Microsoft Entra ID

Manage your Microsoft Entra ID (Azure AD) directory from a workflow: onboard people with a sign-in name and initial password, keep their profile and manager current, block their sign-in or sign them out everywhere when they leave, and manage the security groups that grant access. Deleted users and groups can be restored for 30 days.

Actions

Action	What it does
Add a group member	Add a user, or nest a group, in a group.
Create a group	Create a security group, for granting access to apps and resources, optionally with its owners and first members.
Create a user	Add a person to your directory with a sign-in name and an initial password they must change the first time they sign in.
Delete a group	Delete a group.
Delete a user	Delete a user.
Get a group	Look up one group's name, description and type.
Get a user	Look up one user's profile and account status.
List a user's groups and roles	The groups, admin roles and administrative units a user belongs to directly (not through a nested group).
List app registrations	The apps registered in your directory, with their client IDs.
List deleted users or groups	Users or groups deleted in the last 30 days, which can still be restored.
List group members	The users, groups and devices directly in a group.
List groups	List the groups in your directory, optionally by name or type.
List users	List the people in your directory, optionally filtered by name, by whether they can sign in, or to members or guests.
Remove a group member	Take a user or nested group out of a group.
Remove a user's manager	Clear who a user reports to.
Restore a deleted user or group	Bring back a user or group deleted in the last 30 days, with its memberships.
Set a user's manager	Set who a user reports to, replacing any current manager.
Sign a user out everywhere	Revoke a user's sign-in sessions and refresh tokens, so every app and device has to sign in again.
Update a group	Rename a group or change its description.
Update a user	Change a user's profile, block or allow their sign-in, or rename their sign-in name.

Add a group member

Add a user, or nest a group, in a group. Adding someone who is already a member succeeds and says so.

Inputs

Group IDgrouptextRequired: The group's object ID, shown on its Overview page or returned by a List groups step. A link to the group copied from the Entra admin center also works.
MembermembertextRequired: A user's sign-in name or object ID, or a group's object ID to nest that group (security groups only).

Outputs

addedtrue/false
already_membertrue/false
group_idtext
member_idtext

Example output

{
  "added": true,
  "already_member": false,
  "group_id": "02bd9fd6-8f93-4758-87c3-1fb73740a315",
  "member_id": "87d349ed-44d7-43e1-9a83-5f2406dee5bd"
}

Create a group

Create a security group, for granting access to apps and resources, optionally with its owners and first members.

Inputs

Namedisplay_nametextRequired: The group's name, up to 256 characters.
Descriptiondescriptiontext: What the group is for.
Mail aliasmail_nicknametext: Defaults to the name with spaces replaced by hyphens.
Ownersownerslist: Sign-in names or object IDs of users who own the group.
Membersmemberslist: Sign-in names or object IDs of users, or object IDs of groups, to add.

Outputs

created_date_timetext
descriptiontext
display_nametext
group_typetext
group_typeslist
idtext
is_assignable_to_roletrue/false
mailtext
mail_enabledtrue/false
mail_nicknametext
membership_ruletext
security_enabledtrue/false
visibilitytext

Example output

{
  "created_date_time": "2026-09-21T09:00:00Z",
  "description": "Everyone in Retail",
  "display_name": "Retail team",
  "group_type": "security",
  "group_types": [],
  "id": "02bd9fd6-8f93-4758-87c3-1fb73740a315",
  "is_assignable_to_role": null,
  "mail": null,
  "mail_enabled": false,
  "mail_nickname": "retail-team",
  "membership_rule": null,
  "security_enabled": true,
  "visibility": null
}

Create a user

Add a person to your directory with a sign-in name and an initial password they must change the first time they sign in. Leave the password blank to have one generated; it is returned once, in this step's result.

