Microsoft Entra ID Tools

Microsoft Entra ID (formerly Azure AD) is Microsoft's cloud identity and access management service. These tools manage directory users and groups through the Microsoft Graph API, letting a workflow list and look up users, list groups, and provision new user accounts. Use them when you need to read or automate identity/directory operations as part of an agent or integration flow.

Overview

Operations

Configuration

microsoft_ad_list_users

List users in Microsoft Entra ID. Calls GET https://graph.microsoft.com/v1.0/users (supports the OData $top and $filter query parameters).

microsoft_ad_get_user

Get a single user by ID or user principal name. Calls GET https://graph.microsoft.com/v1.0/users/{userId}.

microsoft_ad_list_groups

List groups in Microsoft Entra ID. Calls GET https://graph.microsoft.com/v1.0/groups (supports the OData $top and $filter query parameters).

microsoft_ad_create_user

Create a new user. Calls POST https://graph.microsoft.com/v1.0/users. The new user is created with forceChangePasswordNextSignIn: true, so the initial password must be changed at first sign-in.

Outputs

microsoft_ad_list_users

• data (json) — Array of Entra user objects returned by Microsoft Graph (the value array).
• metadata (json) — List metadata.
  • metadata.count (number) — Number of users returned.

microsoft_ad_get_user

• data (json) — The Entra user object.
• metadata (json) — User identifiers.
  • metadata.id (string) — User ID.

microsoft_ad_list_groups

• data (json) — Array of Entra group objects returned by Microsoft Graph (the value array).
• metadata (json) — List metadata.
  • metadata.count (number) — Number of groups returned.

microsoft_ad_create_user

• data (json) — The created Entra user object.
• metadata (json) — User identifiers.
  • metadata.id (string) — User ID of the newly created user.

YAML Example

microsoft_ad_1:
  type: microsoft_ad
  name: "Microsoft Entra ID"
  inputs:
    operation: "microsoft_ad_list_users"
    top: 100
    filter: "department eq 'Sales'"
    accessToken: "{{MICROSOFT_AD_ACCESS_TOKEN}}"
  connections:
    outgoing:
      - target: next-block-id

Tips

• Authentication is a raw Microsoft Graph bearer access token, passed via the accessToken field (sent as the Authorization: Bearer <token> header). Obtain it from an Entra app registration with the appropriate Graph permissions — User.Read.All / Group.Read.All for the read operations and User.ReadWrite.All for microsoft_ad_create_user — and reference it as an environment variable like {{MICROSOFT_AD_ACCESS_TOKEN}} rather than hardcoding it.
• The top and filter inputs map directly to the Microsoft Graph OData $top and $filter query parameters. Some filters (e.g., on group properties) may require advanced query support; keep top at or below 999.
• Created users come back with forceChangePasswordNextSignIn set to true, so the password you supply is only a temporary first-sign-in credential. Capture {{microsoft_ad_1.metadata.id}} from the create response to drive follow-up directory operations.