenant. Returns administrativeUnit objects (id, displayName, description, visibility, membershipType). Use administrative_units_list to find units for scoped role assignments. Use administrative_unit_members_list for the members of one.
Inputs
$filterstring- OData $filter expression to narrow administrative units. Example: startswith(displayName,'EMEA'). Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_application_federated_credentials_listList the federated identity credentials of an application registration (workload identity federation).Read-onlyList Application Federated Credentials
List the federated identity credentials of an application registration (workload identity federation). Returns federatedIdentityCredential objects (id, name, issuer, subject, audiences). Use application_federated_credentials_list to audit trusted external identity providers such as GitHub Actions. Use application_federated_credential_create to add one.
Inputs
application_idstringrequired- Object ID (GUID) of the application registration. This is the 'id' property, not the appId (client ID).
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_application_getGet one application registration by object ID.Read-onlyGet Application
Get one application registration by object ID. Returns the application's properties such as appId, displayName, signInAudience, web redirect URIs, requiredResourceAccess, keyCredentials and passwordCredentials metadata. Use application_get for a known app registration. Use applications_list to find it first.
Inputs
application_idstringrequired- Object ID (GUID) of the application registration. This is the 'id' property, not the appId (client ID).
$selectstring- Comma-separated list of application properties to return. Example: id,appId,displayName,signInAudience,createdDateTime,web,requiredResourceAccess,passwordCredentials,keyCredentials. Graph returns only a default subset of properties unless you list the ones you need here.
microsoftentraid_application_owners_listList the owners of an application registration.Read-onlyList Application Owners
List the owners of an application registration. Returns directory objects (users or service principals) with id, displayName and userPrincipalName. Use application_owners_list to find who manages an app registration. Use application_owner_add to add one.
Inputs
application_idstringrequired- Object ID (GUID) of the application registration. This is the 'id' property, not the appId (client ID).
$countboolean- Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter.
$selectstring- Comma-separated list of owner properties to return. Example: id,displayName,userPrincipalName,mail. Graph returns only a default subset of properties unless you list the ones you need here.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_applications_listList application registrations in the Microsoft Entra tenant.Read-onlyList Applications
List application registrations in the Microsoft Entra tenant. Returns application objects (id, appId, displayName, signInAudience, createdDateTime by default) plus @odata.nextLink when more pages exist. Use applications_list to find app registrations. Use service_principals_list for the enterprise application (tenant instance) of an app.
Inputs
$countboolean- Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter.
$filterstring- OData $filter expression to narrow applications. Example: displayName eq 'Payroll Portal'. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual.
$orderbystring- OData $orderby expression to sort results. Example: displayName. Sorting combined with a filter may need advanced query support.
$searchstring- Free-text search over applications, written as "property:term" with the double quotes included. Example: "displayName:Payroll". Requires advanced query support, which this tool enables by sending ConsistencyLevel: eventual.
$selectstring- Comma-separated list of application properties to return. Example: id,appId,displayName,signInAudience,createdDateTime. Graph returns only a default subset of properties unless you list the ones you need here.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_authentication_strength_policies_listList the authentication strength policies (built-in and custom) that Conditional Access can require.Read-onlyList Authentication Strength Policies
List the authentication strength policies (built-in and custom) that Conditional Access can require. Returns authenticationStrengthPolicy objects (id, displayName, policyType, allowedCombinations). Use authentication_strength_policies_list to see which MFA method combinations satisfy each strength. Needs the Policy.Read.All scope.
Inputs
$filterstring- OData $filter expression to narrow authentication strength policies. Example: policyType eq 'custom'. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual.
microsoftentraid_conditional_access_policies_listList the Conditional Access policies of the tenant.Read-onlyList Conditional Access Policies
List the Conditional Access policies of the tenant. Returns conditionalAccessPolicy objects (id, displayName, state, conditions, grantControls, sessionControls). Use conditional_access_policies_list to audit access rules. Use conditional_access_policy_get for one policy. Needs the Policy.Read.All scope.
Inputs
$filterstring- OData $filter expression to narrow policies. Example: state eq 'enabled'. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual.
microsoftentraid_conditional_access_policy_getGet one Conditional Access policy by ID.Read-onlyGet Conditional Access Policy
Get one Conditional Access policy by ID. Returns the policy with its state, conditions (users, applications, locations, platforms), grantControls and sessionControls. Use conditional_access_policy_get after conditional_access_policies_list to inspect one policy. Needs the Policy.Read.All scope.
Inputs
policy_idstringrequired- ID (GUID) of the Conditional Access policy.
microsoftentraid_device_getGet one device by directory object ID.Read-onlyGet Device
Get one device by directory object ID. Returns the device's properties such as displayName, operatingSystem, trustType, isCompliant, isManaged and registrationDateTime. Use device_get for one known device. Use devices_list to find it first.
Inputs
device_object_idstringrequired- Object ID (GUID) of the device; this is the id property, not deviceId.
$selectstring- Comma-separated list of device properties to return. Example: id,deviceId,displayName,operatingSystem,trustType,isCompliant,isManaged,registrationDateTime. Graph returns only a default subset of properties unless you list the ones you need here.
microsoftentraid_devices_listList devices registered or joined in the Microsoft Entra tenant.Read-onlyList Devices
List devices registered or joined in the Microsoft Entra tenant. Returns device objects (id, deviceId, displayName, operatingSystem, operatingSystemVersion, trustType, isCompliant, isManaged, approximateLastSignInDateTime). Use devices_list to inventory devices or find non-compliant ones. Use device_get for one device. Use user_owned_devices_list for a user's devices.
Inputs
$countboolean- Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter.
$filterstring- OData $filter expression to narrow devices. Example: operatingSystem eq 'Windows' and isCompliant eq false. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual.
$orderbystring- OData $orderby expression to sort results. Example: displayName. Sorting combined with a filter may need advanced query support.
$searchstring- Free-text search over devices, written as "property:term" with the double quotes included. Example: "displayName:LAPTOP". Requires advanced query support, which this tool enables by sending ConsistencyLevel: eventual.
$selectstring- Comma-separated list of device properties to return. Example: id,deviceId,displayName,operatingSystem,trustType,isCompliant,approximateLastSignInDateTime. Graph returns only a default subset of properties unless you list the ones you need here.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_directory_audit_getGet one directory audit entry by ID.Read-onlyGet Directory Audit Entry
Get one directory audit entry by ID. Returns the full directoryAudit object including initiatedBy, targetResources and modifiedProperties. Use directory_audit_get after directory_audits_list to see the complete record of one change.