Inputs

Display namedisplay_nametextRequired: The name shown for the user, such as Adele Vance.
Sign-in nameuser_principal_nametextRequired: What the user signs in with. Enter just the part before @ (such as adele.vance) and pick the domain below, or type the whole name@domain.
Domaindomaintext: One of your tenant's verified domains. Leave blank to use the default domain.
Initial passwordpasswordtext: At least 8 characters with three of: upper case, lower case, digits, symbols. Leave blank to generate one.
Must change password at first sign-inforce_change_passwordtrue/false: Recommended. On by default.Default: true.
Can sign inaccount_enabledtrue/false: Turn off to create the account blocked from signing in.Default: true.
Mail aliasmail_nicknametext: Defaults to the part of the sign-in name before @. No spaces or @ ( ) \ [ ] " ; : < > ,
First namegiven_nametext: The user's first name.
Last namesurnametext: The user's last name.
Job titlejob_titletext: The user's job title.
Departmentdepartmenttext: The department the user works in.
Officeoffice_locationtext: The user's office location.
Companycompany_nametext: Company name, at most 64 characters.
Employee IDemployee_idtext: Your HR id for the user, at most 16 characters.
Employee typeemployee_typetext: For example Employee or Contractor.
Usage locationusage_locationtext: Two-letter country code (such as US or GB). Required before the user can be assigned a licence.
Street addressstreet_addresstext: Street address of the user's workplace.
Citycitytext: The city the user works in.
State or provincestatetext: The state or province the user works in.
Postal codepostal_codetext: Postal code of the user's workplace.
Countrycountrytext: The country the user works in, such as United States.
Preferred languagepreferred_languagetext: Language code such as en-US or fr-FR.
Password policiespassword_policiestext: Exceptions to the tenant's password rules for this user.One or more of: DisablePasswordExpiration (Password never expires), DisableStrongPassword (Allow weaker passwords).

Outputs

account_enabledtrue/false
business_phoneslist
citytext
company_nametext
countrytext
created_date_timetext
departmenttext
display_nametext
employee_idtext
given_nametext
idtext
initial_passwordtext
job_titletext
mailtext
mail_nicknametext
mobile_phonetext
office_locationtext
preferred_languagetext
surnametext
usage_locationtext
user_principal_nametext
user_typetext

Example output

{
  "account_enabled": true,
  "business_phones": [
    "+1 425 555 0109"
  ],
  "city": "Seattle",
  "company_name": "Contoso",
  "country": "United States",
  "created_date_time": "2026-09-21T09:00:00Z",
  "department": "Retail",
  "display_name": "Adele Vance",
  "employee_id": "E1042",
  "given_name": "Adele",
  "id": "87d349ed-44d7-43e1-9a83-5f2406dee5bd",
  "initial_password": null,
  "job_title": "Retail Manager",
  "mail": "AdeleV@contoso.onmicrosoft.com",
  "mail_nickname": "AdeleV",
  "mobile_phone": null,
  "office_location": "18/2111",
  "preferred_language": "en-US",
  "surname": "Vance",
  "usage_location": "US",
  "user_principal_name": "AdeleV@contoso.onmicrosoft.com",
  "user_type": "Member"
}

Delete a group

Delete a group. It can be restored for 30 days with 'Restore a deleted user or group'.

Inputs

Group IDgrouptextRequired: The group's object ID, shown on its Overview page or returned by a List groups step. A link to the group copied from the Entra admin center also works.

Outputs

deletedtrue/false
group_idtext

Example output

{
  "deleted": true,
  "group_id": "02bd9fd6-8f93-4758-87c3-1fb73740a315"
}

Delete a user

Delete a user. They can be restored, with their group memberships, for 30 days with 'Restore a deleted user or group'.

Inputs

UserusertextRequired: The user's sign-in name (name@yourdomain.com) or object ID. A link to the user copied from the Entra admin center also works.

Outputs

deletedtrue/false
usertext

Example output

{
  "deleted": true,
  "user": "adele@contoso.onmicrosoft.com"
}

Get a group

Look up one group's name, description and type.

Inputs

Group IDgrouptextRequired: The group's object ID, shown on its Overview page or returned by a List groups step. A link to the group copied from the Entra admin center also works.

