Use Microsoft Entra ID , formerly Azure Active Directory, to manage directory users, groups, memberships, licenses, passwords, sign-in sessions, app roles, and directory roles. Read sign-in and audit logs, registered devices, and conditional access policies; device writes are excluded.
Use OData filters to query directory records. Grant the connection the permissions and administrative roles required by each operation before using it for onboarding, offboarding, or access review. Microsoft 365 groups have a 30-day recovery window. Cloud security-group recovery is a public-cloud preview with tenant restrictions ; confirm eligibility before deleting a group.
Sim requests these scopes when someone connects an Azure AD account. For a self-hosted deployment, register your own app with the provider using the settings below. See Integrations and OAuth for setup.
Setting Value Redirect URI <NEXT_PUBLIC_APP_URL>/api/auth/oauth2/callback/microsoft-adEnvironment variables MICROSOFT_CLIENT_ID, MICROSOFT_CLIENT_SECRET
Scope Description openidStandard authentication profileAccess profile information emailAccess email address User.ReadWrite.AllRead and write all user profiles Group.ReadWrite.AllRead and write all groups GroupMember.ReadWrite.AllRead and write all group memberships LicenseAssignment.Read.AllRead license assignments and subscribed SKUs LicenseAssignment.ReadWrite.AllAssign and remove user licenses UserAuthenticationMethod.ReadWrite.AllRead and reset authentication methods and passwords for all users AuditLog.Read.AllRead sign-in and directory audit logs Application.Read.AllRead all applications and service principals AppRoleAssignment.ReadWrite.AllManage app role assignments and permission grants for any app RoleManagement.ReadWrite.DirectoryRead and manage directory role assignments Device.Read.AllRead all devices Policy.Read.AllRead conditional access and other policies offline_accessAccess account when not using the application
Create, update, and delete users and groups, manage group memberships, assign and remove licenses, reset passwords, revoke sign-in sessions, read sign-in and directory audit logs, grant and revoke app and directory roles, and read registered devices and conditional access policies. Device writes are not supported.
List users in Azure AD (Microsoft Entra ID)
Parameter Type Required Description topnumber No Maximum number of users to return (default 100, max 999) filterstring No OData filter expression (e.g., "department eq 'Sales'") searchstring No Search string to filter users by displayName or mail nextLinkstring No Continuation URL from a previous response's 'nextLink' output, used to fetch the next page of results
Parameter Type Description usersarray List of users ↳ id string User ID ↳ displayName string Display name ↳ givenName string First name ↳ surname string Last name ↳ userPrincipalName string User principal name (email) ↳ mail string Email address ↳ jobTitle string Job title ↳ department string Department ↳ officeLocation string Office location ↳ mobilePhone string Mobile phone number ↳ accountEnabled boolean Whether the account is enabled userCountnumber Number of users returned nextLinkstring Continuation URL for the next page of results, or null if there are no more
Get a user by ID or user principal name from Azure AD
Parameter Type Required Description userIdstring Yes User ID or user principal name (e.g., "user@example.com ")
Parameter Type Description userobject User details ↳ id string User ID ↳ displayName string Display name ↳ givenName string First name ↳ surname string Last name ↳ userPrincipalName string User principal name (email) ↳ mail string Email address ↳ jobTitle string Job title ↳ department string Department ↳ officeLocation string Office location ↳ mobilePhone string Mobile phone number ↳ accountEnabled boolean Whether the account is enabled
Create a new user in Azure AD (Microsoft Entra ID)
Parameter Type Required Description displayNamestring Yes Display name for the user mailNicknamestring Yes Mail alias for the user userPrincipalNamestring Yes User principal name (e.g., "user@example.com ") passwordstring Yes Initial password for the user accountEnabledboolean Yes Whether the account is enabled givenNamestring No First name surnamestring No Last name jobTitlestring No Job title departmentstring No Department officeLocationstring No Office location mobilePhonestring No Mobile phone number
Parameter Type Description userobject Created user details ↳ id string User ID ↳ displayName string Display name ↳ givenName string First name ↳ surname string Last name ↳ userPrincipalName string User principal name (email) ↳ mail string Email address ↳ jobTitle string Job title ↳ officeLocation string Office location ↳ mobilePhone string Mobile phone number ↳ businessPhones array Business phone numbers ↳ preferredLanguage string Preferred language
Update user properties in Azure AD (Microsoft Entra ID)
Parameter Type Required Description userIdstring Yes User ID or user principal name displayNamestring No Display name givenNamestring No First name surnamestring No Last name jobTitlestring No Job title departmentstring No Department officeLocationstring No Office location mobilePhonestring No Mobile phone number accountEnabledboolean No Whether the account is enabled
Parameter Type Description updatedboolean Whether the update was successful userIdstring ID of the updated user
Delete a user from Azure AD (Microsoft Entra ID). The user is moved to a temporary container and can be restored within 30 days.