Inputs
audit_idstringrequired- ID of the audit event, from the id property of directory_audits_list.
microsoftentraid_directory_audits_listList directory audit events, which record changes made to users, groups, applications, roles and policies in the tenant.Read-onlyList Directory Audit Logs
List directory audit events, which record changes made to users, groups, applications, roles and policies in the tenant. Returns directoryAudit objects (id, activityDisplayName, activityDateTime, category, result, initiatedBy, targetResources). Use directory_audits_list to see who changed what. Use sign_ins_list for authentication events. Needs the AuditLog.Read.All scope.
Inputs
$filterstring- OData $filter expression to narrow audit events. Example: activityDateTime ge 2026-10-01T00:00:00Z and category eq 'UserManagement'. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual.
$orderbystring- OData $orderby expression to sort results. Example: activityDateTime desc. Sorting combined with a filter may need advanced query support.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_directory_role_getGet one activated directory role by object ID or role template ID.Read-onlyGet Directory Role
Get one activated directory role by object ID or role template ID. Returns the directoryRole (id, displayName, description, roleTemplateId). Use directory_role_get for a known role. Use directory_roles_list to enumerate activated roles.
Inputs
directory_role_idstringrequired- Object ID (GUID) of the directory role, or its roleTemplateId.
microsoftentraid_directory_role_members_listList the users and service principals that hold an activated directory role (for example Global Administrator).Read-onlyList Directory Role Members
List the users and service principals that hold an activated directory role (for example Global Administrator). Returns directory objects (id, displayName, userPrincipalName, @odata.type) for each member. Use directory_role_members_list to audit privileged access. Use role_assignments_list to also see scoped and PIM-managed assignments.
Inputs
directory_role_idstringrequired- Object ID (GUID) of the directory role from directory_roles_list, or roleTemplateId of the role.
$selectstring- Comma-separated list of member properties to return. Example: id,displayName,userPrincipalName,mail. Graph returns only a default subset of properties unless you list the ones you need here.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_directory_role_templates_listList all directory role templates, including roles that are not yet activated in the tenant.Read-onlyList Directory Role Templates
List all directory role templates, including roles that are not yet activated in the tenant. Returns directoryRoleTemplate objects (id, displayName, description). Use directory_role_templates_list to find the template ID of a built-in role. Use role_definitions_list for full role definitions with permissions.
Inputs
$selectstring- Comma-separated list of role template properties to return. Example: id,displayName,description. Graph returns only a default subset of properties unless you list the ones you need here.
microsoftentraid_directory_roles_listList the directory roles that are activated in the tenant.Read-onlyList Activated Directory Roles
List the directory roles that are activated in the tenant. Returns directoryRole objects (id, displayName, description, roleTemplateId). Use directory_roles_list to find the role object ID before listing its members. Use directory_role_templates_list for roles that are not yet activated.
Inputs
$selectstring- Comma-separated list of role properties to return. Example: id,displayName,description,roleTemplateId. Graph returns only a default subset of properties unless you list the ones you need here.
microsoftentraid_domain_getGet one tenant domain by its name.Read-onlyGet Domain
Get one tenant domain by its name. Returns the domain (id, isVerified, isDefault, isAdminManaged, authenticationType, passwordValidityPeriodInDays). Use domain_get for one known domain. Use domains_list to enumerate.
Inputs
domain_idstringrequired- Fully qualified domain name, which is the id of the domain.
microsoftentraid_domain_verification_dns_records_listList the DNS records required to verify ownership of a domain.Read-onlyList Domain Verification DNS Records
List the DNS records required to verify ownership of a domain. Returns domainDnsRecord objects (id, recordType, label, ttl, text or mailExchange). Use domain_verification_dns_records_list when onboarding a custom domain. Use domain_get to check isVerified.
Inputs
domain_idstringrequired- Fully qualified domain name to verify.
microsoftentraid_domains_listList the domains associated with the tenant.Read-onlyList Domains
List the domains associated with the tenant. Returns domain objects (id which is the domain name, isVerified, isDefault, authenticationType, supportedServices). Use domains_list to see verified and unverified domains. Use domain_verification_dns_records_list for the DNS records needed to verify one.
Inputs
$filterstring- OData $filter expression to narrow domains. Example: isVerified eq true. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual.
microsoftentraid_group_app_role_assignments_listList the enterprise applications and app roles that are assigned to a group.Read-onlyList Group App Role Assignments
List the enterprise applications and app roles that are assigned to a group. Returns appRoleAssignment objects (id, appRoleId, resourceId, resourceDisplayName). Use group_app_role_assignments_list to see which apps a group grants access to. Use user_app_role_assignments_list for a single user.
Inputs
group_idstringrequired- Object ID (GUID) of the group.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_group_getGet one group from the Microsoft Entra tenant by object ID.Read-onlyGet Group
Get one group from the Microsoft Entra tenant by object ID. Returns the group's properties such as displayName, description, mail, groupTypes, securityEnabled and membershipRule. Use group_get for a known group. Use groups_list to find the group first.
Inputs
group_idstringrequired- Object ID (GUID) of the group.
$selectstring- Comma-separated list of group properties to return. Example: id,displayName,description,mail,securityEnabled,groupTypes,membershipRule. Graph returns only a default subset of properties unless you list the ones you need here.
microsoftentraid_group_member_of_listList the groups and administrative units that a group is a direct member of.Read-onlyList Group Memberships
List the groups and administrative units that a group is a direct member of. Returns directory objects with @odata.type, id and displayName. Use group_member_of_list to find parent groups. Use group_members_list for the group's own members.
Inputs
group_idstringrequired- Object ID (GUID) of the group.
$countboolean- Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter.
$selectstring- Comma-separated list of group properties to return. Example: id,displayName. Graph returns only a default subset of properties unless you list the ones you need here.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_group_members_listList the direct members of a group (users, devices, service principals, contacts and nested groups).Read-onlyList Group Members
List the direct members of a group (users, devices, service principals, contacts and nested groups). Returns directory objects with @odata.type, id, displayName and, for users, userPrincipalName and mail. Use group_members_list for direct members. Use group_transitive_members_list to expand nested groups. Use group_owners_list for owners.
Inputs
group_idstringrequired- Object ID (GUID) of the group.
$countboolean- Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter.
$selectstring- Comma-separated list of member properties to return. Example: id,displayName,userPrincipalName,mail. Graph returns only a default subset of properties unless you list the ones you need here.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_group_owners_listList the owners of a group.Read-onlyList Group Owners
List the owners of a group. Returns directory objects (users or service principals) with id, displayName and userPrincipalName. Use group_owners_list to see who manages a group. Use group_members_list for members. Use group_owner_add to add an owner.
Inputs
group_idstringrequired- Object ID (GUID) of the group.
$countboolean- Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter.