Outputs

created_date_timetext
descriptiontext
display_nametext
group_typetext
group_typeslist
idtext
is_assignable_to_roletrue/false
mailtext
mail_enabledtrue/false
mail_nicknametext
membership_ruletext
security_enabledtrue/false
visibilitytext

Example output

{
  "created_date_time": "2026-09-21T09:00:00Z",
  "description": "Everyone in Retail",
  "display_name": "Retail team",
  "group_type": "security",
  "group_types": [],
  "id": "02bd9fd6-8f93-4758-87c3-1fb73740a315",
  "is_assignable_to_role": null,
  "mail": null,
  "mail_enabled": false,
  "mail_nickname": "retail-team",
  "membership_rule": null,
  "security_enabled": true,
  "visibility": null
}

Get a user

Look up one user's profile and account status.

Inputs

UserusertextRequired: The user's sign-in name (name@yourdomain.com) or object ID. A link to the user copied from the Entra admin center also works.

Outputs

account_enabledtrue/false
business_phoneslist
citytext
company_nametext
countrytext
created_date_timetext
departmenttext
display_nametext
employee_idtext
given_nametext
idtext
job_titletext
mailtext
mail_nicknametext
mobile_phonetext
office_locationtext
preferred_languagetext
surnametext
usage_locationtext
user_principal_nametext
user_typetext

Example output

{
  "account_enabled": true,
  "business_phones": [
    "+1 425 555 0109"
  ],
  "city": "Seattle",
  "company_name": "Contoso",
  "country": "United States",
  "created_date_time": "2026-09-21T09:00:00Z",
  "department": "Retail",
  "display_name": "Adele Vance",
  "employee_id": "E1042",
  "given_name": "Adele",
  "id": "87d349ed-44d7-43e1-9a83-5f2406dee5bd",
  "job_title": "Retail Manager",
  "mail": "AdeleV@contoso.onmicrosoft.com",
  "mail_nickname": "AdeleV",
  "mobile_phone": null,
  "office_location": "18/2111",
  "preferred_language": "en-US",
  "surname": "Vance",
  "usage_location": "US",
  "user_principal_name": "AdeleV@contoso.onmicrosoft.com",
  "user_type": "Member"
}

List a user's groups and roles

The groups, admin roles and administrative units a user belongs to directly (not through a nested group).

Inputs

UserusertextRequired: The user's sign-in name (name@yourdomain.com) or object ID. A link to the user copied from the Entra admin center also works.
Groups onlygroups_onlytrue/false: Leave out admin roles and administrative units.Default: false.
Maximum resultsmax_resultsnumber: How many to return at most. Defaults to 100 if left blank.From 1 to 999.

Outputs

countnumber
has_moretrue/false
itemslist

Example output

{
  "count": 1,
  "has_more": false,
  "items": [
    {
      "deleted_date_time": null,
      "description": "Everyone in Retail",
      "display_name": "Retail team",
      "group_types": [],
      "id": "02bd9fd6-8f93-4758-87c3-1fb73740a315",
      "job_title": null,
      "mail": null,
      "type": "group",
      "user_principal_name": null
    }
  ]
}

List app registrations

The apps registered in your directory, with their client IDs.

Inputs

Name containssearchtext: Only those with a word in their display name starting with this.
Maximum resultsmax_resultsnumber: How many to return at most. Defaults to 100 if left blank.From 1 to 999.

Outputs

countnumber
has_moretrue/false
itemslist

Example output

{
  "count": 1,
  "has_more": false,
  "items": [
    {
      "app_id": "00001111-aaaa-2222-bbbb-3333cccc4444",
      "created_date_time": "2026-09-21T08:00:00Z",
      "description": null,
      "display_name": "Lodol",
      "id": "acc848e9-e8ec-4feb-a521-8d58b5482e09",
      "notes": null,
      "publisher_domain": "contoso.onmicrosoft.com",
      "sign_in_audience": "AzureADMyOrg",
      "tags": [],
      "type": "application"
    }
  ]
}

List deleted users or groups

Users or groups deleted in the last 30 days, which can still be restored.