Parameter Type Required Description userIdstring Yes User ID or user principal name
Parameter Type Description deletedboolean Whether the deletion was successful userIdstring ID of the deleted user
List groups in Azure AD (Microsoft Entra ID)
Parameter Type Required Description topnumber No Maximum number of groups to return (default 100, max 999) filterstring No OData filter expression (e.g., "securityEnabled eq true") searchstring No Search string to filter groups by displayName or description nextLinkstring No Continuation URL from a previous response's 'nextLink' output, used to fetch the next page of results
Parameter Type Description groupsarray List of groups ↳ id string Group ID ↳ displayName string Display name ↳ description string Group description ↳ mail string Email address ↳ mailEnabled boolean Whether mail is enabled ↳ mailNickname string Mail nickname ↳ securityEnabled boolean Whether security is enabled ↳ groupTypes array Group types ↳ visibility string Group visibility ↳ createdDateTime string Creation date groupCountnumber Number of groups returned nextLinkstring Continuation URL for the next page of results, or null if there are no more
Get a group by ID from Azure AD (Microsoft Entra ID)
Parameter Type Required Description groupIdstring Yes Group ID
Parameter Type Description groupobject Group details ↳ id string Group ID ↳ displayName string Display name ↳ description string Group description ↳ mail string Email address ↳ mailEnabled boolean Whether mail is enabled ↳ mailNickname string Mail nickname ↳ securityEnabled boolean Whether security is enabled ↳ groupTypes array Group types ↳ visibility string Group visibility ↳ createdDateTime string Creation date
Create a new group in Azure AD (Microsoft Entra ID)
Parameter Type Required Description displayNamestring Yes Display name for the group mailNicknamestring Yes Mail alias for the group (ASCII only, max 64 characters) descriptionstring No Group description mailEnabledboolean Yes Whether mail is enabled (true for Microsoft 365 groups) securityEnabledboolean Yes Whether security is enabled (true for security groups) groupTypesstring No Group type: "Unified" for Microsoft 365 group, leave empty for security group visibilitystring No Group visibility: "Private" or "Public" (can be changed later), or "HiddenMembership" (Microsoft 365 groups only; can only be set at creation and never changed afterward)
Parameter Type Description groupobject Created group details ↳ id string Group ID ↳ displayName string Display name ↳ description string Group description ↳ mail string Email address ↳ mailEnabled boolean Whether mail is enabled ↳ mailNickname string Mail nickname ↳ securityEnabled boolean Whether security is enabled ↳ groupTypes array Group types ↳ visibility string Group visibility ↳ createdDateTime string Creation date
Update group properties in Azure AD (Microsoft Entra ID)
Parameter Type Required Description groupIdstring Yes Group ID displayNamestring No Display name descriptionstring No Group description mailNicknamestring No Mail alias visibilitystring No Group visibility: "Private" or "Public"
Parameter Type Description updatedboolean Whether the update was successful groupIdstring ID of the updated group
Delete a group from Azure AD (Microsoft Entra ID). Microsoft 365 groups can be restored within 30 days. Cloud security-group recovery is a public-cloud preview with tenant restrictions; confirm eligibility before deleting.
Parameter Type Required Description groupIdstring Yes Group ID
Parameter Type Description deletedboolean Whether the deletion was successful groupIdstring ID of the deleted group
List members of a group in Azure AD (Microsoft Entra ID)
Parameter Type Required Description groupIdstring No Group ID. Not needed when Next Page is provided to fetch a later page. topnumber No Maximum number of members to return (default 100, max 999) nextLinkstring No Continuation URL from a previous response's 'nextLink' output, used to fetch the next page of results
Parameter Type Description membersarray List of group members ↳ id string Member ID ↳ displayName string Display name ↳ mail string Email address ↳ odataType string Directory object type memberCountnumber Number of members returned nextLinkstring Continuation URL for the next page of results, or null if there are no more
Add a member to a group in Azure AD (Microsoft Entra ID)
Parameter Type Required Description groupIdstring Yes Group ID memberIdstring Yes User ID of the member to add
Parameter Type Description addedboolean Whether the member was added successfully groupIdstring Group ID memberIdstring Member ID that was added
Remove a member from a group in Azure AD (Microsoft Entra ID)
Parameter Type Required Description groupIdstring Yes Group ID memberIdstring Yes User ID of the member to remove
Parameter Type Description removedboolean Whether the member was removed successfully groupIdstring Group ID memberIdstring Member ID that was removed
Add or remove subscription licenses (SKUs) on a user in Microsoft Entra ID. Removing a license immediately revokes the access it granted to the associated services.