$selectstring- Comma-separated list of owner properties to return. Example: id,displayName,userPrincipalName,mail. Graph returns only a default subset of properties unless you list the ones you need here.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_group_transitive_members_listList all members of a group, expanding nested groups.Read-onlyList Group Transitive Members
List all members of a group, expanding nested groups. Returns directory objects with @odata.type, id, displayName and, for users, userPrincipalName and mail. Use group_transitive_members_list for the effective membership. Use group_members_list for direct members only.
Inputs
group_idstringrequired- Object ID (GUID) of the group.
$countboolean- Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter.
$selectstring- Comma-separated list of member properties to return. Example: id,displayName,userPrincipalName,mail. Graph returns only a default subset of properties unless you list the ones you need here.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_groups_listList groups in the Microsoft Entra tenant, including Microsoft 365 groups and security groups.Read-onlyList Groups
List groups in the Microsoft Entra tenant, including Microsoft 365 groups and security groups. Returns group objects (id, displayName, description, mail, groupTypes, securityEnabled by default) plus @odata.nextLink when more pages exist. Use groups_list to browse or search groups. Use group_get for one group by ID. Use group_members_list to list who is in a group.
Inputs
$countboolean- Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter.
$filterstring- OData $filter expression to narrow groups. Example: securityEnabled eq true and startswith(displayName,'Eng'). Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual.
$orderbystring- OData $orderby expression to sort results. Example: displayName. Sorting combined with a filter may need advanced query support.
$searchstring- Free-text search over groups, written as "property:term" with the double quotes included. Example: "displayName:Security". Requires advanced query support, which this tool enables by sending ConsistencyLevel: eventual.
$selectstring- Comma-separated list of group properties to return. Example: id,displayName,description,mail,securityEnabled,groupTypes. Graph returns only a default subset of properties unless you list the ones you need here.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_me_getGet the profile of the user who authorized this connection.Read-onlyGet Signed-in User
Get the profile of the user who authorized this connection. Returns the signed-in user's id, displayName, userPrincipalName and mail, plus any properties requested with $select. Use me_get to confirm which account the connection runs as. Use user_get for any other user.
Inputs
$selectstring- Comma-separated list of user properties to return. Example: id,displayName,userPrincipalName,mail,jobTitle. Graph returns only a default subset of properties unless you list the ones you need here.
microsoftentraid_named_location_getGet one Conditional Access named location by ID.Read-onlyGet Named Location
Get one Conditional Access named location by ID. Returns the namedLocation with its type and either its IP ranges or its countries and regions. Use named_location_get after named_locations_list to inspect one location.
Inputs
named_location_idstringrequired- ID (GUID) of the named location.
microsoftentraid_named_locations_listList the named locations (IP ranges and countries) used by Conditional Access policies.Read-onlyList Named Locations
List the named locations (IP ranges and countries) used by Conditional Access policies. Returns namedLocation objects (id, displayName, @odata.type, and ipRanges or countriesAndRegions). Use named_locations_list to review trusted networks and country rules. Use conditional_access_policies_list for the policies that reference them.
Inputs
$filterstring- OData $filter expression to narrow named locations. Example: isTrusted eq true. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual.
microsoftentraid_oauth2_permission_grants_listList delegated permission grants (OAuth2 consents) across the tenant.Read-onlyList OAuth2 Permission Grants
List delegated permission grants (OAuth2 consents) across the tenant. Returns oAuth2PermissionGrant objects (id, clientId, consentType, principalId, resourceId, scope). Use oauth2_permission_grants_list for a tenant-wide consent audit; filter by clientId to narrow to one app. Use service_principal_oauth2_permission_grants_list for one app.
Inputs
$filterstring- OData $filter expression to narrow grants. Example: clientId eq '5e6f7a8b-9c0d-4e1f-8a2b-3c4d5e6f7a8b'. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_organization_getGet the tenant's organization details.Read-onlyGet Organization
Get the tenant's organization details. Returns the organization object (id which is the tenant ID, displayName, verifiedDomains, assignedPlans, technicalNotificationMails, onPremisesSyncEnabled). Use organization_get for tenant-level facts such as tenant ID and verified domains. Use domains_list for domain verification status.
Inputs
$selectstring- Comma-separated list of organization properties to return. Example: id,displayName,verifiedDomains,onPremisesSyncEnabled. Graph returns only a default subset of properties unless you list the ones you need here.
microsoftentraid_provisioning_logs_listList provisioning log events, which record users and groups synced to or from connected applications by the Entra provisioning service.Read-onlyList Provisioning Logs
List provisioning log events, which record users and groups synced to or from connected applications by the Entra provisioning service. Returns provisioningObjectSummary objects (id, activityDateTime, provisioningAction, sourceSystem, targetSystem, provisioningStatusInfo). Use provisioning_logs_list to debug app provisioning failures. Use directory_audits_list for other directory changes. Needs the AuditLog.Read.All scope.
Inputs
$filterstring- OData $filter expression to narrow provisioning events. Example: provisioningAction eq 'create' and activityDateTime ge 2026-10-01T00:00:00Z. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_risk_detections_listList risk detection events raised by Microsoft Entra ID Protection, such as leaked credentials or anonymous IP sign-ins.Read-onlyList Risk Detections
List risk detection events raised by Microsoft Entra ID Protection, such as leaked credentials or anonymous IP sign-ins. Returns riskDetection objects (id, riskEventType, riskLevel, riskState, detectedDateTime, userPrincipalName, ipAddress). Use risk_detections_list to see why users were flagged. Use risky_users_list for the per-user risk state. Needs Entra ID P2 and the IdentityRiskEvent.Read.All scope.
Inputs
$filterstring- OData $filter expression to narrow risk detections. Example: riskLevel eq 'high' and detectedDateTime ge 2026-10-01T00:00:00Z. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual.
$orderbystring- OData $orderby expression to sort results. Example: detectedDateTime desc. Sorting combined with a filter may need advanced query support.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 500). When more results exist the response includes @odata.nextLink.
microsoftentraid_risky_users_listList users that Microsoft Entra ID Protection flags as at risk.Read-onlyList Risky Users
List users that Microsoft Entra ID Protection flags as at risk. Returns riskyUser objects (id, userPrincipalName, riskLevel, riskState, riskLastUpdatedDateTime). Use risky_users_list to triage compromised accounts. Use risk_detections_list for the underlying events. Needs Entra ID P2 and the IdentityRiskyUser.Read.All scope.
Inputs
$filterstring- OData $filter expression to narrow risky users. Example: riskLevel eq 'high' and riskState eq 'atRisk'. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual.