Inputs

Showobject_typetextRequired: Deleted users, or deleted groups.One of: user (Users), group (Groups). Default: user.
Maximum resultsmax_resultsnumber: How many to return at most. Defaults to 100 if left blank.From 1 to 999.

Outputs

countnumber
has_moretrue/false
itemslist

Example output

{
  "count": 1,
  "has_more": false,
  "items": [
    {
      "deleted_date_time": "2026-09-21T10:00:00Z",
      "description": null,
      "display_name": "Adele Vance",
      "group_types": null,
      "id": "87d349ed-44d7-43e1-9a83-5f2406dee5bd",
      "job_title": "Retail Manager",
      "mail": "AdeleV@contoso.onmicrosoft.com",
      "type": "user",
      "user_principal_name": "AdeleV@contoso.onmicrosoft.com"
    }
  ]
}

List group members

The users, groups and devices directly in a group.

Inputs

Group IDgrouptextRequired: The group's object ID, shown on its Overview page or returned by a List groups step. A link to the group copied from the Entra admin center also works.
Users onlyusers_onlytrue/false: Leave out nested groups, devices and apps.Default: false.
Maximum resultsmax_resultsnumber: How many to return at most. Defaults to 100 if left blank.From 1 to 999.

Outputs

countnumber
has_moretrue/false
itemslist

Example output

{
  "count": 1,
  "has_more": false,
  "items": [
    {
      "deleted_date_time": null,
      "description": null,
      "display_name": "Adele Vance",
      "group_types": null,
      "id": "87d349ed-44d7-43e1-9a83-5f2406dee5bd",
      "job_title": "Retail Manager",
      "mail": "AdeleV@contoso.onmicrosoft.com",
      "type": "user",
      "user_principal_name": "AdeleV@contoso.onmicrosoft.com"
    }
  ]
}

List groups

List the groups in your directory, optionally by name or type.

Inputs

Name containssearchtext: Only those with a word in their display name starting with this.
Group typegroup_typetext: Only security groups, or only Microsoft 365 groups.One of: security (Security groups), microsoft_365 (Microsoft 365 groups).
Maximum resultsmax_resultsnumber: How many to return at most. Defaults to 100 if left blank.From 1 to 999.

Outputs

countnumber
has_moretrue/false
itemslist

Example output

{
  "count": 1,
  "has_more": false,
  "items": [
    {
      "created_date_time": "2026-09-21T09:00:00Z",
      "description": "Everyone in Retail",
      "display_name": "Retail team",
      "group_type": "security",
      "group_types": [],
      "id": "02bd9fd6-8f93-4758-87c3-1fb73740a315",
      "is_assignable_to_role": null,
      "mail": null,
      "mail_enabled": false,
      "mail_nickname": "retail-team",
      "membership_rule": null,
      "security_enabled": true,
      "visibility": null
    }
  ]
}

List users

List the people in your directory, optionally filtered by name, by whether they can sign in, or to members or guests.

Inputs

Name containssearchtext: Only those with a word in their display name starting with this.
Sign-inaccount_statustext: Only users who can, or cannot, sign in.One of: enabled (Enabled (can sign in)), disabled (Disabled (blocked from signing in)).
User typeuser_typetext: Only members of your organization, or only guests.One of: Member, Guest.
Advanced filterfilter_querytext: An OData $filter expression, combined with the choices above. For example: department eq 'Sales'.
Maximum resultsmax_resultsnumber: How many to return at most. Defaults to 100 if left blank.From 1 to 999.