Parameter Type Required Description userIdstring Yes User ID or user principal name to change licenses for addSkuIdsstring No Comma-separated SKU IDs (GUIDs) of the licenses to assign. Leave empty to only remove licenses. removeSkuIdsstring No Comma-separated SKU IDs (GUIDs) of the licenses to remove. Leave empty to only add licenses. disabledPlanIdsstring No Comma-separated service plan IDs (GUIDs) to disable on every license being assigned
Parameter Type Description userIdstring ID of the user whose licenses changed displayNamestring Display name of the user userPrincipalNamestring User principal name of the user assignedLicensesarray Licenses assigned to the user after the change ↳ skuId string SKU ID of the assigned license ↳ disabledPlans array Service plan IDs disabled on this license
List the subscription licenses assigned to a user in Microsoft Entra ID
Parameter Type Required Description userIdstring Yes User ID or user principal name
Parameter Type Description licensesarray Licenses assigned to the user ↳ id string License detail ID ↳ skuId string SKU ID of the license ↳ skuPartNumber string SKU part number (e.g., "ENTERPRISEPACK") ↳ servicePlans array Service plans included in the license ↳ servicePlanId string Service plan ID ↳ servicePlanName string Service plan name ↳ provisioningStatus string Provisioning status of the service plan ↳ appliesTo string Whether the plan applies to "User" or "Company" licenseCountnumber Number of licenses returned
List the subscription SKUs the tenant owns, including how many license units are prepaid and how many are consumed
Parameter Type Required Description
Parameter Type Description skusarray Subscription SKUs owned by the tenant ↳ id string Subscribed SKU object ID ↳ skuId string SKU ID, used when assigning or removing licenses ↳ skuPartNumber string SKU part number (e.g., "ENTERPRISEPACK") ↳ appliesTo string Whether the SKU applies to "User" or "Company" ↳ capabilityStatus string Capability status of the subscription ↳ consumedUnits number Number of licenses currently assigned ↳ prepaidUnits object Prepaid license unit counts by status ↳ enabled number Number of units that are enabled ↳ suspended number Number of units that are suspended ↳ warning number Number of units that are in warning status ↳ lockedOut number Number of units that are locked out ↳ servicePlans array Service plans included in the SKU ↳ servicePlanId string Service plan ID ↳ servicePlanName string Service plan name ↳ provisioningStatus string Provisioning status of the service plan ↳ appliesTo string Whether the plan applies to "User" or "Company" skuCountnumber Number of SKUs returned
Invalidate every refresh token and session cookie issued to a user, forcing them to sign in again on all applications and devices. Revocation can take a few minutes to take effect and does not apply to external users.
Parameter Type Required Description userIdstring Yes User ID or user principal name whose sessions should be revoked
Parameter Type Description revokedboolean Whether Microsoft Graph confirmed the sessions were revoked userIdstring ID of the user whose sessions were revoked
Set a specific password on a user by updating their password profile. Cannot be used for federated users. Requires an administrator role in Microsoft Entra ID.
Parameter Type Required Description userIdstring Yes User ID or user principal name whose password should be set passwordstring Yes The new password. Must satisfy the tenant password policy. forceChangePasswordNextSignInboolean No Whether the user must change this password at their next sign-in. Defaults to true. forceChangePasswordNextSignInWithMfaboolean No Whether the user must complete multifactor authentication before being forced to change the password
Parameter Type Description updatedboolean Whether the password was set successfully userIdstring ID of the user whose password was set forceChangePasswordNextSignInboolean Whether the user must change the password at their next sign-in
Reset another user's password through their password authentication method. Leave the new password empty to have Microsoft generate one and return it. The user is prompted to change the password at their next sign-in. Cannot be run against your own account.