$orderbystring- OData $orderby expression to sort results. Example: riskLastUpdatedDateTime desc. Sorting combined with a filter may need advanced query support.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 500). When more results exist the response includes @odata.nextLink.
microsoftentraid_role_assignments_listList Microsoft Entra directory role assignments, including scoped assignments.Read-onlyList Role Assignments
List Microsoft Entra directory role assignments, including scoped assignments. Returns unifiedRoleAssignment objects (id, principalId, roleDefinitionId, directoryScopeId). Use role_assignments_list to audit who holds which role, filtering by principalId or roleDefinitionId. Use directory_role_members_list for a simple membership view.
Inputs
$expandstring- Set to principal to inline the user or service principal that holds each assignment.
$filterstring- OData $filter expression to narrow role assignments. Example: roleDefinitionId eq '62e90394-69f5-4237-9190-012177145e10'. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_role_definition_getGet one Microsoft Entra role definition including its permissions.Read-onlyGet Role Definition
Get one Microsoft Entra role definition including its permissions. Returns the unifiedRoleDefinition with displayName, isBuiltIn and rolePermissions (allowedResourceActions). Use role_definition_get to inspect what a role allows. Use role_definitions_list to find role IDs.
Inputs
role_definition_idstringrequired- ID (GUID) of the role definition; for built-in roles this equals the role template ID.
microsoftentraid_role_definitions_listList Microsoft Entra role definitions, both built-in and custom.Read-onlyList Role Definitions
List Microsoft Entra role definitions, both built-in and custom. Returns unifiedRoleDefinition objects (id, displayName, description, isBuiltIn, isEnabled). Use role_definitions_list to find a roleDefinitionId for role_assignment_create or role_assignments_list. Use role_definition_get to see the permissions of one role.
Inputs
$filterstring- OData $filter expression to narrow role definitions. Example: isBuiltIn eq false. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual.
$selectstring- Comma-separated list of role definition properties to return. Example: id,displayName,description,isBuiltIn. Graph returns only a default subset of properties unless you list the ones you need here.
microsoftentraid_role_eligibility_schedule_instances_listList Privileged Identity Management (PIM) eligible directory role assignments that are currently in effect.Read-onlyList Eligible Role Assignments
List Privileged Identity Management (PIM) eligible directory role assignments that are currently in effect. Returns unifiedRoleEligibilityScheduleInstance objects (id, principalId, roleDefinitionId, directoryScopeId, startDateTime, endDateTime). Use role_eligibility_schedule_instances_list to find who can activate a privileged role. Use role_assignments_list for active assignments. Needs Entra ID P2 or ID Governance licensing.
Inputs
$filterstring- OData $filter expression to narrow eligibility instances. Example: principalId eq '8c1e4f2a-3b5d-4c6e-9f70-1a2b3c4d5e6f'. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_service_principal_app_role_assigned_to_listList the users, groups and service principals that are assigned an app role on an enterprise application.Read-onlyList Service Principal App Role Assignees
List the users, groups and service principals that are assigned an app role on an enterprise application. Returns appRoleAssignment objects (id, appRoleId, principalId, principalDisplayName, principalType). Use service_principal_app_role_assigned_to_list to audit who can access an app. Use service_principal_app_role_assignments_list for roles this principal holds on other resources.
Inputs
service_principal_idstringrequired- Object ID (GUID) of the service principal.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_service_principal_app_role_assignments_listList the app roles that a service principal has been granted on other resource applications, such as Microsoft Graph application permissions.Read-onlyList Service Principal App Role Assignments
List the app roles that a service principal has been granted on other resource applications, such as Microsoft Graph application permissions. Returns appRoleAssignment objects (id, appRoleId, resourceId, resourceDisplayName). Use service_principal_app_role_assignments_list to audit application permissions granted to an app. Use service_principal_app_role_assigned_to_list for who is assigned to this app.
Inputs
service_principal_idstringrequired- Object ID (GUID) of the service principal.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_service_principal_getGet one service principal by object ID.Read-onlyGet Service Principal
Get one service principal by object ID. Returns the service principal's properties such as appId, displayName, appRoles, oauth2PermissionScopes, servicePrincipalType and accountEnabled. Use service_principal_get for a known enterprise application. Use service_principals_list to find it first.
Inputs
service_principal_idstringrequired- Object ID (GUID) of the service principal.
$selectstring- Comma-separated list of service principal properties to return. Example: id,appId,displayName,servicePrincipalType,accountEnabled,appRoles,oauth2PermissionScopes,appOwnerOrganizationId. Graph returns only a default subset of properties unless you list the ones you need here.
microsoftentraid_service_principal_member_of_listList the groups and directory roles a service principal is a direct member of.Read-onlyList Service Principal Memberships
List the groups and directory roles a service principal is a direct member of. Returns directory objects (groups, directoryRoles) with @odata.type, id and displayName. Use service_principal_member_of_list to find privileged roles held by an app. Use user_member_of_list for users.
Inputs
service_principal_idstringrequired- Object ID (GUID) of the service principal.
$countboolean- Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter.
$selectstring- Comma-separated list of directory object properties to return. Example: id,displayName. Graph returns only a default subset of properties unless you list the ones you need here.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_service_principal_oauth2_permission_grants_listList the delegated permission grants (OAuth2 consents) given to an application.Read-onlyList Service Principal Delegated Grants
List the delegated permission grants (OAuth2 consents) given to an application. Returns oAuth2PermissionGrant objects (id, clientId, consentType, principalId, resourceId, scope). Use service_principal_oauth2_permission_grants_list to audit delegated consent for one app. Use oauth2_permission_grants_list to query grants tenant-wide.
Inputs
service_principal_idstringrequired- Object ID (GUID) of the service principal.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_service_principal_owners_listList the owners of a service principal.Read-onlyList Service Principal Owners
List the owners of a service principal. Returns directory objects (users or service principals) with id, displayName and userPrincipalName. Use service_principal_owners_list to see who manages an enterprise app. Use application_owners_list for the app registration.
Inputs
service_principal_idstringrequired- Object ID (GUID) of the service principal.
$countboolean- Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter.
$selectstring- Comma-separated list of owner properties to return. Example: id,displayName,userPrincipalName,mail. Graph returns only a default subset of properties unless you list the ones you need here.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_service_principals_listList service principals (enterprise applications and managed identities) in the Microsoft Entra tenant.Read-onlyList Service Principals
List service principals (enterprise applications and managed identities) in the Microsoft Entra tenant. Returns servicePrincipal objects (id, appId, displayName, servicePrincipalType, accountEnabled by default) plus @odata.nextLink when more pages exist. Use service_principals_list to find enterprise applications, for example by appId. Use applications_list for app registrations.
Inputs
$countboolean- Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter.