Outputs

countnumber
has_moretrue/false
itemslist

Example output

{
  "count": 1,
  "has_more": false,
  "items": [
    {
      "account_enabled": true,
      "business_phones": [
        "+1 425 555 0109"
      ],
      "city": "Seattle",
      "company_name": "Contoso",
      "country": "United States",
      "created_date_time": "2026-09-21T09:00:00Z",
      "department": "Retail",
      "display_name": "Adele Vance",
      "employee_id": "E1042",
      "given_name": "Adele",
      "id": "87d349ed-44d7-43e1-9a83-5f2406dee5bd",
      "job_title": "Retail Manager",
      "mail": "AdeleV@contoso.onmicrosoft.com",
      "mail_nickname": "AdeleV",
      "mobile_phone": null,
      "office_location": "18/2111",
      "preferred_language": "en-US",
      "surname": "Vance",
      "usage_location": "US",
      "user_principal_name": "AdeleV@contoso.onmicrosoft.com",
      "user_type": "Member"
    }
  ]
}

Remove a group member

Take a user or nested group out of a group. Nothing is deleted.

Inputs

Group IDgrouptextRequired: The group's object ID, shown on its Overview page or returned by a List groups step. A link to the group copied from the Entra admin center also works.
MembermembertextRequired: A user's sign-in name or object ID, or a group's object ID to nest that group (security groups only).

Outputs

group_idtext
member_idtext
removedtrue/false

Example output

{
  "group_id": "02bd9fd6-8f93-4758-87c3-1fb73740a315",
  "member_id": "87d349ed-44d7-43e1-9a83-5f2406dee5bd",
  "removed": true
}

Remove a user's manager

Clear who a user reports to.

Inputs

UserusertextRequired: The user's sign-in name (name@yourdomain.com) or object ID. A link to the user copied from the Entra admin center also works.

Outputs

removedtrue/false
usertext

Example output

{
  "removed": true,
  "user": "adele@contoso.onmicrosoft.com"
}

Restore a deleted user or group

Bring back a user or group deleted in the last 30 days, with its memberships.

Inputs

Deleted item IDitem_idtextRequired: The object ID of the deleted user or group, from a List deleted users or groups step.
New sign-in namenew_user_principal_nametext: Users only: restore under this name@domain instead, if the old one has been taken.
Drop conflicting email addressesauto_reconcile_proxy_conflicttrue/false: Users only: remove any of the user's email addresses now used by someone else, instead of failing.Default: false.

Outputs

deleted_date_timetext
descriptiontext
display_nametext
group_typeslist
idtext
job_titletext
mailtext
restoredtrue/false
typetext
user_principal_nametext

Example output

{
  "deleted_date_time": null,
  "description": null,
  "display_name": "Adele Vance",
  "group_types": null,
  "id": "87d349ed-44d7-43e1-9a83-5f2406dee5bd",
  "job_title": "Retail Manager",
  "mail": "AdeleV@contoso.onmicrosoft.com",
  "restored": true,
  "type": "user",
  "user_principal_name": "AdeleV@contoso.onmicrosoft.com"
}

Set a user's manager

Set who a user reports to, replacing any current manager.

Inputs

UserusertextRequired: The user's sign-in name (name@yourdomain.com) or object ID. A link to the user copied from the Entra admin center also works.
ManagermanagertextRequired: The manager's sign-in name or object ID.

Outputs

manager_idtext
updatedtrue/false
usertext

Example output

{
  "manager_id": "5bde3e51-d13b-4db1-9948-fe4b109d11a7",
  "updated": true,
  "user": "adele@contoso.onmicrosoft.com"
}

Sign a user out everywhere

Revoke a user's sign-in sessions and refresh tokens, so every app and device has to sign in again. Use it when an account may be compromised or someone leaves. It can take a few minutes to reach every app.

Inputs

UserusertextRequired: The user's sign-in name (name@yourdomain.com) or object ID. A link to the user copied from the Entra admin center also works.

Outputs

revokedtrue/false
usertext

Example output

{
  "revoked": true,
  "user": "adele@contoso.onmicrosoft.com"
}

Update a group

Rename a group or change its description. Only the fields you fill in change.

Inputs

Group IDgrouptextRequired: The group's object ID, shown on its Overview page or returned by a List groups step. A link to the group copied from the Entra admin center also works.
Namedisplay_nametext: The group's new name.
Descriptiondescriptiontext: The group's new description.
Mail aliasmail_nicknametext: The group's new mail alias.
Visibilityvisibilitytext: Microsoft 365 groups only.One of: Private, Public.