Parameter Type Required Description userIdstring Yes User ID or user principal name whose password should be reset newPasswordstring No The new password. Required for tenants with hybrid password scenarios. Leave empty for a cloud-only password to have Microsoft generate and return one.
Parameter Type Description acceptedboolean Whether Microsoft Graph accepted the password reset operation userIdstring ID of the user whose password was reset newPasswordstring The system-generated password, returned only when no new password was supplied in the request. Like every tool output it appears in workflow outputs and run history, and is sent to the model when an agent calls this tool, so prefer supplying your own password when the value must not leave the workflow. operationLocationstring URL to poll for the status of the long-running password reset operation
List the authentication methods a user has registered, such as passwords, phone numbers, FIDO2 keys, and authenticator apps
Parameter Type Required Description userIdstring Yes User ID or user principal name
Parameter Type Description methodsarray Authentication methods registered by the user ↳ id string Authentication method ID ↳ odataType string Authentication method type (e.g., "#microsoft.graph.phoneAuthenticationMethod"). Method-specific details vary by type. ↳ createdDateTime string When the authentication method was registered methodCountnumber Number of authentication methods returned
List sign-in events from the Microsoft Entra ID sign-in logs, newest first. Requires a Microsoft Entra ID P1 or P2 license. Apply a date filter to keep large queries from timing out.
Parameter Type Required Description topnumber No Maximum number of sign-ins to return (default and maximum page size is 1000) filterstring No OData filter expression. Filterable fields include userPrincipalName, userId, appId, appDisplayName, ipAddress, createdDateTime, conditionalAccessStatus, riskState and status/errorCode. Example: "createdDateTime ge 2024-01-01T00:00:00Z and status/errorCode ne 0". nextLinkstring No Continuation URL from a previous response's 'nextLink' output, used to fetch the next page of results
Parameter Type Description signInsarray Sign-in events ↳ id string Sign-in event ID ↳ createdDateTime string When the sign-in was initiated ↳ userId string ID of the user who signed in ↳ userDisplayName string Display name of the user ↳ userPrincipalName string User principal name of the user ↳ appId string ID of the application used to sign in ↳ appDisplayName string Display name of the application ↳ resourceId string ID of the resource that was accessed ↳ resourceDisplayName string Display name of the resource ↳ ipAddress string IP address the sign-in came from ↳ clientAppUsed string Legacy client app used to sign in ↳ correlationId string Correlation ID for the sign-in request ↳ conditionalAccessStatus string Conditional access result: success, failure, notApplied, or unknownFutureValue ↳ isInteractive boolean Whether the sign-in was interactive ↳ riskDetail string Reason behind a specific risk state ↳ riskLevelAggregated string Aggregated risk level for the sign-in ↳ riskState string Risk state of the user or sign-in ↳ errorCode number Sign-in status error code. 0 indicates a successful sign-in. ↳ failureReason string Failure reason from the sign-in status ↳ deviceDisplayName string Display name of the device used ↳ deviceId string ID of the device used ↳ deviceOperatingSystem string Operating system of the device used ↳ deviceBrowser string Browser used to sign in ↳ deviceIsCompliant boolean Whether the device is compliant ↳ deviceIsManaged boolean Whether the device is managed ↳ locationCity string City the sign-in came from ↳ locationState string State the sign-in came from ↳ locationCountryOrRegion string Two-letter country or region code the sign-in came from signInCountnumber Number of sign-ins returned nextLinkstring Continuation URL for the next page of results, or null if there are no more
List directory audit records showing who changed what in Microsoft Entra ID, such as user creation, group membership changes, and role assignments
Parameter Type Required Description topnumber No Maximum number of audit records to return filterstring No OData filter expression. Filterable fields include activityDateTime, activityDisplayName, correlationId, loggedByService, initiatedBy and targetResources. Example: "activityDateTime ge 2024-01-01T00:00:00Z". nextLinkstring No Continuation URL from a previous response's 'nextLink' output, used to fetch the next page of results
Parameter Type Description auditsarray Directory audit records ↳ id string Audit record ID ↳ activityDateTime string When the activity took place ↳ activityDisplayName string Name of the activity ↳ category string Category of the activity ↳ correlationId string Correlation ID for the activity ↳ loggedByService string Service that logged the activity ↳ operationType string Operation type (e.g., Add, Update, Delete) ↳ result string Result of the activity: success, failure, timeout, or unknownFutureValue ↳ resultReason string Reason for the result ↳ initiatedByUserId string ID of the user who initiated the activity ↳ initiatedByUserPrincipalName string User principal name of the initiating user ↳ initiatedByUserDisplayName string Display name of the initiating user ↳ initiatedByAppId string App ID that initiated the activity ↳ initiatedByAppDisplayName string Display name of the app that initiated the activity ↳ targetResources array Resources the activity acted on ↳ id string ID of the target resource ↳ displayName string Display name of the target resource ↳ type string Type of the target resource (e.g., User, Group) ↳ userPrincipalName string User principal name of the target, null for non-user resources auditCountnumber Number of audit records returned nextLinkstring Continuation URL for the next page of results, or null if there are no more