$filterstring- OData $filter expression to narrow service principals. Example: appId eq '00000003-0000-0000-c000-000000000000'. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual.
$orderbystring- OData $orderby expression to sort results. Example: displayName. Sorting combined with a filter may need advanced query support.
$searchstring- Free-text search over service principals, written as "property:term" with the double quotes included. Example: "displayName:Salesforce". Requires advanced query support, which this tool enables by sending ConsistencyLevel: eventual.
$selectstring- Comma-separated list of service principal properties to return. Example: id,appId,displayName,servicePrincipalType,accountEnabled. Graph returns only a default subset of properties unless you list the ones you need here.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_sign_in_getGet one sign-in log entry by ID.Read-onlyGet Sign-in Log Entry
Get one sign-in log entry by ID. Returns the full signIn object including device detail, location, applied Conditional Access policies and risk details. Use sign_in_get after sign_ins_list to see the complete record of one sign-in.
Inputs
sign_in_idstringrequired- ID of the sign-in event, from the id property of sign_ins_list.
microsoftentraid_sign_ins_listList interactive and non-interactive user sign-in events from the Microsoft Entra sign-in logs, newest first.Read-onlyList Sign-in Logs
List interactive and non-interactive user sign-in events from the Microsoft Entra sign-in logs, newest first. Returns signIn objects (id, createdDateTime, userPrincipalName, appDisplayName, ipAddress, status, conditionalAccessStatus, riskLevelDuringSignIn, location). Use sign_ins_list to investigate sign-in activity; filter by userPrincipalName, appId or createdDateTime. Use directory_audits_list for configuration changes. Needs Entra ID P1 or P2 and the AuditLog.Read.All scope.
Inputs
$filterstring- OData $filter expression to narrow sign-in events. Example: createdDateTime ge 2026-10-01T00:00:00Z and userPrincipalName eq 'ada.lovelace@contoso.com'. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual.
$orderbystring- OData $orderby expression to sort results. Example: createdDateTime desc. Sorting combined with a filter may need advanced query support.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 1000). When more results exist the response includes @odata.nextLink.
microsoftentraid_subscribed_skus_listList the license SKUs the tenant has purchased, with consumed and available units.Read-onlyList Subscribed SKUs
List the license SKUs the tenant has purchased, with consumed and available units. Returns subscribedSku objects (id, skuId, skuPartNumber, consumedUnits, prepaidUnits, servicePlans). Use subscribed_skus_list to find skuId values for user_assign_license and to track license consumption.
Inputs
This tool takes no inputs.
microsoftentraid_user_app_role_assignments_listList the enterprise applications and app roles that are assigned to a user.Read-onlyList User App Role Assignments
List the enterprise applications and app roles that are assigned to a user. Returns appRoleAssignment objects (id, appRoleId, resourceId, resourceDisplayName, createdDateTime). Use user_app_role_assignments_list to audit which applications a user can access. Use service_principal_app_role_assigned_to_list for the reverse view.
Inputs
user_idstringrequired- Object ID (GUID) or user principal name (UPN) of the user.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_user_authentication_methods_listList the authentication methods registered for a user, such as password, Authenticator app, FIDO2 key or phone.Read-onlyList User Authentication Methods
List the authentication methods registered for a user, such as password, Authenticator app, FIDO2 key or phone. Returns authenticationMethod objects with their @odata.type and id; secret values are never returned. Use user_authentication_methods_list to audit MFA registration. Needs the UserAuthenticationMethod.Read.All scope.
Inputs
user_idstringrequired- Object ID (GUID) or user principal name (UPN) of the user.
microsoftentraid_user_direct_reports_listList the users and contacts who report to a user.Read-onlyList User Direct Reports
List the users and contacts who report to a user. Returns directory objects (id, displayName, userPrincipalName, mail) for each direct report. Use user_direct_reports_list to walk down the reporting chain. Use user_manager_get to walk up.
Inputs
user_idstringrequired- Object ID (GUID) or user principal name (UPN) of the user.
$countboolean- Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter.
$selectstring- Comma-separated list of user properties to return. Example: id,displayName,userPrincipalName,mail. Graph returns only a default subset of properties unless you list the ones you need here.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_user_getGet one user from the Microsoft Entra tenant by object ID or user principal name.Read-onlyGet User
Get one user from the Microsoft Entra tenant by object ID or user principal name. Returns the user's profile properties, and any extra properties requested with $select such as signInActivity, accountEnabled or assignedLicenses. Use user_get for a known user. Use users_list to find the user first. Use user_manager_get for the user's manager.
Inputs
user_idstringrequired- Object ID (GUID) or user principal name (UPN) of the user.
$selectstring- Comma-separated list of user properties to return. Example: id,displayName,userPrincipalName,mail,accountEnabled,jobTitle,department,signInActivity. Graph returns only a default subset of properties unless you list the ones you need here.
microsoftentraid_user_license_details_listList the licenses assigned to a user.Read-onlyList User License Details
List the licenses assigned to a user. Returns licenseDetails objects (id, skuId, skuPartNumber, servicePlans). Use user_license_details_list to see a user's licenses. Use subscribed_skus_list for tenant-wide license counts. Use user_assign_license to change licenses.
Inputs
user_idstringrequired- Object ID (GUID) or user principal name (UPN) of the user.
microsoftentraid_user_manager_getGet the manager of a user.Read-onlyGet User Manager
Get the manager of a user. Returns the manager's directory object (id, displayName, userPrincipalName, mail), or a 404 error when no manager is set. Use user_manager_get to walk up the reporting chain. Use user_direct_reports_list to walk down.
Inputs
user_idstringrequired- Object ID (GUID) or user principal name (UPN) of the user.
$selectstring- Comma-separated list of user properties to return. Example: id,displayName,userPrincipalName,mail. Graph returns only a default subset of properties unless you list the ones you need here.
microsoftentraid_user_member_of_listList the groups, directory roles and administrative units a user is a direct member of.Read-onlyList User Group and Role Memberships
List the groups, directory roles and administrative units a user is a direct member of. Returns directory objects (groups, directoryRoles, administrativeUnits) with their @odata.type, id and displayName. Use user_member_of_list to see a user's direct memberships. Use user_transitive_member_of_list to include memberships inherited through nested groups.
Inputs
user_idstringrequired- Object ID (GUID) or user principal name (UPN) of the user.
$countboolean- Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter.
