Azure AD

List Users

List users in Azure AD (Microsoft Entra ID)

Get User

Get a user by ID or user principal name from Azure AD

Create User

Create a new user in Azure AD (Microsoft Entra ID)

Update User

Update user properties in Azure AD (Microsoft Entra ID)

Delete User

Delete a user from Azure AD (Microsoft Entra ID). The user is moved to a temporary container and can be restored within 30 days.

List Groups

List groups in Azure AD (Microsoft Entra ID)

Get Group

Get a group by ID from Azure AD (Microsoft Entra ID)

Create Group

Create a new group in Azure AD (Microsoft Entra ID)

Update Group

Update group properties in Azure AD (Microsoft Entra ID)

Delete Group

Delete a group from Azure AD (Microsoft Entra ID). Microsoft 365 and security groups can be restored within 30 days.

List Group Members

List members of a group in Azure AD (Microsoft Entra ID)

Add Group Member

Add a member to a group in Azure AD (Microsoft Entra ID)

Remove Group Member

Remove a member from a group in Azure AD (Microsoft Entra ID)

Assign License

Add or remove subscription licenses (SKUs) on a user in Microsoft Entra ID. Removing a license immediately revokes the access it granted to the associated services.

List User Licenses

List the subscription licenses assigned to a user in Microsoft Entra ID

List Subscribed SKUs

List the subscription SKUs the tenant owns, including how many license units are prepaid and how many are consumed

Revoke Sign-In Sessions

Invalidate every refresh token and session cookie issued to a user, forcing them to sign in again on all applications and devices. Revocation can take a few minutes to take effect and does not apply to external users.

Set Password

Set a specific password on a user by updating their password profile. Cannot be used for federated users. Requires an administrator role in Microsoft Entra ID.

Reset Password

Reset another user's password through their password authentication method. Leave the new password empty to have Microsoft generate one and return it. The user is prompted to change the password at their next sign-in. Cannot be run against your own account.

List Authentication Methods

List the authentication methods a user has registered, such as passwords, phone numbers, FIDO2 keys, and authenticator apps

List Sign-Ins

List sign-in events from the Microsoft Entra ID sign-in logs, newest first. Requires a Microsoft Entra ID P1 or P2 license. Apply a date filter to keep large queries from timing out.

List Directory Audits

List directory audit records showing who changed what in Microsoft Entra ID, such as user creation, group membership changes, and role assignments

List User App Role Assignments

List the application role assignments granted to a user, including assignments the user inherits from groups they are a direct member of

Grant App Role To User

Grant a user an application role on a service principal, giving them access to that application

Revoke App Role From User

Revoke an application role assignment from a user, removing their access to that application. Takes the assignment's own ID, not the app role ID.

List Service Principals

List the enterprise applications and service principals in the tenant, including the app roles each one exposes

List Application Assignments

List every user, group, and service principal assigned to an application, by reading the app role assignments on its service principal. Recently granted or removed assignments can take time to appear.

List Directory Roles

List the administrator roles that are activated in the tenant, such as Global Administrator and User Administrator. Roles that have never been activated are not returned.

List Directory Role Members

List the principals holding an administrator role. Returns up to 1000 members; this endpoint does not support paging.

Add Directory Role Member

Grant a user an administrator role in Microsoft Entra ID. This is a privileged change that expands what the user can do across the tenant.

Remove Directory Role Member

Revoke an administrator role from a user in Microsoft Entra ID. Removes only the role membership; the user account itself is not deleted.

List Devices

List the devices registered in Microsoft Entra ID

Get Device

Get a registered device by its object ID from Microsoft Entra ID

List User Devices

List the devices a user has registered or owns. Devices the caller cannot read are returned with only their ID and the remaining fields null.

List Conditional Access Policies

List the conditional access policies configured in the tenant, including their state and the conditions and controls they enforce. Read-only.

Get Conditional Access Policy

Get a single conditional access policy by ID, including the conditions it matches and the controls it enforces. Read-only.