List the application role assignments granted to a user, including assignments the user inherits from groups they are a direct member of
Parameter Type Required Description userIdstring No User ID or user principal name. Not needed when Next Page is provided to fetch a later page. topnumber No Maximum number of assignments to return filterstring No OData filter expression. Filterable fields include id, resourceId and principalDisplayName. Example: "resourceId eq 8e881353-1735-45af-af21-ee1344582a4d". nextLinkstring No Continuation URL from a previous response's 'nextLink' output, used to fetch the next page of results
Parameter Type Description assignmentsarray App role assignments granted to the user ↳ id string App role assignment ID, used when removing the assignment ↳ appRoleId string ID of the app role. All-zero GUID means the assignment grants access without a specific role. ↳ createdDateTime string When the assignment was created ↳ principalId string ID of the assigned principal ↳ principalDisplayName string Display name of the assigned principal ↳ principalType string Principal type: User, Group, or ServicePrincipal ↳ resourceId string ID of the resource service principal that defines the app role ↳ resourceDisplayName string Display name of the resource assignmentCountnumber Number of assignments returned nextLinkstring Continuation URL for the next page of results, or null if there are no more
Grant a user an application role on a service principal, giving them access to that application
Parameter Type Required Description userIdstring Yes Object ID or user principal name of the user to grant the app role to. A user principal name is resolved to its object ID before the grant. resourceIdstring Yes Object ID of the resource service principal that defines the app role. Use List Service Principals to find it. appRoleIdstring Yes ID of the app role to grant. Use the all-zero GUID 00000000-0000-0000-0000-000000000000 to assign access without a specific role.
Parameter Type Description assignmentobject The created app role assignment ↳ id string App role assignment ID, used when removing the assignment ↳ appRoleId string ID of the app role. All-zero GUID means the assignment grants access without a specific role. ↳ createdDateTime string When the assignment was created ↳ principalId string ID of the assigned principal ↳ principalDisplayName string Display name of the assigned principal ↳ principalType string Principal type: User, Group, or ServicePrincipal ↳ resourceId string ID of the resource service principal that defines the app role ↳ resourceDisplayName string Display name of the resource
Revoke an application role assignment from a user, removing their access to that application. Takes the assignment's own ID, not the app role ID.
Parameter Type Required Description userIdstring Yes User ID or user principal name the assignment belongs to appRoleAssignmentIdstring Yes ID of the app role assignment to remove, taken from the "id" field of List User App Role Assignments
Parameter Type Description removedboolean Whether the assignment was removed successfully userIdstring ID of the user the assignment belonged to appRoleAssignmentIdstring ID of the removed app role assignment
List the enterprise applications and service principals in the tenant, including the app roles each one exposes
Parameter Type Required Description topnumber No Maximum number of service principals to return (default and maximum page size is 100) filterstring No OData filter expression. Example: "servicePrincipalType eq 'Application'" or "startsWith(displayName, 'Salesforce')". searchstring No Search string matched against the service principal display name nextLinkstring No Continuation URL from a previous response's 'nextLink' output, used to fetch the next page of results
Parameter Type Description servicePrincipalsarray Service principals in the tenant ↳ id string Service principal object ID, used as the resource ID of an app role assignment ↳ appId string Application ID associated with the service principal ↳ displayName string Display name of the service principal ↳ servicePrincipalType string Type of service principal (e.g., Application, ManagedIdentity, Legacy) ↳ accountEnabled boolean Whether users can sign in to the associated application ↳ appOwnerOrganizationId string Tenant ID where the application is registered ↳ signInAudience string Which Microsoft accounts are supported by the associated application ↳ tags array Custom strings used to categorize the service principal ↳ appRoles array App roles exposed by the associated application ↳ id string App role ID, used when granting an app role assignment ↳ displayName string Display name of the app role ↳ description string Description of the app role ↳ value string Value included in the roles claim for this app role ↳ isEnabled boolean Whether the app role can be assigned ↳ allowedMemberTypes array Principal types the app role can be assigned to (User and/or Application) servicePrincipalCountnumber Number of service principals returned nextLinkstring Continuation URL for the next page of results, or null if there are no more
List every user, group, and service principal assigned to an application, by reading the app role assignments on its service principal. Recently granted or removed assignments can take time to appear.
