rocketkind
Security

Microsoft Entra ID

Microsoft Entra ID (formerly Azure Active Directory) is the directory behind every Microsoft 365 and Azure tenant.

Authentication

  • Microsoft Entra ID (app-only client credentials)
  • OAuth 2.0 (delegated admin sign-in)

Actions

Generic API request. Call any Microsoft Graph endpoint on this connection, for the case where no shipped action covers it yet — directory objects, administrative units, applications, authentication methods and the rest of Graph v1.0. The connection supplies the base URL, the authentication and the egress route, so only the path, query,…

  • Add group memberAdd a user, group, device or service principal to a group by object id.
  • Create groupCreate a security group (for access and app assignment) or a Microsoft 365 group (with a shared mailbox, calendar and files).
  • Create userCreate a work or school account in the directory.
  • Delete userDestructiveDelete a user.
  • Disable userDestructiveBlock a user from signing in by setting accountEnabled to false — the standard first step of offboarding or of containing a compromised account.
  • Enable userDestructiveLet a disabled user sign in again by setting accountEnabled to true, for example when a leave ends or a suspected compromise is cleared.
  • Get groupRead one group by object id: its name, description, whether it is a security or Microsoft 365 group, its visibility and, for a dynamic group, its membership rule.
  • Get userRead one directory user by object id or userPrincipalName, returning its profile under body.
  • List active role assignmentsList every active directory role assignment — permanent ones and Privileged Identity Management eligibilities someone has activated, each marked by assignmentType (Assigned or Activated) with its end time.
  • List directory auditsRead the directory audit log — every change made in Entra ID: users created or deleted, group memberships changed, roles assigned, apps consented — with who did it (initiatedBy) and to what (targetResources).
  • List directory role membersList who holds an activated directory role — users, groups assignable to roles and service principals — for privileged-access reviews such as "who are our Global Administrators?".
  • List directory rolesList the directory roles activated in this tenant — Global Administrator, User Administrator and the rest — with the role id microsoftentraid:listdirectoryrolemembers takes.
  • List eligible role assignmentsList who is eligible for a directory role through Privileged Identity Management — people, groups and service principals that can activate a role on demand but do not hold it until they do.
  • List group membersList the members of a group — users, nested groups, devices, service principals and contacts.
  • List groupsRead the directory's groups — security groups and Microsoft 365 groups alike — narrowed by an OData $filter (securityEnabled eq true, groupTypes/any(c:c eq 'Unified'), startsWith(displayName,'HR')) or a $search clause.
  • List sign-insRead the tenant's interactive user sign-in log, newest first — who signed in to what, from where, and whether it succeeded (status.errorCode 0) or failed; it keeps 30 days.
  • List user membershipsList what a user belongs to: groups, activated directory roles and administrative units.
  • List usersRead directory users, narrowed by an OData $filter (accountEnabled eq false, startsWith(displayName,'Ada'), department eq 'Sales') or a $search clause, with the properties you name in Select.
  • Remove group memberDestructiveRemove one member from a group by object id — the object itself is untouched, only the membership goes.
  • Revoke user sign-in sessionsDestructiveInvalidate every refresh token and browser session cookie issued to a user, forcing a fresh sign-in everywhere — the step that actually cuts off a lost device or a compromised account, usually right after microsoftentraid:disableuser or a password reset.
  • Update userDestructiveChange profile properties of an existing user — job title, department, manager-facing contact details, usage location, even the sign-in name.

Product names, logos and brands are the property of their respective owners and are used here for identification only. Their use does not imply endorsement by, or affiliation with, those owners.