--- canonical_url: "https://docs.composio.dev/toolkits/microsoft_entra_id" markdown_url: "https://docs.composio.dev/toolkits/microsoft_entra_id.md" product: "platform" version: null last_updated: null --- # Microsoft Entra ID Manage Microsoft Entra ID directory resources through Microsoft Graph v1.0, including users, groups, applications, roles, devices, policies, and audit data. - **Category:** security & identity tools - **Auth:** OAUTH2, S2S_OAUTH2 - **Composio-managed OAuth available?** No - **Tools:** 73 - **Triggers:** 0 - **Slug:** `MICROSOFT_ENTRA_ID` - **Version:** 00000000_00 ## Tools ### Add Administrative Unit Member **Slug:** `MICROSOFT_ENTRA_ID_ADD_ADMINISTRATIVE_UNIT_MEMBER` Add one existing user, group, or device to an assigned-membership Microsoft Entra administrative unit, bringing that object into the unit's delegated administration scope. Dynamic administrative units are managed only by their membership rule and reject manual changes. In a restricted-management unit, a group must be a nonunified, security-enabled, non-mail-enabled group that is not synchronized from on-premises. For delegated access, Privileged Role Administrator is the least-privileged supported role. App-only callers that need directory reads also require a supported directory-reader role or an application permission such as Directory.Read.All. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `member_id` | string | Yes | Directory object ID of the existing user, group, or device to add. Provide an object ID, not a URL. | | `administrative_unit_id` | string | Yes | Directory object ID of the assigned-membership administrative unit. Dynamic administrative units do not support manual membership changes. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Add Application Owner **Slug:** `MICROSOFT_ENTRA_ID_ADD_APPLICATION_OWNER` Add an existing user or service principal as an owner of an application registration, granting authority to administer it. For delegated access, the signed-in user must also hold Application Administrator, Cloud Application Administrator, Hybrid Identity Administrator, or a supported custom Microsoft Entra role. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `owner_id` | string | Yes | Directory object ID of the existing user or service principal to make an owner. Provide an ID, not a URL. | | `application_object_id` | string | Yes | Application directory Object ID, not the Application (client) ID shown as appId. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Add Directory Role Member **Slug:** `MICROSOFT_ENTRA_ID_ADD_DIRECTORY_ROLE_MEMBER` Assign a principal to an activated Microsoft Entra directory role, granting that role's tenant-wide administrative access. This is an access-elevation operation. For delegated access, the signed-in user must be a Privileged Role Administrator (the least-privileged supported role) or hold a custom role that grants the permissions required for this operation. Prefer unified role assignments when scoped access is required. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `role_id` | string | Yes | Object ID of the activated directory role that will grant tenant-wide administrative access. | | `member_id` | string | Yes | Directory object ID of the principal that will receive the role and its tenant-wide administrative access. Provide an ID, not a URL. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Add Group Member **Slug:** `MICROSOFT_ENTRA_ID_ADD_GROUP_MEMBER` Add an existing directory object as a direct member of an assigned-membership Microsoft Entra group. Dynamic group membership cannot be changed manually. Role-assignable groups additionally require RoleManagement.ReadWrite.Directory and an eligible Entra role. Adding a device, service principal, or organizational contact can require an additional permission for that member type. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `group_id` | string | Yes | Directory object ID of the assigned-membership group. Dynamic groups do not support manual membership changes. | | `member_id` | string | Yes | Directory object ID of the existing user, group, device, service principal, or organizational contact to add. Provide an ID, not a URL. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Add Group Owner **Slug:** `MICROSOFT_ENTRA_ID_ADD_GROUP_OWNER` Add an existing user or service principal as an owner of a Microsoft 365 or security group, granting authority to modify the group. Delegated callers must also be a group owner or hold a supported Microsoft Entra role; some roles can add only user owners or are limited to particular group types. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `group_id` | string | Yes | Directory object ID of the Microsoft 365 or security group. | | `owner_id` | string | Yes | Directory object ID of the existing user or service principal to make an owner. Provide an ID, not a URL. | | `owner_type` | string ("user" | "service_principal") | Yes | Directory object type identified by owner_id. Choose user or service_principal; the action constructs the corresponding fixed Microsoft Graph reference URL. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Add Service Principal Owner **Slug:** `MICROSOFT_ENTRA_ID_ADD_SERVICE_PRINCIPAL_OWNER` Add an existing user or service principal as an owner of an enterprise application/service principal, granting authority to administer it. For delegated access, the signed-in user must also hold Application Administrator, Cloud Application Administrator, Hybrid Identity Administrator, or a supported custom Microsoft Entra role. With app-only Application.ReadWrite.OwnedBy access, the calling application must already own the target service principal. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `owner_id` | string | Yes | Directory object ID of the existing user or service principal to make an owner. Provide an ID, not a URL. | | `service_principal_id` | string | Yes | Service-principal directory Object ID, not the Application (client) ID shown as appId. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Assign User Licenses **Slug:** `MICROSOFT_ENTRA_ID_ASSIGN_USER_LICENSES` Add and remove Microsoft product licenses for one Entra user in a single request. Both add and remove lists are required and either can be empty. Removing a license revokes the user's entitlement to that product's services and can immediately prevent access; data retention depends on the affected Microsoft product. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `add_licenses` | array | Yes | Licenses to add, including any service plans to disable. This array is required; pass an empty array when adding none. | | `user_id_or_upn` | string | Yes | User object ID or full user principal name whose licenses to change. | | `remove_license_ids` | array | Yes | Product SKU IDs to remove. This array is required; pass an empty array when removing none. Removing a SKU revokes the user's entitlement to its services and can immediately prevent access; service data retention depends on the affected Microsoft product. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Administrative Unit **Slug:** `MICROSOFT_ENTRA_ID_CREATE_ADMINISTRATIVE_UNIT` Create an assigned or dynamic Microsoft Entra administrative unit for scoping directory administration. Restricted member management can be set only during creation and is immutable afterward. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `visibility` | string | No | Set to HiddenMembership to hide membership from nonmembers; omit for the default public visibility. | | `description` | string | No | Description of the new administrative unit. | | `display_name` | string | Yes | Display name for the new administrative unit. | | `membership_rule` | string | No | Dynamic membership rule. Required when membership_type is dynamic and forbidden for assigned membership. | | `membership_type` | string ("dynamic" | "assigned") | No | Membership mode. Use dynamic with a rule and processing state; use assigned or omit this field for manually assigned membership. | | `is_member_management_restricted` | boolean | No | Whether members are sensitive and can be managed only by appropriately scoped administrators. This setting is immutable after creation. | | `membership_rule_processing_state` | string ("On" | "Paused") | No | Whether the dynamic rule is actively processed. Required when membership_type is dynamic and forbidden for assigned membership. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Application **Slug:** `MICROSOFT_ENTRA_ID_CREATE_APPLICATION` Create a Microsoft Entra application registration with allowlisted platform, role, and API permission settings, without creating or accepting password or key credentials. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `api` | object | No | Delegated permission scopes, preauthorized clients, and access-token settings exposed by this resource API. | | `spa` | object | No | Single-page application redirect settings. | | `web` | object | No | Web application redirect and implicit-flow settings. | | `app_roles` | array | No | Application roles exposed by this registration. | | `display_name` | string | Yes | Display name for the new application registration. | | `public_client` | object | No | Desktop and mobile public-client redirect settings. | | `identifier_uris` | array | No | Application ID URIs that identify this application as a resource API. | | `sign_in_audience` | string ("AzureADMyOrg" | "AzureADMultipleOrgs" | "AzureADandPersonalMicrosoftAccount" | "PersonalMicrosoftAccount") | No | Microsoft account types allowed to sign in to the application. | | `required_resource_access` | array | No | Resource permissions requested by the application. This declares requirements but does not grant tenant consent. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create App Role Assignment **Slug:** `MICROSOFT_ENTRA_ID_CREATE_APP_ROLE_ASSIGNMENT` Assign an application role to a user, group, or client service principal. This grants the principal the application access represented by that role; for client service principals, the grant is an application permission. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `app_role_id` | string | Yes | ID of the application role to grant from the resource service principal. | | `principal_id` | string | Yes | Object ID of the user, group, or client service principal that receives the application access. | | `resource_service_principal_id` | string | Yes | Object ID of the resource service principal that defines the app role. This same ID is sent as resourceId in the request body. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Group **Slug:** `MICROSOFT_ENTRA_ID_CREATE_GROUP` Create a Microsoft 365, assigned security, or dynamic-membership group. Optionally bind up to 20 total initial owners and members by directory object ID; dynamic groups cannot have initial members. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `owner_ids` | array | No | Existing user or service-principal object IDs to bind as initial owners. Only IDs are accepted; this action constructs the Microsoft Graph URLs. | | `member_ids` | array | No | Existing directory object IDs to bind as initial members. Omit for a dynamic-membership group. Only IDs are accepted; this action constructs the Microsoft Graph URLs. | | `description` | string | No | Description of the new group. | | `group_types` | array | No | Group type markers. Include Unified for a Microsoft 365 group and DynamicMembership for a dynamic group. Omit for an assigned security group. | | `display_name` | string | Yes | Name displayed for the new group (1-256 characters). | | `mail_enabled` | boolean | Yes | Whether the group is mail-enabled. Must be true for a Microsoft 365 group and false for a security group. | | `mail_nickname` | string | Yes | Mail alias for the new group (1-64 characters). | | `membership_rule` | string | No | Rule that determines dynamic membership. Required when group_types contains DynamicMembership; otherwise omit it. | | `security_enabled` | boolean | Yes | Whether the group is security-enabled. Must be true for a security group. | | `membership_rule_processing_state` | string ("On" | "Paused") | No | Whether Microsoft Entra actively processes the dynamic membership rule. Required when group_types contains DynamicMembership; otherwise omit it. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Role Assignment **Slug:** `MICROSOFT_ENTRA_ID_CREATE_ROLE_ASSIGNMENT` Grant a user, role-assignable group, or service principal a Microsoft Entra directory role, conferring the role's administrative access at the explicit tenant, administrative-unit, resource-application, or app-specific scope. This is an access-elevation operation. For delegated access, the signed-in user must be a Privileged Role Administrator (the least-privileged supported role) or hold a custom role that grants the required permissions. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `app_scope_id` | string | No | Application-defined scope understood by the resource application. Provide exactly one of app_scope_id and directory_scope_id. | | `principal_id` | string | Yes | Object ID of the user, role-assignable group, or service principal that will receive the role's administrative access. | | `directory_scope_id` | string | No | Directory scope for the administrative access. Use '/' for tenant-wide access, '/administrativeUnits/{id}' for an administrative unit, or '/{application-object-id}' for a resource application. Provide exactly one of directory_scope_id and app_scope_id. | | `role_definition_id` | string | Yes | Service-wide role template ID or tenant-specific unified role definition ID to assign. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Service Principal **Slug:** `MICROSOFT_ENTRA_ID_CREATE_SERVICE_PRINCIPAL` Create an enterprise application (service principal) for an existing application ID without accepting or creating password or key credentials. Delegated callers also need a supported Microsoft Entra role. With app-only Application.ReadWrite.OwnedBy, the calling application must own the backing application. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `tags` | array | No | Custom non-secret strings used to categorize the service principal. | | `app_id` | string | Yes | Application (client) ID whose service principal should be created. | | `display_name` | string | No | Display name for the service principal. | | `account_enabled` | boolean | No | Whether the service principal can authenticate and users can sign in to it. | | `app_role_assignment_required` | boolean | No | Whether users, groups, or client service principals need an explicit app-role assignment before sign-in or token issuance. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create User **Slug:** `MICROSOFT_ENTRA_ID_CREATE_USER` Create a Microsoft Entra tenant user with the required sign-in profile and an initial password. This action only sets the password required during creation; it does not reset passwords or modify authentication methods. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `surname` | string | No | Surname for the new user. | | `job_title` | string | No | Job title for the new user. | | `department` | string | No | Department for the new user. | | `given_name` | string | No | Given name for the new user. | | `display_name` | string | Yes | Name displayed in the address book for the new user. | | `mail_nickname` | string | Yes | Mail alias for the new user. | | `account_enabled` | boolean | Yes | Whether the new user can sign in. | | `initial_password` | string | Yes | Initial password used only to create this user. Treat it as a secret and never log, store, or repeat it in output. | | `user_principal_name` | string | Yes | Internet-style sign-in name for the new user, using a domain verified in the tenant. | | `on_premises_immutable_id` | string | No | Immutable ID required when the user principal name uses a federated domain; otherwise omit it. | | `force_change_password_next_sign_in` | boolean | No | Whether the user must change the initial password at first sign-in. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Administrative Unit **Slug:** `MICROSOFT_ENTRA_ID_DELETE_ADMINISTRATIVE_UNIT` Delete a Microsoft Entra administrative unit and remove its administrative scope. This is irreversible from this toolkit because restoration is not supported here. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `administrative_unit_id` | string | Yes | Directory object ID of the administrative unit to delete. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Application **Slug:** `MICROSOFT_ENTRA_ID_DELETE_APPLICATION` Delete a Microsoft Entra application registration by its directory Object ID. This is irreversible from this toolkit because restoration is not supported here. Deleting the registration can break dependent user or workload sign-in and integrations that rely on its Application (client) ID, permissions, roles, or redirect configuration. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `application_object_id` | string | Yes | Directory Object ID of the application registration to delete, not its Application (client) ID shown as appId. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Group **Slug:** `MICROSOFT_ENTRA_ID_DELETE_GROUP` Delete a Microsoft Entra group and its associated group resources. This is irreversible from this toolkit: Microsoft 365 and security groups can be restored for 30 days only through recovery outside this toolkit, while distribution groups are permanently deleted immediately. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `group_id` | string | Yes | Directory object ID of the group to delete. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Service Principal **Slug:** `MICROSOFT_ENTRA_ID_DELETE_SERVICE_PRINCIPAL` Delete a Microsoft Entra enterprise application/service principal. This is irreversible from this toolkit because restoration is not supported here. Deletion removes the enterprise application's tenant identity and can break sign-in, resource access, and app-role assignments that depend on it. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `service_principal_id` | string | Yes | Directory Object ID of the service principal to delete, not its Application (client) ID shown as appId. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete User **Slug:** `MICROSOFT_ENTRA_ID_DELETE_USER` Delete a tenant user and remove the directory identity. This deletion is irreversible from this toolkit; restoration is outside this toolkit. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `user_id_or_upn` | string | Yes | User directory object ID or full user principal name to delete. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Disable User **Slug:** `MICROSOFT_ENTRA_ID_DISABLE_USER` Disable a Microsoft Entra user without deleting the directory object. This sets accountEnabled=false and blocks future sign-ins; already-issued access tokens or sessions can remain usable until they expire or are separately revoked. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `user_id_or_upn` | string | Yes | User object ID or full user principal name of the account to disable. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Administrative Unit **Slug:** `MICROSOFT_ENTRA_ID_GET_ADMINISTRATIVE_UNIT` Get one Microsoft Entra administrative unit by directory object ID. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `select` | array | No | Administrative-unit properties to return. Omit to use Microsoft Graph's default projection. | | `administrative_unit_id` | string | Yes | Directory object ID of the administrative unit. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Application **Slug:** `MICROSOFT_ENTRA_ID_GET_APPLICATION` Get one application registration by its directory Object ID, not its Application (client) ID, returning only credential-safe properties. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `safe_fields` | array | No | Credential-safe application properties to return. Only the listed values are accepted; credential properties cannot be selected. | | `application_object_id` | string | Yes | Application directory object ID (Object ID), not the Application (client) ID shown as appId. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Conditional Access Policy **Slug:** `MICROSOFT_ENTRA_ID_GET_CONDITIONAL_ACCESS_POLICY` Get one Microsoft Entra Conditional Access policy by object ID. This is a read-only paid-tier capability; delegated callers also need a supported Entra role such as Security Reader, Global Reader, or Conditional Access Administrator. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `select` | array | No | Conditional Access policy properties to return. Omit to use Microsoft Graph's default projection. | | `policy_id` | string | Yes | Object ID of the Microsoft Entra Conditional Access policy. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Device **Slug:** `MICROSOFT_ENTRA_ID_GET_DEVICE` Get one Microsoft Entra device by its directory Object ID, not its distinct Device Registration Service deviceId value. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `select` | array | No | Device properties to return. Use id for the directory object ID and deviceId for the distinct registration-service device identifier. | | `device_object_id` | string | Yes | Microsoft Entra directory object ID (Object ID) used as /devices/{id}; not the distinct Device Registration Service deviceId value. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Directory Audit **Slug:** `MICROSOFT_ENTRA_ID_GET_DIRECTORY_AUDIT` Get one Microsoft Entra directory audit event by its event ID. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `audit_id` | string | Yes | Unique ID of the Microsoft Entra directory audit event to retrieve. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Directory Role **Slug:** `MICROSOFT_ENTRA_ID_GET_DIRECTORY_ROLE` Get one Microsoft Entra directory role that is activated in the tenant by its activated role object ID. Inactive role definitions are not available. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `select` | array | No | Activated directory-role properties to return. | | `role_id` | string | Yes | Object ID of a directory role activated in the tenant, not a role definition ID or role template ID. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Domain **Slug:** `MICROSOFT_ENTRA_ID_GET_DOMAIN` Get one tenant domain by its fully qualified domain name. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `select` | array | No | Domain properties to return. | | `domain_name` | string | Yes | Fully qualified tenant domain name using ASCII DNS labels only, without a scheme, port, path, query, fragment, or trailing dot. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Group **Slug:** `MICROSOFT_ENTRA_ID_GET_GROUP` Get one tenant group by directory object ID. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `expand` | string | No | Supported OData group relationship expansion without the '$expand=' prefix. | | `select` | array | No | Group properties to return. | | `group_id` | string | Yes | Group directory object ID. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Organization **Slug:** `MICROSOFT_ENTRA_ID_GET_ORGANIZATION` Get the connected Microsoft Entra tenant's organization record by tenant organization ID. The keyed Graph route returns one organization entity. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `select` | array | No | Organization properties to return. Navigation properties, extensions, and arbitrary OData expressions are not accepted. | | `organization_id` | string | Yes | Microsoft Entra tenant organization ID in GUID format. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Role Assignment **Slug:** `MICROSOFT_ENTRA_ID_GET_ROLE_ASSIGNMENT` Get one unified Microsoft Entra directory role assignment by its assignment ID, including its principal, role definition, and directory or application scope identifiers. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `expand` | string | No | OData $expand expression without the '$expand=' prefix. For the directory provider, supported relationships include principal, roleDefinition, and directoryScope. | | `select` | array | No | Role-assignment properties to return through the OData $select option. | | `assignment_id` | string | Yes | Opaque identifier of the unified directory role assignment. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Service Principal **Slug:** `MICROSOFT_ENTRA_ID_GET_SERVICE_PRINCIPAL` Get one Microsoft Entra enterprise application/service principal by its directory Object ID, not its Application (client) ID, returning only credential-safe properties. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `safe_fields` | array | No | Credential-safe service principal properties to return. Only the listed values are accepted; credential and token-encryption properties cannot be selected. | | `service_principal_id` | string | Yes | Service principal directory Object ID, not the associated Application (client) ID exposed as appId. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Sign In **Slug:** `MICROSOFT_ENTRA_ID_GET_SIGN_IN` Get one retained Microsoft Entra sign-in event by event ID. Availability is limited by the tenant's sign-in data retention policy; downloading sign-in logs requires Microsoft Entra ID P1 or P2, and delegated callers need a supported Entra role such as Reports Reader or Security Reader. P2-only risk details can be hidden. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `sign_in_id` | string | Yes | Unique sign-in event ID, also shown as Request ID in the Microsoft Entra admin center. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Subscribed SKU **Slug:** `MICROSOFT_ENTRA_ID_GET_SUBSCRIBED_SKU` Get one commercial product subscription acquired by the Microsoft Entra tenant using its subscribed-SKU object ID. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `select` | array | No | Subscribed-SKU properties to return. | | `subscribed_sku_id` | string | Yes | Unique identifier of the tenant's subscribed-SKU object, distinct from the skuId product GUID. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get User **Slug:** `MICROSOFT_ENTRA_ID_GET_USER` Get one tenant user by directory object ID or user principal name. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `expand` | string | No | Supported OData relationship expansion. | | `select` | array | No | User properties to return. Sensitive properties can require additional Microsoft Graph grants; credential and authentication data are never included in this action's response. | | `user_id_or_upn` | string | Yes | User directory object ID or full user principal name. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get User Manager **Slug:** `MICROSOFT_ENTRA_ID_GET_USER_MANAGER` Get the directory object recorded as a user's manager. Returns not found when no manager is assigned. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `select` | array | No | Manager directory-object properties to return. | | `user_id_or_upn` | string | Yes | User directory object ID or full user principal name. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Administrative Unit Members **Slug:** `MICROSOFT_ENTRA_ID_LIST_ADMINISTRATIVE_UNIT_MEMBERS` List users, groups, and devices directly assigned to a Microsoft Entra administrative unit. Hidden membership requires the additional Member.Read.Hidden grant, so hidden members can otherwise be omitted. Properties other than id and type can be null when the connection lacks permission to read a member's concrete object type. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque cursor returned by this action. Omit it for the first page and pass it back unchanged to continue. | | `filter` | string | No | OData member filter without the '$filter=' prefix. This enables advanced query mode. | | `search` | string | No | Search expression over displayName or description. This enables advanced query mode. | | `select` | array | No | Member properties to return. Properties other than id and @odata.type can be null when the connection cannot read a member's concrete type. | | `page_size` | integer | No | Maximum administrative-unit members to return on this page. | | `include_count` | boolean | No | Return the first page's total matching member count using advanced query mode. | | `advanced_query` | boolean | No | Send ConsistencyLevel eventual and $count=true for an advanced OData query. Results can lag behind recent membership changes. | | `administrative_unit_id` | string | Yes | Directory object ID of the administrative unit whose direct members to list. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Administrative Units **Slug:** `MICROSOFT_ENTRA_ID_LIST_ADMINISTRATIVE_UNITS` List Microsoft Entra administrative units with optional OData filtering, search, field selection, relationship expansion, and cursor pagination. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque cursor returned by this action. Omit it for the first page and pass it back unchanged to continue. | | `expand` | string | No | Supported administrative-unit relationship expansion without the '$expand=' prefix. Cannot be combined with advanced query mode. | | `filter` | string | No | OData administrative-unit filter without the '$filter=' prefix. Set advanced_query when the expression requires advanced query support. | | `search` | string | No | Microsoft Graph administrative-unit search expression; automatically enables eventual consistency and a result count. | | `select` | array | No | Administrative-unit properties to return. | | `page_size` | integer | No | Maximum administrative units to return on this page. | | `include_count` | boolean | No | Return the first page's total matching administrative-unit count when Microsoft Graph supplies it. | | `advanced_query` | boolean | No | Enable ConsistencyLevel eventual and $count=true for an advanced administrative-unit filter. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Administrative Unit Scoped Role Members **Slug:** `MICROSOFT_ENTRA_ID_LIST_ADMINISTRATIVE_UNIT_SCOPED_ROLE_MEMBERS` List the legacy scoped-role memberships that grant users administrative access within one Microsoft Entra administrative unit. This action is read-only; create new scoped grants with unified role assignments instead. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque cursor returned by this action. Omit it for the first page and pass it back unchanged to continue. | | `filter` | string | No | OData scoped-role-membership filter without the '$filter=' prefix. | | `select` | array | No | Scoped-role-membership properties to return. | | `page_size` | integer | No | Maximum legacy scoped role memberships to return on this page. | | `administrative_unit_id` | string | Yes | Directory object ID of the Microsoft Entra administrative unit. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Application Owners **Slug:** `MICROSOFT_ENTRA_ID_LIST_APPLICATION_OWNERS` List the users and service principals that own an application registration. Properties other than id and type can be null when the connection lacks permission to read an owner's concrete object type. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque cursor returned by this action. Omit it for the first page and pass it back unchanged to continue. | | `filter` | string | No | OData owner filter without the '$filter=' prefix; this enables advanced query mode. | | `search` | string | No | Search expression over owner displayName or description; this enables advanced query mode. | | `select` | array | No | Directory-object properties to return. Properties other than id and @odata.type can be null when the connection cannot read an owner's concrete type. | | `order_by` | string | No | OData owner ordering expression without the '$orderby=' prefix; this enables advanced query mode. | | `page_size` | integer | No | Maximum application owners to return on this page (1-999). | | `include_count` | boolean | No | Return the first page's total matching owner count using advanced query mode. | | `advanced_query` | boolean | No | Send ConsistencyLevel eventual and $count=true for an advanced OData query. Results can lag behind recent ownership changes. | | `application_object_id` | string | Yes | Application directory object ID (Object ID), not the Application (client) ID shown as appId. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Applications **Slug:** `MICROSOFT_ENTRA_ID_LIST_APPLICATIONS` List Microsoft Entra application registrations with OData filtering, search, ordering, and cursor pagination. Selection and output schemas structurally exclude password and key credential collections. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque cursor returned by this action. Omit it for the first page and pass it back unchanged to continue. | | `filter` | string | No | OData application filter without the '$filter=' prefix; enable advanced_query for advanced operators. | | `search` | string | No | Microsoft Graph application search expression; automatically enables eventual consistency and a result count. | | `order_by` | string | No | OData application ordering expression without the '$orderby=' prefix. | | `page_size` | integer | No | Maximum applications to return on this page (1-999). | | `safe_fields` | array | No | Credential-safe application properties to return. The allowed values structurally exclude passwordCredentials and keyCredentials. | | `include_count` | boolean | No | Return the first page's total matching application count when Microsoft Graph supplies it. | | `advanced_query` | boolean | No | Enable ConsistencyLevel eventual and $count=true for an advanced filter or ordering combination. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List App Role Assignments **Slug:** `MICROSOFT_ENTRA_ID_LIST_APP_ROLE_ASSIGNMENTS` List users, groups, and client service principals granted application roles on a resource service principal, with OData filtering, field selection, and cursor pagination. Recently added or removed assignments can be delayed by Microsoft Entra replication. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque cursor returned by this action. Omit it for the first page and pass it back unchanged to continue. | | `filter` | string | No | OData app-role-assignment filter without the '$filter=' prefix. Microsoft Graph supports eq and startswith expressions on this route. | | `select` | array | No | App-role-assignment properties to return. | | `resource_service_principal_id` | string | Yes | Directory object ID (Object ID) of the resource service principal whose granted app-role assignments to list, not its Application (client) ID. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Conditional Access Policies **Slug:** `MICROSOFT_ENTRA_ID_LIST_CONDITIONAL_ACCESS_POLICIES` List read-only Microsoft Entra Conditional Access policy definitions, including conditions, grant controls, and session controls, with OData queries and cursor pagination. Conditional Access is license-dependent; delegated callers also need a supported Microsoft Entra role. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `skip` | integer | No | Number of policies to skip on the first page. Omit when continuing with cursor. | | `cursor` | string | No | Opaque cursor returned by this action. Omit it for the first page and pass it back unchanged to continue. | | `filter` | string | No | OData conditional-access-policy filter without the '$filter=' prefix. | | `select` | array | No | Conditional Access policy properties to return. | | `order_by` | string | No | OData conditional-access-policy ordering expression without the '$orderby=' prefix. | | `page_size` | integer | No | Maximum Conditional Access policies to return on this page. | | `include_count` | boolean | No | Return the first page's total matching policy count when Microsoft Graph supplies it. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Devices **Slug:** `MICROSOFT_ENTRA_ID_LIST_DEVICES` List devices registered in the Microsoft Entra tenant with optional advanced OData queries and cursor pagination. Results distinguish each device's directory object ID from its registration-service deviceId. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque cursor returned by this action. Omit it for the first page and pass it back unchanged to continue. | | `expand` | string | No | Supported device relationship expansion without the '$expand=' prefix. Cannot be combined with advanced query mode. | | `filter` | string | No | OData device filter without the '$filter=' prefix; enable advanced_query when the expression requires advanced query support. | | `search` | string | No | Microsoft Graph device search expression; automatically enables eventual consistency and a result count. | | `select` | array | No | Device properties to return. Use id for the directory object ID and deviceId for the distinct registration-service device identifier. | | `order_by` | string | No | OData device ordering expression without the '$orderby=' prefix. | | `page_size` | integer | No | Maximum devices to return on this page. | | `include_count` | boolean | No | Return the first page's total matching device count when Microsoft Graph supplies it. | | `advanced_query` | boolean | No | Enable ConsistencyLevel eventual and $count=true for an advanced device filter or ordering combination. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Directory Audits **Slug:** `MICROSOFT_ENTRA_ID_LIST_DIRECTORY_AUDITS` List retained Microsoft Entra directory audit events with documented OData filtering, activity-time ordering, and opaque cursor pagination. Availability is limited by the tenant's Microsoft Entra data-retention policy. For delegated access, the signed-in user must have Reports Reader, Security Reader, Security Administrator, or a supported custom role. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque cursor returned by this action. Omit it for the first page and pass it back unchanged to continue; do not pass a Graph $skiptoken. | | `filter` | string | No | OData directory-audit filter without the '$filter=' prefix. Microsoft supports eq, ge, le, and startswith expressions on documented fields. | | `order_by` | string ("activityDateTime asc" | "activityDateTime desc") | No | Order audit events by their UTC activity time. | | `page_size` | integer | No | Maximum directory audit events to return on this page. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Directory Role Members **Slug:** `MICROSOFT_ENTRA_ID_LIST_DIRECTORY_ROLE_MEMBERS` List principals currently assigned to one activated Microsoft Entra directory role. Microsoft Graph returns up to 1,000 objects by default and this operation does not support $top pagination, so the result is a single bounded collection. Concrete-type properties can be null when the connection has limited permission. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `select` | array | No | Directory-object properties to return. Properties other than id and @odata.type can be null when the connection cannot read a member's concrete object type. | | `role_id` | string | Yes | Object ID of the directory role activated in the tenant whose assigned principals to list. Do not provide a role definition or role template ID. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Directory Roles **Slug:** `MICROSOFT_ENTRA_ID_LIST_DIRECTORY_ROLES` List Microsoft Entra directory roles that are activated in the tenant. Inactive built-in roles and other available role definitions are not returned. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque cursor returned by this action. Omit it for the first page and pass it back unchanged to continue. | | `expand` | string | No | Supported directory-role relationship expansion without the '$expand=' prefix. | | `filter` | string | No | OData filter for activated directory roles without the '$filter=' prefix. Microsoft Graph supports only the eq operator for this endpoint. | | `select` | array | No | Directory-role properties to return. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Domains **Slug:** `MICROSOFT_ENTRA_ID_LIST_DOMAINS` List verified and unverified domains configured for the Microsoft Entra tenant, with documented OData query controls and cursor pagination. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `skip` | integer | No | Number of matching domains to skip on the first page. Omit when continuing with cursor. | | `cursor` | string | No | Opaque cursor returned by this action. Omit it for the first page and pass it back unchanged to continue. | | `expand` | string | No | Supported domain relationships to expand without the '$expand=' prefix. | | `filter` | string | No | OData domain filter without the '$filter=' prefix. Microsoft documents a known issue where $filter can return unexpected results on this endpoint. | | `search` | string | No | OData domain search expression without the '$search=' prefix. Microsoft documents a known issue where $search can return unexpected results on this endpoint. | | `select` | array | No | Domain properties to return. | | `order_by` | string | No | OData domain ordering expression without the '$orderby=' prefix. | | `page_size` | integer | No | Maximum domains to return on this page. Microsoft documents a known issue where $top can return unexpected results on this endpoint. | | `include_count` | boolean | No | Request the total number of matching domains when Microsoft Graph supplies it. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Group Members **Slug:** `MICROSOFT_ENTRA_ID_LIST_GROUP_MEMBERS` List a group's direct members; transitive members are not included. Hidden membership requires the additional Member.Read.Hidden grant and, for delegated access, an eligible Entra role, so hidden members can otherwise be omitted. Properties other than id and type can be null when the connection lacks permission to read a member's concrete object type. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque cursor returned by this action. Omit it for the first page and pass it back unchanged to continue. | | `expand` | string | No | Relationship expansion without the '$expand=' prefix. Microsoft Graph does not allow this with filter, search, count, or advanced_query. | | `filter` | string | No | OData direct-member filter without the '$filter=' prefix; this enables advanced query mode. | | `search` | string | No | Search expression over displayName or description; this enables advanced query mode. | | `select` | array | No | Directory-object properties to return. Properties other than id and @odata.type can be null when the connection cannot read a member's concrete type. | | `group_id` | string | Yes | Directory object ID of the group whose direct members to list. | | `page_size` | integer | No | Maximum direct members to return on this page (1-999). | | `include_count` | boolean | No | Return the first page's total matching member count using advanced query mode. | | `advanced_query` | boolean | No | Send ConsistencyLevel eventual and $count=true for an advanced OData query. Results can lag behind recent membership changes. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Group Owners **Slug:** `MICROSOFT_ENTRA_ID_LIST_GROUP_OWNERS` List the users and service principals that own a group. Microsoft Graph can omit service-principal owners during its staged v1.0 rollout. Properties other than id and type can be null when the connection lacks permission to read an owner's concrete object type. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque cursor returned by this action. Omit it for the first page and pass it back unchanged to continue. | | `filter` | string | No | OData owner filter without the '$filter=' prefix; this enables advanced query mode. | | `search` | string | No | Search expression over owner displayName or description; this enables advanced query mode. | | `select` | array | No | Directory-object properties to return. Properties other than id and @odata.type can be null when the connection cannot read an owner's concrete type. | | `group_id` | string | Yes | Directory object ID of the group whose owners to list. | | `order_by` | string | No | OData owner ordering expression without the '$orderby=' prefix; this enables advanced query mode. | | `page_size` | integer | No | Maximum group owners to return on this page (1-999). | | `include_count` | boolean | No | Return the first page's total matching owner count using advanced query mode. | | `advanced_query` | boolean | No | Send ConsistencyLevel eventual and $count=true for an advanced OData query. Results can lag behind recent ownership changes. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Groups **Slug:** `MICROSOFT_ENTRA_ID_LIST_GROUPS` List tenant groups with general OData options, or list only dynamic-membership groups with a fixed safe filter and membership-rule fields. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque cursor returned by this action. Omit it for the first page and pass it back unchanged to continue. | | `expand` | string | No | Supported OData group relationship expansion without the '$expand=' prefix. | | `filter` | string | No | OData group filter without the '$filter=' prefix. Available only when group_kind is all; dynamic mode supplies its own safe filter. | | `search` | string | No | Microsoft Graph group search expression; automatically enables eventual consistency and a result count. | | `select` | array | No | Group properties to return. Dynamic mode always adds id, displayName, membershipRule, membershipRuleProcessingState, and groupTypes. | | `order_by` | string | No | OData group ordering expression without the '$orderby=' prefix. | | `page_size` | integer | No | Maximum groups to return on this page (1-999). | | `group_kind` | string ("all" | "dynamic") | No | Return all groups, or only dynamic-membership groups. Dynamic mode uses a fixed filter and always requests group type and membership-rule fields. | | `include_count` | boolean | No | Return the first page's total matching group count when Microsoft Graph supplies it. | | `advanced_query` | boolean | No | Enable ConsistencyLevel eventual and $count=true for an advanced filter or ordering combination. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Organizations **Slug:** `MICROSOFT_ENTRA_ID_LIST_ORGANIZATIONS` Return the connected Microsoft Entra tenant's organization record. Microsoft Graph exposes it as a collection containing exactly one organization. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `select` | array | No | Organization properties to return. The tenant ID is always included. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Role Assignments **Slug:** `MICROSOFT_ENTRA_ID_LIST_ROLE_ASSIGNMENTS` List unified Microsoft Entra directory role assignments, including the assigned principal, role definition, and directory or application scope. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque cursor returned by this action. Omit it for the first page and pass it back unchanged to continue. | | `expand` | string | No | Supported role-assignment relationships to expand without the '$expand=' prefix, such as principal, roleDefinition, or directoryScope. | | `filter` | string | No | OData role-assignment filter without the '$filter=' prefix. | | `select` | array | No | Unified role-assignment properties to return. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Service Principal Owners **Slug:** `MICROSOFT_ENTRA_ID_LIST_SERVICE_PRINCIPAL_OWNERS` List directory objects that own an enterprise application/service principal. Properties other than id and type can be null when the connection lacks permission to read an owner's concrete object type. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque cursor returned by this action. Omit it for the first page and pass it back unchanged to continue. | | `filter` | string | No | OData owner filter without the '$filter=' prefix; this enables advanced query mode. | | `search` | string | No | Search expression over owner displayName or description; this enables advanced query mode. | | `select` | array | No | Directory-object properties to return. Properties other than id and @odata.type can be null when the connection cannot read an owner's concrete type. | | `order_by` | string | No | OData owner ordering expression without the '$orderby=' prefix; this enables advanced query mode. | | `page_size` | integer | No | Maximum service-principal owners to return on this page (1-999). | | `include_count` | boolean | No | Return the first page's total matching owner count using advanced query mode. | | `advanced_query` | boolean | No | Send ConsistencyLevel eventual and $count=true for an advanced OData query. Results can lag behind recent ownership changes. | | `service_principal_id` | string | Yes | Service-principal directory object ID (Object ID), not the Application (client) ID shown as appId. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Service Principals **Slug:** `MICROSOFT_ENTRA_ID_LIST_SERVICE_PRINCIPALS` List Microsoft Entra enterprise applications and service principals with OData filtering, search, ordering, and cursor pagination. Selection and output schemas structurally exclude password credentials, key credentials, and token-encryption key identifiers. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque cursor returned by this action. Omit it for the first page and pass it back unchanged to continue. | | `filter` | string | No | OData service-principal filter without the '$filter=' prefix; enable advanced_query for advanced operators. | | `search` | string | No | Microsoft Graph service-principal search expression; automatically enables eventual consistency and a result count. | | `order_by` | string | No | OData service-principal ordering expression without the '$orderby=' prefix. | | `page_size` | integer | No | Maximum service principals to return on this page (1-100). | | `safe_fields` | array | No | Credential-safe service-principal properties to return. The allowed values structurally exclude passwordCredentials, keyCredentials, and tokenEncryptionKeyId. | | `include_count` | boolean | No | Return the first page's total matching service-principal count when Microsoft Graph supplies it. | | `advanced_query` | boolean | No | Enable ConsistencyLevel eventual and $count=true for an advanced filter or ordering combination. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Sign Ins **Slug:** `MICROSOFT_ENTRA_ID_LIST_SIGN_INS` List retained Microsoft Entra sign-in events, newest first. Prefer a createdDateTime range filter to avoid timeouts. Results are limited by the tenant's retention policy; downloading sign-in logs requires Microsoft Entra ID P1 or P2, and delegated callers need a supported Entra role such as Reports Reader or Security Reader. P2-only risk details can be hidden. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque cursor returned by this action. Omit it for the first page and pass it back unchanged to continue; do not pass a Graph $skiptoken. | | `filter` | string | No | OData sign-in filter without the '$filter=' prefix. Prefer a bounded createdDateTime UTC range to avoid timeouts, for example createdDateTime ge 2024-07-01T00:00:00Z and createdDateTime le 2024-07-14T23:59:59Z. | | `page_size` | integer | No | Maximum sign-in events to return on this page (1-1000). | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Subscribed SKUs **Slug:** `MICROSOFT_ENTRA_ID_LIST_SUBSCRIBED_SKUS` List commercial product subscriptions acquired by the Microsoft Entra tenant, including assigned-license counts, prepaid-unit availability, and included service plans. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `select` | array | No | Subscribed-SKU properties to return. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List User Direct Reports **Slug:** `MICROSOFT_ENTRA_ID_LIST_USER_DIRECT_REPORTS` List directory objects that directly report to one user, with optional OData filtering, search, ordering, field selection, and safe cursor pagination. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque cursor returned by this action. Omit it for the first page and pass it back unchanged to continue. | | `expand` | string | No | Supported relationship expansion without the '$expand=' prefix. | | `filter` | string | No | OData direct-report filter without the '$filter=' prefix. | | `search` | string | No | Microsoft Graph search expression; automatically enables eventual consistency and a result count. | | `select` | array | No | Directory-object properties to return. | | `order_by` | string | No | OData ordering expression without the '$orderby=' prefix. | | `page_size` | integer | No | Direct reports to return on this page (1-999). | | `include_count` | boolean | No | Return the first page's total matching direct-report count when Microsoft Graph supplies it. | | `advanced_query` | boolean | No | Enable ConsistencyLevel eventual and $count=true for an advanced filter or ordering combination. | | `user_id_or_upn` | string | Yes | Manager user object ID or full user principal name. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List User License Details **Slug:** `MICROSOFT_ENTRA_ID_LIST_USER_LICENSE_DETAILS` List one tenant user's assigned product licenses and the provisioning state of their included service plans. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque cursor returned by this action. Omit it for the first page and pass it back unchanged to continue. | | `select` | array | No | License-detail properties to return. | | `user_id` | string | Yes | Directory object ID of the user. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List User Memberships **Slug:** `MICROSOFT_ENTRA_ID_LIST_USER_MEMBERSHIPS` List groups, directory roles, and administrative units a user directly belongs to. This is not transitive. Hidden memberships require the additional Member.Read.Hidden grant and otherwise might be omitted. Advanced OData queries use an eventually consistent index, so recent membership changes might not appear immediately. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque cursor returned by this action. Omit it for the first page and pass it back unchanged to continue. | | `filter` | string | No | OData filter for direct memberships, without the '$filter=' prefix; this uses eventual consistency. | | `search` | string | No | Microsoft Graph search expression over membership displayName; this uses eventual consistency. | | `select` | array | No | Directory-object properties to return. Properties can be null when the account cannot read a membership's concrete object type. | | `order_by` | string | No | OData ordering expression without the '$orderby=' prefix; this uses eventual consistency. | | `page_size` | integer | No | Maximum direct memberships to return on this page (1-999). | | `include_count` | boolean | No | Return the first page's total matching direct-membership count when Microsoft Graph supplies it. | | `advanced_query` | boolean | No | Force ConsistencyLevel eventual and $count=true for another documented advanced-query combination. | | `user_id_or_upn` | string | Yes | User directory object ID or full user principal name. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Users **Slug:** `MICROSOFT_ENTRA_ID_LIST_USERS` List tenant users with optional OData filtering, search, ordering, field selection, and a safe continuation cursor. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `cursor` | string | No | Opaque cursor returned by this action. Omit it for the first page and pass it back unchanged to continue. | | `expand` | string | No | Supported OData relationship expansion without the '$expand=' prefix. | | `filter` | string | No | OData user filter without the '$filter=' prefix; enable advanced_query for advanced operators. | | `search` | string | No | Microsoft Graph user search expression; automatically enables eventual consistency and a result count. | | `select` | array | No | User properties to return. Some sensitive properties require additional Microsoft Graph grants. | | `order_by` | string | No | OData user ordering expression without the '$orderby=' prefix. | | `page_size` | integer | No | Users to return on this page (1-999); use at most 500 when selecting signInActivity. | | `include_count` | boolean | No | Return the first page's total matching user count when Microsoft Graph supplies it. | | `advanced_query` | boolean | No | Enable ConsistencyLevel eventual and $count=true for an advanced filter or ordering combination. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Remove Administrative Unit Member **Slug:** `MICROSOFT_ENTRA_ID_REMOVE_ADMINISTRATIVE_UNIT_MEMBER` Remove a user, group, or device from a Microsoft Entra administrative unit, ending administration scoped through that membership. This is irreversible from this toolkit because the prior membership is not restored automatically. The request retains the mandatory /$ref suffix, so it removes only the membership reference and never deletes the member directory object. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `member_id` | string | Yes | Directory object ID of the user, group, or device to remove from the administrative unit. | | `administrative_unit_id` | string | Yes | Directory object ID of the target administrative unit. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Remove Application Owner **Slug:** `MICROSOFT_ENTRA_ID_REMOVE_APPLICATION_OWNER` Remove an owner from a Microsoft Entra application registration, revoking that principal's authority to administer the application. This is irreversible from this toolkit because prior ownership and administration access are not restored automatically. Microsoft recommends retaining at least two owners; verify that another valid owner will retain access before removal. The request preserves the required /$ref suffix, so it removes only the ownership reference and never deletes the owner directory object. With app-only authentication, the target application must be owned by the calling application when using Application.ReadWrite.OwnedBy. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `owner_id` | string | Yes | Directory object ID of the owner to remove. Verify that at least one other valid application owner will retain administration access. | | `application_object_id` | string | Yes | Application directory object ID (Object ID), not the Application (client) ID shown as appId. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Remove App Role Assignment **Slug:** `MICROSOFT_ENTRA_ID_REMOVE_APP_ROLE_ASSIGNMENT` Remove an app-role assignment from a Microsoft Entra resource service principal. This revokes the user, group, or client service principal's application access granted by that role. The removal is irreversible from this toolkit because the prior assignment is not restored automatically. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `app_role_assignment_id` | string | Yes | Opaque app-role assignment ID returned by Microsoft Graph. These IDs are typically base64url strings, not GUIDs. Removing it revokes the principal's application access granted by that role. | | `resource_service_principal_id` | string | Yes | Directory Object ID of the resource service principal that exposes the assigned application role, not its Application (client) ID. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Remove Directory Role Member **Slug:** `MICROSOFT_ENTRA_ID_REMOVE_DIRECTORY_ROLE_MEMBER` Remove a principal from an activated Microsoft Entra directory role, revoking the role's tenant-wide administrative access. This is irreversible from this toolkit because the prior role membership is not restored automatically. The request retains the mandatory /$ref suffix, so it removes only the membership reference and never deletes the principal directory object. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `role_id` | string | Yes | Object ID of the activated Microsoft Entra directory role. | | `member_id` | string | Yes | Directory object ID of the principal whose administrative role access will be revoked. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Remove Group Member **Slug:** `MICROSOFT_ENTRA_ID_REMOVE_GROUP_MEMBER` Remove a direct member from an assigned-membership Microsoft Entra group, revoking access inherited through that membership. This is irreversible from this toolkit because the prior membership is not restored automatically. Dynamic groups do not support manual membership changes. Role-assignable groups additionally require RoleManagement.ReadWrite.Directory and a supported Microsoft Entra role. The request retains the required /$ref suffix so it removes only the membership reference and never deletes the member object. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `group_id` | string | Yes | Directory object ID of the assigned-membership group. Dynamic groups do not support manual membership changes. | | `member_id` | string | Yes | Directory object ID of the direct member to remove. This removes only the membership reference, not the member directory object. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Remove Group Owner **Slug:** `MICROSOFT_ENTRA_ID_REMOVE_GROUP_OWNER` Remove a user or service principal as an owner of a Microsoft Entra group, revoking that principal's authority to administer the group. This is irreversible from this toolkit because prior ownership is not restored automatically. Verify that another valid owner remains before removing the current owner; removing the last owner can leave ownership-dependent groups without an administrator. The owner directory object itself is not deleted. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `group_id` | string | Yes | Directory object ID of the group whose owner will be removed. | | `owner_id` | string | Yes | Directory object ID of the user or service-principal owner to remove. Verify that another valid owner remains before calling this action. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Remove Role Assignment **Slug:** `MICROSOFT_ENTRA_ID_REMOVE_ROLE_ASSIGNMENT` Remove a unified Microsoft Entra directory role assignment and revoke the principal's administrative access at that assignment's scope. This is irreversible from this toolkit because the prior assignment is not restored automatically. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `assignment_id` | string | Yes | Opaque identifier of the unified directory role assignment whose administrative access will be revoked. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Remove Service Principal Owner **Slug:** `MICROSOFT_ENTRA_ID_REMOVE_SERVICE_PRINCIPAL_OWNER` Remove an owner from a Microsoft Entra enterprise application/service principal, revoking that principal's authority to administer it. This is irreversible from this toolkit because prior ownership and administration access are not restored automatically. Microsoft recommends retaining at least two owners; verify that another valid owner will retain access before removal. The request preserves the required /$ref suffix, so it removes only the ownership reference and never deletes the owner directory object. With app-only authentication, the target service principal must be owned by the calling application when using Application.ReadWrite.OwnedBy. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `owner_id` | string | Yes | Directory object ID of the owner to remove. Verify that another valid owner will retain administration access. | | `service_principal_id` | string | Yes | Service-principal directory Object ID, not the Application (client) ID shown as appId. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Administrative Unit **Slug:** `MICROSOFT_ENTRA_ID_UPDATE_ADMINISTRATIVE_UNIT` Update explicitly supplied profile or dynamic-membership properties of one Microsoft Entra administrative unit. The immutable restricted-member-management property is not accepted. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `visibility` | string | No | Hide the administrative unit membership from nonmembers. | | `description` | string | No | New description, or null to clear it. | | `display_name` | string | No | New display name. This property cannot be cleared. | | `membership_rule` | string | No | New rule for a dynamic administrative unit. | | `membership_type` | string ("dynamic" | "assigned") | No | New membership mode. Switching to dynamic also requires a rule and processing state. | | `administrative_unit_id` | string | Yes | Directory object ID of the administrative unit to update. | | `membership_rule_processing_state` | string ("On" | "Paused") | No | Activate or pause processing for a dynamic membership rule. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Application **Slug:** `MICROSOFT_ENTRA_ID_UPDATE_APPLICATION` Update explicitly supplied, allowlisted settings of one Microsoft Entra application registration. Password credentials, key credentials, and token encryption key selection are structurally unavailable. With app-only OAuth, the least-privilege grant can update only applications owned by the calling app. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `api` | object | No | Resource API settings to update. Credential and token-encryption-key fields are unavailable. | | `spa` | object | No | Replacement single-page application redirect settings. | | `web` | object | No | Web platform settings to update. Only explicitly supplied nested fields are sent. | | `app_roles` | array | No | Complete replacement list of application roles; include existing roles that must remain. | | `description` | string | No | New application description, or null to clear it. | | `display_name` | string | No | New application display name. | | `public_client` | object | No | Replacement public-client redirect settings. | | `identifier_uris` | array | No | Complete replacement list of globally unique application identifier URIs. | | `sign_in_audience` | string ("AzureADMyOrg" | "AzureADMultipleOrgs" | "AzureADandPersonalMicrosoftAccount" | "PersonalMicrosoftAccount") | No | New set of Microsoft account types supported for sign-in. | | `application_object_id` | string | Yes | Application directory object ID (Object ID), not the Application (client) ID shown as appId. | | `required_resource_access` | array | No | Complete replacement resource-permission declarations. This does not grant tenant consent. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Group **Slug:** `MICROSOFT_ENTRA_ID_UPDATE_GROUP` Update explicitly supplied, allowlisted properties of one Microsoft Entra group, including its dynamic membership rule or processing state. Properties that require separate permissions or delegated-only support are unavailable. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `group_id` | string | Yes | Directory object ID of the group to update. | | `description` | string | No | New group description, or null to clear it. | | `display_name` | string | No | New display name. This property cannot be cleared. | | `mail_nickname` | string | No | New mail alias when Microsoft Graph permits changing it. | | `membership_rule` | string | No | New membership rule for a dynamic-membership group. | | `membership_rule_processing_state` | string ("On" | "Paused") | No | Turn dynamic membership rule processing on or pause it. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Service Principal **Slug:** `MICROSOFT_ENTRA_ID_UPDATE_SERVICE_PRINCIPAL` Update explicitly supplied, allowlisted settings of one Microsoft Entra enterprise application/service principal. Password credentials, key credentials, and token-encryption-key selection are structurally unavailable. With app-only OAuth, the least-privilege grant applies only to service principals owned by the calling application. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `tags` | array | No | Complete replacement list of strings used to categorize the service principal. | | `description` | string | No | New end-user-facing description, or null to clear it. | | `display_name` | string | No | New display name for the service principal. | | `account_enabled` | boolean | No | Whether users and applications can authenticate through this service principal. | | `service_principal_id` | string | Yes | Service-principal directory object ID (Object ID), not the associated application's appId. | | `app_role_assignment_required` | boolean | No | Whether users and other service principals must receive an explicit app role assignment before signing in or obtaining tokens. | | `notification_email_addresses` | array | No | Complete replacement list of addresses notified before a SAML token-signing certificate expires. | | `preferred_single_sign_on_mode` | string ("password" | "saml" | "notSupported" | "oidc") | No | Preferred single sign-on mode used to launch the enterprise application. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update User **Slug:** `MICROSOFT_ENTRA_ID_UPDATE_USER` Update allowlisted, non-credential profile properties for one Microsoft Entra user. Only explicitly supplied fields are changed; use null only on fields whose description permits clearing. Account status, passwords, authentication methods, identities, phone properties, lifecycle data, and custom security attributes are intentionally unavailable. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `surname` | string | No | New surname, or null to clear it. | | `job_title` | string | No | New job title, or null to clear it. | | `department` | string | No | New department, or null to clear it. | | `given_name` | string | No | New given name, or null to clear it. | | `display_name` | string | No | New display name. | | `user_id_or_upn` | string | Yes | User object ID or full user principal name to update. | | `office_location` | string | No | New office location, or null to clear it. | | `preferred_language` | string | No | New preferred language, or null to clear it. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not |