Outputs

group_idtext
updatedtrue/false
updated_fieldslist

Example output

{
  "group_id": "02bd9fd6-8f93-4758-87c3-1fb73740a315",
  "updated": true,
  "updated_fields": [
    "description"
  ]
}

Update a user

Change a user's profile, block or allow their sign-in, or rename their sign-in name. Only the fields you fill in change. Accounts that hold an admin role can only be changed by an app that has been given a higher Entra role itself.

Inputs

UserusertextRequired: The user's sign-in name (name@yourdomain.com) or object ID. A link to the user copied from the Entra admin center also works.
Display namedisplay_nametext: The name shown for the user.
Sign-inaccount_statustext: Enable or block this user's sign-in. Leave unselected to keep it as it is.One of: enabled (Enabled (can sign in)), disabled (Disabled (blocked from signing in)).
First namegiven_nametext: The user's first name.
Last namesurnametext: The user's last name.
Job titlejob_titletext: The user's job title.
Departmentdepartmenttext: The department the user works in.
Officeoffice_locationtext: The user's office location.
Companycompany_nametext: Company name, at most 64 characters.
Employee IDemployee_idtext: Your HR id for the user, at most 16 characters.
Employee typeemployee_typetext: For example Employee or Contractor.
Usage locationusage_locationtext: Two-letter country code (such as US or GB). Required before the user can be assigned a licence.
Street addressstreet_addresstext: Street address of the user's workplace.
Citycitytext: The city the user works in.
State or provincestatetext: The state or province the user works in.
Postal codepostal_codetext: Postal code of the user's workplace.
Countrycountrytext: The country the user works in, such as United States.
Preferred languagepreferred_languagetext: Language code such as en-US or fr-FR.
User typeuser_typetext: Make the user a member of your organization or a guest.One of: Member, Guest.
Mail aliasmail_nicknametext: The user's mail alias.
New sign-in nameuser_principal_nametext: The whole new name@domain; the domain must be verified.

Outputs

updatedtrue/false
updated_fieldslist
usertext

Example output

{
  "updated": true,
  "updated_fields": [
    "jobTitle"
  ],
  "user": "adele@contoso.onmicrosoft.com"
}

ActionsCopy Anchor Link

Add a group memberCopy Anchor Link

Inputs

Outputs

Create a groupCopy Anchor Link

Inputs

Outputs

Create a userCopy Anchor Link

Inputs

Outputs

Delete a groupCopy Anchor Link

Inputs

Outputs

Delete a userCopy Anchor Link

Inputs

Outputs

Get a groupCopy Anchor Link

Inputs

Outputs

Get a userCopy Anchor Link

Inputs

Outputs

List a user's groups and rolesCopy Anchor Link

Inputs

Outputs

List app registrationsCopy Anchor Link

Inputs

Outputs

List deleted users or groupsCopy Anchor Link

Inputs

Outputs

List group membersCopy Anchor Link

Inputs

Outputs

List groupsCopy Anchor Link

Inputs

Outputs

List usersCopy Anchor Link

Inputs

Outputs

Remove a group memberCopy Anchor Link

Inputs

Outputs

Remove a user's managerCopy Anchor Link

Inputs

Outputs

Restore a deleted user or groupCopy Anchor Link

Inputs

Outputs

Set a user's managerCopy Anchor Link

Inputs

Outputs

Sign a user out everywhereCopy Anchor Link

Inputs

Outputs

Update a groupCopy Anchor Link

Inputs

Outputs

Update a userCopy Anchor Link

Inputs

Outputs

On this page

Actions

Add a group member

Create a group

Create a user

Delete a group

Delete a user

Get a group

Get a user

List a user's groups and roles

List app registrations

List deleted users or groups

List group members

List groups

List users

Remove a group member

Remove a user's manager

Restore a deleted user or group

Set a user's manager

Sign a user out everywhere

Update a group

Update a user