$selectstring- Comma-separated list of directory object properties to return. Example: id,displayName. Graph returns only a default subset of properties unless you list the ones you need here.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_user_oauth2_permission_grants_listList the delegated permission grants (OAuth2 consents) a user has given to applications.Read-onlyList User OAuth2 Permission Grants
List the delegated permission grants (OAuth2 consents) a user has given to applications. Returns oAuth2PermissionGrant objects (id, clientId, consentType, resourceId, scope). Use user_oauth2_permission_grants_list to see what apps a user consented to. Use oauth2_permission_grants_list to query grants tenant-wide.
Inputs
user_idstringrequired- Object ID (GUID) or user principal name (UPN) of the user.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_user_owned_devices_listList the devices a user owns.Read-onlyList User Owned Devices
List the devices a user owns. Returns device objects (id, displayName, operatingSystem, trustType, isCompliant). Use user_owned_devices_list for devices a user owns. Use user_registered_devices_list for devices registered to the user.
Inputs
user_idstringrequired- Object ID (GUID) or user principal name (UPN) of the user.
$countboolean- Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter.
$selectstring- Comma-separated list of device properties to return. Example: id,displayName,operatingSystem,trustType,isCompliant. Graph returns only a default subset of properties unless you list the ones you need here.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_user_registered_devices_listList the devices registered to a user.Read-onlyList User Registered Devices
List the devices registered to a user. Returns device objects (id, displayName, operatingSystem, trustType, isCompliant). Use user_registered_devices_list for devices registered to the user. Use user_owned_devices_list for devices the user owns.
Inputs
user_idstringrequired- Object ID (GUID) or user principal name (UPN) of the user.
$countboolean- Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter.
$selectstring- Comma-separated list of device properties to return. Example: id,displayName,operatingSystem,trustType,isCompliant. Graph returns only a default subset of properties unless you list the ones you need here.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_user_transitive_member_of_listList every group, directory role and administrative unit a user belongs to, including through nested groups.Read-onlyList User Transitive Memberships
List every group, directory role and administrative unit a user belongs to, including through nested groups. Returns directory objects (groups, directoryRoles, administrativeUnits) with their @odata.type, id and displayName. Use user_transitive_member_of_list for effective access. Use user_member_of_list for direct memberships only.
Inputs
user_idstringrequired- Object ID (GUID) or user principal name (UPN) of the user.
$countboolean- Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter.
$selectstring- Comma-separated list of directory object properties to return. Example: id,displayName. Graph returns only a default subset of properties unless you list the ones you need here.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_users_listList users in the Microsoft Entra tenant, optionally filtered, searched, sorted or limited to selected properties.Read-onlyList Users
List users in the Microsoft Entra tenant, optionally filtered, searched, sorted or limited to selected properties. Returns user objects (id, displayName, givenName, surname, mail, userPrincipalName and jobTitle by default) plus @odata.nextLink when more pages exist. Use users_list to browse or search the directory. Use user_get when you already know the user's ID or user principal name.
Inputs
$countboolean- Set to true to include the total number of matching objects as @odata.count in the response. Required when a $filter or $orderby uses advanced query operators such as ne, not, endsWith or a $count-based filter.
$expandstring- Related objects to expand inline in each result. Example: manager.
$filterstring- OData $filter expression to narrow users. Example: accountEnabled eq true and department eq 'Sales'. Properties other than a few basics need advanced query support, which this tool enables by sending ConsistencyLevel: eventual.
$orderbystring- OData $orderby expression to sort results. Example: displayName. Sorting combined with a filter may need advanced query support.
$searchstring- Free-text search over users, written as "property:term" with the double quotes included. Example: "displayName:Ada". Requires advanced query support, which this tool enables by sending ConsistencyLevel: eventual.
$selectstring- Comma-separated list of user properties to return. Example: id,displayName,userPrincipalName,mail,accountEnabled,jobTitle,department. Graph returns only a default subset of properties unless you list the ones you need here.
$skiptokenstring- Opaque paging token. To fetch the next page, copy the value of the $skiptoken query parameter from the @odata.nextLink URL of the previous response.
$topinteger- Maximum number of results per page (1 to 999). When more results exist the response includes @odata.nextLink.
microsoftentraid_application_add_passwordCreate a new client secret (password credential) for an application registration.WriteAdd Application Client Secret
Create a new client secret (password credential) for an application registration. Returns the passwordCredential including keyId and the secretText value, which is shown only once. Use application_add_password to rotate or issue a client secret. Use application_remove_password to delete one by keyId.
Inputs
application_idstringrequired- Object ID (GUID) of the application registration. This is the 'id' property, not the appId (client ID).
display_namestring- Friendly name for the secret.
end_date_timestring- Expiry of the secret as an ISO 8601 UTC timestamp. Graph caps the lifetime at 2 years; leave empty to use the tenant default lifetime.
microsoftentraid_application_createCreate a new application registration in the Microsoft Entra tenant.WriteCreate Application
Create a new application registration in the Microsoft Entra tenant. Returns the created application object including its id (object ID) and appId (client ID). Use application_create to register an app. Use service_principal_create afterwards to instantiate it in the tenant. Use application_add_password to create a client secret.
Inputs
display_namestringrequired- Display name of the application.
descriptionstring- Free-text description of the application.
identifier_urisarray- Application ID URIs that identify the app as a resource, for example api://<appId>.
notesstring- Notes relevant to the management of the application.
sign_in_audiencestring- Which accounts can sign in to the application: AzureADMyOrg (this tenant only), AzureADMultipleOrgs (any organizational directory), AzureADandPersonalMicrosoftAccount, or PersonalMicrosoftAccount.one of
AzureADMyOrgAzureADMultipleOrgsAzureADandPersonalMicrosoftAccountPersonalMicrosoftAccount web_redirect_urisarray- Redirect URIs for a web application. Each must be an absolute https URL (http only for localhost).
microsoftentraid_application_federated_credential_createCreate a federated identity credential so an external identity provider can authenticate as the application without a secret.WriteCreate Application Federated Credential
Create a federated identity credential so an external identity provider can authenticate as the application without a secret. Returns the created federatedIdentityCredential including its id. Use application_federated_credential_create for workload identity federation. Use application_federated_credentials_list to review existing ones.
Inputs
application_idstringrequired- Object ID (GUID) of the application registration. This is the 'id' property, not the appId (client ID).
audiencesarrayrequired- Audiences that can appear in the external token. Use ["api://AzureADTokenExchange"] for Entra ID.
issuerstringrequired- URL of the external identity provider issuer. It must match the iss claim of the external token.
namestringrequired- Unique name of the credential within the application (3-120 characters, URL-friendly).
subjectstringrequired- Identifier of the external workload; must match the sub claim of the external token.
descriptionstring- Description of the credential.
microsoftentraid_application_owner_addAdd a user or service principal as an owner of an application registration.WriteAdd Application Owner
Add a user or service principal as an owner of an application registration. Returns an empty body on success (HTTP 204). Use application_owner_add to grant management rights on an app registration. Use application_owners_list to review owners.