Parameter Type Required Description servicePrincipalIdstring No Object ID of the service principal. Use List Service Principals to find it. Not needed when Next Page is provided to fetch a later page. filterstring No OData filter expression supporting eq and startswith. Example: "principalType eq 'User'". nextLinkstring No Continuation URL from a previous response's 'nextLink' output, used to fetch the next page of results
Parameter Type Description assignmentsarray Principals assigned to the application ↳ id string App role assignment ID, used when removing the assignment ↳ appRoleId string ID of the app role. All-zero GUID means the assignment grants access without a specific role. ↳ createdDateTime string When the assignment was created ↳ principalId string ID of the assigned principal ↳ principalDisplayName string Display name of the assigned principal ↳ principalType string Principal type: User, Group, or ServicePrincipal ↳ resourceId string ID of the resource service principal that defines the app role ↳ resourceDisplayName string Display name of the resource assignmentCountnumber Number of assignments returned nextLinkstring Continuation URL for the next page of results, or null if there are no more
List the administrator roles that are activated in the tenant, such as Global Administrator and User Administrator. Roles that have never been activated are not returned.
Parameter Type Required Description
Parameter Type Description rolesarray Activated directory roles ↳ id string Directory role object ID ↳ displayName string Display name of the directory role ↳ description string Description of the directory role ↳ roleTemplateId string ID of the directory role template roleCountnumber Number of directory roles returned
List the principals holding an administrator role. Returns up to 1000 members; this endpoint does not support paging.
Parameter Type Required Description directoryRoleIdstring Yes Object ID of the directory role. Use List Directory Roles to find it.
Parameter Type Description membersarray Principals holding the directory role ↳ id string Member ID ↳ displayName string Display name ↳ mail string Email address ↳ odataType string Directory object type memberCountnumber Number of members returned
Grant a user an administrator role in Microsoft Entra ID. This is a privileged change that expands what the user can do across the tenant.
Parameter Type Required Description directoryRoleIdstring Yes Object ID of the directory role. Use List Directory Roles to find it. memberIdstring Yes Object ID of the user to grant the role to
Parameter Type Description addedboolean Whether the member was added successfully directoryRoleIdstring ID of the directory role memberIdstring ID of the member that was added
Revoke an administrator role from a user in Microsoft Entra ID. Removes only the role membership; the user account itself is not deleted.
Parameter Type Required Description directoryRoleIdstring Yes Object ID of the directory role. Use List Directory Roles to find it. memberIdstring Yes Object ID of the user to remove the role from
Parameter Type Description removedboolean Whether the member was removed successfully directoryRoleIdstring ID of the directory role memberIdstring ID of the member that was removed
List the devices registered in Microsoft Entra ID
Parameter Type Required Description topnumber No Maximum number of devices to return filterstring No OData filter expression. Example: "accountEnabled eq false" or "operatingSystem eq 'Windows'". searchstring No Search string matched against the device display name nextLinkstring No Continuation URL from a previous response's 'nextLink' output, used to fetch the next page of results
Parameter Type Description devicesarray Registered devices ↳ id string Device object ID, used to get, update, or delete the device ↳ deviceId string Unique device identifier set during registration ↳ displayName string Display name of the device ↳ operatingSystem string Operating system of the device ↳ operatingSystemVersion string Operating system version of the device ↳ accountEnabled boolean Whether the device is enabled ↳ isCompliant boolean Whether the device complies with MDM policies ↳ isManaged boolean Whether the device is managed by an MDM app ↳ trustType string Device registration type: Workplace, AzureAd, or ServerAd ↳ profileType string Device profile type: RegisteredDevice, SecureVM, Printer, Shared, or IoT ↳ manufacturer string Manufacturer of the device ↳ model string Model of the device ↳ approximateLastSignInDateTime string Approximate time the device last signed in ↳ registrationDateTime string When the device was registered deviceCountnumber Number of devices returned nextLinkstring Continuation URL for the next page of results, or null if there are no more
Get a registered device by its object ID from Microsoft Entra ID
Parameter Type Required Description deviceObjectIdstring Yes Device object ID (the "id" field), not the "deviceId" registration identifier
Parameter Type Description deviceobject Device details ↳ id string Device object ID, used to get, update, or delete the device ↳ deviceId string Unique device identifier set during registration ↳ displayName string Display name of the device ↳ operatingSystem string Operating system of the device ↳ operatingSystemVersion string Operating system version of the device ↳ accountEnabled boolean Whether the device is enabled ↳ isCompliant boolean Whether the device complies with MDM policies ↳ isManaged boolean Whether the device is managed by an MDM app ↳ trustType string Device registration type: Workplace, AzureAd, or ServerAd ↳ profileType string Device profile type: RegisteredDevice, SecureVM, Printer, Shared, or IoT ↳ manufacturer string Manufacturer of the device ↳ model string Model of the device ↳ approximateLastSignInDateTime string Approximate time the device last signed in ↳ registrationDateTime string When the device was registered
List the devices a user has registered or owns. Devices the caller cannot read are returned with only their ID and the remaining fields null.