Inputs
application_idstringrequired- Object ID (GUID) of the application registration. This is the 'id' property, not the appId (client ID).
owner_idstringrequired- Object ID (GUID) of the user or service principal to add as owner.
microsoftentraid_application_remove_passwordDelete a client secret from an application registration by its keyId.WriteRemove Application Client Secret
Delete a client secret from an application registration by its keyId. Returns an empty body on success (HTTP 204). Use application_remove_password to retire a leaked or expired secret. Read the keyId from application_get.
Inputs
application_idstringrequired- Object ID (GUID) of the application registration. This is the 'id' property, not the appId (client ID).
key_idstringrequired- keyId (GUID) of the password credential to remove, as listed in passwordCredentials on the application.
microsoftentraid_application_updateUpdate properties of an application registration; only the fields you provide change.WriteUpdate Application
Update properties of an application registration; only the fields you provide change. Returns an empty body on success (HTTP 204). Use application_update to rename an app or change its redirect URIs or sign-in audience. Use application_create to register a new app.
Inputs
application_idstringrequired- Object ID (GUID) of the application registration. This is the 'id' property, not the appId (client ID).
descriptionstring- New description.
display_namestring- New display name.
identifier_urisarray- Replacement list of application ID URIs. This replaces the whole list.
notesstring- New notes.
sign_in_audiencestring- New sign-in audience.one of
AzureADMyOrgAzureADMultipleOrgsAzureADandPersonalMicrosoftAccountPersonalMicrosoftAccount web_redirect_urisarray- Replacement list of redirect URIs for a web application. This replaces the whole list.
microsoftentraid_directory_role_member_addAdd a user or service principal to an activated directory role.WriteAdd Directory Role Member
Add a user or service principal to an activated directory role. Returns an empty body on success (HTTP 204). Use directory_role_member_add to grant a built-in admin role. Use role_assignment_create for scoped assignments. Needs the RoleManagement.ReadWrite.Directory scope.
Inputs
directory_role_idstringrequired- Object ID (GUID) of the activated directory role, from directory_roles_list.
member_idstringrequired- Object ID (GUID) of the user or service principal to add.
microsoftentraid_group_createCreate a security group or a Microsoft 365 group in the Microsoft Entra tenant.WriteCreate Group
Create a security group or a Microsoft 365 group in the Microsoft Entra tenant. Returns the created group object including its new id. Use group_create to add a group. Use group_update to change an existing group. Use group_owner_add to assign owners afterwards.
Inputs
display_namestringrequired- Name displayed in the address book for the group.
mail_enabledbooleanrequired- Set true for a Microsoft 365 group or mail-enabled group, false for a security-only group.
mail_nicknamestringrequired- Mail alias for the group, unique in the organization. Required by Graph even for groups with mail disabled.
security_enabledbooleanrequired- Set true for a security group that can be used to control access to resources.
descriptionstring- Description of the group.
group_typesarray- Group type flags. Use ["Unified"] for a Microsoft 365 group, ["DynamicMembership"] for dynamic membership, or leave empty for a plain security group.
member_idsarray- Object IDs (GUIDs) of users to add as members when the group is created (up to 20).
membership_rulestring- Dynamic membership rule. Only used when group_types contains DynamicMembership.
membership_rule_processing_statestring- Whether dynamic membership processing is On or Paused. Only used with a membership rule.one of
OnPaused owner_idsarray- Object IDs (GUIDs) of users to set as owners when the group is created.
visibilitystring- Group join policy and visibility.one of
PrivatePublicHiddenMembership
microsoftentraid_group_owner_addAdd a user or service principal as an owner of a group.WriteAdd Group Owner
Add a user or service principal as an owner of a group. Returns an empty body on success (HTTP 204). Use group_owner_add to grant group management rights. Use group_owner_remove to revoke them.
Inputs
group_idstringrequired- Object ID (GUID) of the group.
owner_idstringrequired- Object ID (GUID) of the user or service principal to add as owner.
microsoftentraid_group_updateUpdate properties of a group; only the fields you provide change.WriteUpdate Group
Update properties of a group; only the fields you provide change. Returns an empty body on success (HTTP 204). Use group_update to rename a group or change its description or visibility. Use group_create to add a new group.
Inputs
group_idstringrequired- Object ID (GUID) of the group.
descriptionstring- New description for the group.
display_namestring- New display name for the group.
mail_nicknamestring- New mail alias for the group.
membership_rulestring- New dynamic membership rule. Only valid on dynamic groups.
membership_rule_processing_statestring- Turn dynamic membership processing On or Paused.one of
OnPaused visibilitystring- New visibility of a Microsoft 365 group.one of
PrivatePublicHiddenMembership
microsoftentraid_oauth2_permission_grant_createGrant delegated permissions (admin consent or consent for one user) from a client application to a resource application.WriteCreate OAuth2 Permission Grant
Grant delegated permissions (admin consent or consent for one user) from a client application to a resource application. Returns the created oAuth2PermissionGrant including its id. Use oauth2_permission_grant_create to grant admin consent without the portal. Use oauth2_permission_grants_list to check existing grants first.
Inputs
client_idstringrequired- Object ID (GUID) of the client service principal that is granted access (not its appId).
consent_typestringrequired- AllPrincipals grants consent on behalf of the whole organization. Principal grants it for a single user, which requires principal_id.one of
AllPrincipalsPrincipal resource_idstringrequired- Object ID (GUID) of the resource service principal being accessed, for example the Microsoft Graph service principal in your tenant.
scopestringrequired- Space-separated list of delegated permission scopes to grant. Example: User.Read Group.Read.All.
principal_idstring- Object ID (GUID) of the user who consents. Required when consent_type is Principal, omit otherwise.
microsoftentraid_role_assignment_createAssign a Microsoft Entra directory role to a user, group or service principal, optionally scoped to an administrative unit or app.WriteCreate Role Assignment
Assign a Microsoft Entra directory role to a user, group or service principal, optionally scoped to an administrative unit or app. Returns the created unifiedRoleAssignment including its id. Use role_assignment_create to grant an admin role with optional scoping. Use role_definitions_list to find the role ID. Needs the RoleManagement.ReadWrite.Directory scope.
Inputs
directory_scope_idstringrequired- Scope of the assignment. Use / for the whole tenant, /administrativeUnits/<id> for an administrative unit, or /<appObjectId> for an app-scoped role. Leave empty for tenant-wide.
principal_idstringrequired- Object ID (GUID) of the user, group or service principal that receives the role.
role_definition_idstringrequired- ID (GUID) of the role definition to assign.
microsoftentraid_service_principal_app_role_assigned_to_createAssign a user, group or service principal to an app role on an enterprise application.WriteAssign App Role to Principal
Assign a user, group or service principal to an app role on an enterprise application. Returns the created appRoleAssignment including its id. Use service_principal_app_role_assigned_to_create to grant app access. Use the default access role ID 00000000-0000-0000-0000-000000000000 when the app defines no roles.
Inputs
app_role_idstringrequired- ID (GUID) of the app role to assign, from the appRoles list of the service principal. Use 00000000-0000-0000-0000-000000000000 for the default access role.
principal_idstringrequired- Object ID (GUID) of the user, group or service principal receiving the assignment.
resource_idstringrequired- Object ID (GUID) of the service principal that exposes the app role; normally the same value as service_principal_id.
service_principal_idstringrequired- Object ID (GUID) of the service principal.
microsoftentraid_service_principal_createCreate a service principal, which instantiates an application registration as an enterprise application in the tenant.WriteCreate Service Principal
Create a service principal, which instantiates an application registration as an enterprise application in the tenant. Returns the created service principal including its id. Use service_principal_create after application_create, or to add a multi-tenant app from another tenant. Use service_principal_update to change an existing one.
Inputs
app_idstringrequired- appId (client ID, a GUID) of the application to instantiate.
account_enabledboolean- Whether the service principal account is enabled. Defaults to true on the server when omitted.
app_role_assignment_requiredboolean- When true, users and groups must be assigned an app role before they can sign in to the app.
tagsarray- Custom tags. Use ["WindowsAzureActiveDirectoryIntegratedApp"] to show the app under Enterprise applications in the portal.
microsoftentraid_service_principal_updateUpdate properties of a service principal; only the fields you provide change.WriteUpdate Service Principal
Update properties of a service principal; only the fields you provide change. Returns an empty body on success (HTTP 204). Use service_principal_update to disable an enterprise app or require assignment. Use service_principal_create to add a new one.
Inputs
service_principal_idstringrequired- Object ID (GUID) of the service principal.
account_enabledboolean- Set false to block the application from signing in.
app_role_assignment_requiredboolean- When true, users and groups must be assigned an app role before they can sign in.
display_namestring- New display name.
notesstring- New notes.
tagsarray- Replacement list of tags. This replaces the whole list.
microsoftentraid_user_assign_licenseAdd or remove licenses for a user in one call.WriteAssign User License
Add or remove licenses for a user in one call. Returns the updated user object including assignedLicenses. Use user_assign_license to grant or revoke SKUs. Use subscribed_skus_list to find skuId values. The user needs a usageLocation first.
Inputs
user_idstringrequired- Object ID (GUID) or user principal name (UPN) of the user.
add_license_sku_idsarray- SKU IDs (GUIDs) of the licenses to add. Pass an empty array to add none. Find IDs with subscribed_skus_list.
remove_license_sku_idsarray- SKU IDs (GUIDs) of the licenses to remove. Pass an empty array to remove none.
microsoftentraid_user_createCreate a new cloud user in the Microsoft Entra tenant.WriteCreate User
Create a new cloud user in the Microsoft Entra tenant. Returns the created user object including its new id. Use user_create to add a member account. Use user_update to change an existing user. Use user_assign_license afterwards to license the user.
Inputs
account_enabledbooleanrequired- Whether the account is enabled. Set true for a user who can sign in immediately.
display_namestringrequired- Name displayed in the address book for the user, usually first and last name.
mail_nicknamestringrequired- Mail alias for the user. It is the part of the email address before the @ sign.
passwordstringrequired- Initial password for the user. It must satisfy the tenant's password complexity policy.
user_principal_namestringrequired- User principal name (UPN) in the form alias@domain. The domain must be a verified domain of the tenant.
citystring- City in which the user is located.
company_namestring- Name of the company the user is associated with.
countrystring- Country or region in which the user is located.
departmentstring- Name of the department in which the user works.
force_change_password_next_sign_inboolean- Set true to require the user to change the password at the next sign-in. Leave empty to use the tenant default behavior.
given_namestring- First name of the user.
job_titlestring- Job title of the user.
mobile_phonestring- Primary cellular telephone number of the user.
office_locationstring- Office location in the user's place of business.
surnamestring- Last name of the user.
usage_locationstring- Two-letter ISO 3166 country code. Required before a license can be assigned to the user.
microsoftentraid_user_revoke_sign_in_sessionsInvalidate all refresh tokens and session cookies for a user, forcing a new sign-in.WriteRevoke User Sign-in Sessions
Invalidate all refresh tokens and session cookies for a user, forcing a new sign-in. Returns {"value": true} on success. Use user_revoke_sign_in_sessions after a suspected account compromise or offboarding. Use user_update with account_enabled false to block sign-in entirely.
Inputs
user_idstringrequired- Object ID (GUID) or user principal name (UPN) of the user.
microsoftentraid_user_set_managerAssign a manager to a user, replacing any existing manager.WriteSet User Manager
Assign a manager to a user, replacing any existing manager. Returns an empty body on success (HTTP 204). Use user_set_manager to change the reporting line. Use user_manager_get to read the current manager.
- Idempotent
Inputs
manager_idstringrequired- Object ID (GUID) of the user who becomes the manager.
user_idstringrequired- Object ID (GUID) or user principal name (UPN) of the user.
microsoftentraid_user_updateUpdate properties of a user in the Microsoft Entra tenant; only the fields you provide change.WriteUpdate User
Update properties of a user in the Microsoft Entra tenant; only the fields you provide change. Returns an empty body on success (HTTP 204). Use user_update to disable an account or edit profile fields. Use user_create to add a new user. Use user_set_manager to change the manager.
Inputs
user_idstringrequired- Object ID (GUID) or user principal name (UPN) of the user to update.
account_enabledboolean- Set false to block the user from signing in, true to re-enable the account.
citystring- New city.
company_namestring- New company name.
countrystring- New country or region.
departmentstring- New department name.
display_namestring- New display name for the user.
given_namestring- New first name.
job_titlestring- New job title.
mobile_phonestring- New mobile phone number.
office_locationstring- New office location.
surnamestring- New last name.
usage_locationstring- Two-letter ISO 3166 country code, required before assigning a license.
microsoftentraid_group_owner_removeRemove an owner from a group.DestructiveRemove Group Owner
Remove an owner from a group. Returns an empty body on success (HTTP 204). Use group_owner_remove to revoke group management rights. Use group_owners_list to find owner IDs.
- Idempotent
Inputs
group_idstringrequired- Object ID (GUID) of the group.
owner_idstringrequired- Object ID (GUID) of the owner to remove.
No tools match.