Parameter Type Required Description userIdstring No User ID or user principal name. Not needed when Next Page is provided to fetch a later page. deviceRelationshipstring No Which devices to list: "registered" for devices the user registered, or "owned" for devices the user owns. Defaults to "registered". topnumber No Maximum number of devices to return nextLinkstring No Continuation URL from a previous response's 'nextLink' output, used to fetch the next page of results
Parameter Type Description devicesarray Devices linked to the user ↳ id string Device object ID, used to get, update, or delete the device ↳ deviceId string Unique device identifier set during registration ↳ displayName string Display name of the device ↳ operatingSystem string Operating system of the device ↳ operatingSystemVersion string Operating system version of the device ↳ accountEnabled boolean Whether the device is enabled ↳ isCompliant boolean Whether the device complies with MDM policies ↳ isManaged boolean Whether the device is managed by an MDM app ↳ trustType string Device registration type: Workplace, AzureAd, or ServerAd ↳ profileType string Device profile type: RegisteredDevice, SecureVM, Printer, Shared, or IoT ↳ manufacturer string Manufacturer of the device ↳ model string Model of the device ↳ approximateLastSignInDateTime string Approximate time the device last signed in ↳ registrationDateTime string When the device was registered deviceCountnumber Number of devices returned nextLinkstring Continuation URL for the next page of results, or null if there are no more
List the conditional access policies configured in the tenant, including their state and the conditions and controls they enforce. Read-only.
Parameter Type Required Description topnumber No Maximum number of policies to return filterstring No OData filter expression. Example: "state eq 'enabled'". nextLinkstring No Continuation URL from a previous response's 'nextLink' output, used to fetch the next page of results
Parameter Type Description policiesarray Conditional access policies ↳ id string Conditional access policy ID ↳ displayName string Display name of the policy ↳ state string Policy state: enabled, disabled, or enabledForReportingButNotEnforced ↳ templateId string ID of the template the policy was created from ↳ createdDateTime string When the policy was created ↳ modifiedDateTime string When the policy was last modified ↳ conditions json Conditions that trigger the policy (users, applications, platforms, locations, risk levels) ↳ grantControls json Controls enforced when the policy applies, or null when none are configured ↳ sessionControls json Session controls enforced when the policy applies, or null when none are set policyCountnumber Number of policies returned nextLinkstring Continuation URL for the next page of results, or null if there are no more
Get a single conditional access policy by ID, including the conditions it matches and the controls it enforces. Read-only.
Parameter Type Required Description policyIdstring Yes Conditional access policy ID
Parameter Type Description policyobject Conditional access policy details ↳ id string Conditional access policy ID ↳ displayName string Display name of the policy ↳ state string Policy state: enabled, disabled, or enabledForReportingButNotEnforced ↳ templateId string ID of the template the policy was created from ↳ createdDateTime string When the policy was created ↳ modifiedDateTime string When the policy was last modified ↳ conditions json Conditions that trigger the policy (users, applications, platforms, locations, risk levels) ↳ grantControls json Controls enforced when the policy applies, or null when none are configured ↳ sessionControls json Session controls enforced when the policy applies, or null when none are set