# Microsoft Entra ID

> Manage your Microsoft Entra ID (Azure AD) directory from a workflow: onboard people with a sign-in name and initial password, keep their profile and manager current, block their sign-in or sign them out everywhere when they leave, and manage the security groups that grant access. Deleted users and groups can be restored for 30 days.

App · Compliance & Security · 20 actions. Web page: https://docs.lodol.com/docs/integrations/microsoft-entra-id

## Actions

### Add a group member

Add a user, or nest a group, in a group. Adding someone who is already a member succeeds and says so.

**Inputs**

- Group ID (`group`, text, required): The group's object ID, shown on its Overview page or returned by a List groups step. A link to the group copied from the Entra admin center also works.
- Member (`member`, text, required): A user's sign-in name or object ID, or a group's object ID to nest that group (security groups only).

**Outputs**

- `added` (true/false)
- `already_member` (true/false)
- `group_id` (text)
- `member_id` (text)

**Example output**

```json
{
  "added": true,
  "already_member": false,
  "group_id": "02bd9fd6-8f93-4758-87c3-1fb73740a315",
  "member_id": "87d349ed-44d7-43e1-9a83-5f2406dee5bd"
}
```

### Create a group

Create a security group, for granting access to apps and resources, optionally with its owners and first members.

**Inputs**

- Name (`display_name`, text, required): The group's name, up to 256 characters.
- Description (`description`, text): What the group is for.
- Mail alias (`mail_nickname`, text): Defaults to the name with spaces replaced by hyphens.
- Owners (`owners`, list): Sign-in names or object IDs of users who own the group.
- Members (`members`, list): Sign-in names or object IDs of users, or object IDs of groups, to add.

**Outputs**

- `created_date_time` (text)
- `description` (text)
- `display_name` (text)
- `group_type` (text)
- `group_types` (list)
- `id` (text)
- `is_assignable_to_role` (true/false)
- `mail` (text)
- `mail_enabled` (true/false)
- `mail_nickname` (text)
- `membership_rule` (text)
- `security_enabled` (true/false)
- `visibility` (text)

**Example output**

```json
{
  "created_date_time": "2026-09-21T09:00:00Z",
  "description": "Everyone in Retail",
  "display_name": "Retail team",
  "group_type": "security",
  "group_types": [],
  "id": "02bd9fd6-8f93-4758-87c3-1fb73740a315",
  "is_assignable_to_role": null,
  "mail": null,
  "mail_enabled": false,
  "mail_nickname": "retail-team",
  "membership_rule": null,
  "security_enabled": true,
  "visibility": null
}
```

### Create a user

Add a person to your directory with a sign-in name and an initial password they must change the first time they sign in. Leave the password blank to have one generated; it is returned once, in this step's result.

**Inputs**

- Display name (`display_name`, text, required): The name shown for the user, such as Adele Vance.
- Sign-in name (`user_principal_name`, text, required): What the user signs in with. Enter just the part before @ (such as adele.vance) and pick the domain below, or type the whole name@domain.
- Domain (`domain`, text): One of your tenant's verified domains. Leave blank to use the default domain.
- Initial password (`password`, text): At least 8 characters with three of: upper case, lower case, digits, symbols. Leave blank to generate one.
- Must change password at first sign-in (`force_change_password`, true/false): Recommended. On by default. Default: `true`.
- Can sign in (`account_enabled`, true/false): Turn off to create the account blocked from signing in. Default: `true`.
- Mail alias (`mail_nickname`, text): Defaults to the part of the sign-in name before @. No spaces or @ ( ) \ [ ] " ; : < > ,
- First name (`given_name`, text): The user's first name.
- Last name (`surname`, text): The user's last name.
- Job title (`job_title`, text): The user's job title.
- Department (`department`, text): The department the user works in.
- Office (`office_location`, text): The user's office location.
- Company (`company_name`, text): Company name, at most 64 characters.
- Employee ID (`employee_id`, text): Your HR id for the user, at most 16 characters.
- Employee type (`employee_type`, text): For example Employee or Contractor.
- Usage location (`usage_location`, text): Two-letter country code (such as US or GB). Required before the user can be assigned a licence.
- Street address (`street_address`, text): Street address of the user's workplace.
- City (`city`, text): The city the user works in.
- State or province (`state`, text): The state or province the user works in.
- Postal code (`postal_code`, text): Postal code of the user's workplace.
- Country (`country`, text): The country the user works in, such as United States.
- Preferred language (`preferred_language`, text): Language code such as en-US or fr-FR.
- Password policies (`password_policies`, text): Exceptions to the tenant's password rules for this user. One or more of: `DisablePasswordExpiration` (Password never expires), `DisableStrongPassword` (Allow weaker passwords).

**Outputs**

- `account_enabled` (true/false)
- `business_phones` (list)
- `city` (text)
- `company_name` (text)
- `country` (text)
- `created_date_time` (text)
- `department` (text)
- `display_name` (text)
- `employee_id` (text)
- `given_name` (text)
- `id` (text)
- `initial_password` (text)
- `job_title` (text)
- `mail` (text)
- `mail_nickname` (text)
- `mobile_phone` (text)
- `office_location` (text)
- `preferred_language` (text)
- `surname` (text)
- `usage_location` (text)
- `user_principal_name` (text)
- `user_type` (text)

**Example output**

```json
{
  "account_enabled": true,
  "business_phones": [
    "+1 425 555 0109"
  ],
  "city": "Seattle",
  "company_name": "Contoso",
  "country": "United States",
  "created_date_time": "2026-09-21T09:00:00Z",
  "department": "Retail",
  "display_name": "Adele Vance",
  "employee_id": "E1042",
  "given_name": "Adele",
  "id": "87d349ed-44d7-43e1-9a83-5f2406dee5bd",
  "initial_password": null,
  "job_title": "Retail Manager",
  "mail": "AdeleV@contoso.onmicrosoft.com",
  "mail_nickname": "AdeleV",
  "mobile_phone": null,
  "office_location": "18/2111",
  "preferred_language": "en-US",
  "surname": "Vance",
  "usage_location": "US",
  "user_principal_name": "AdeleV@contoso.onmicrosoft.com",
  "user_type": "Member"
}
```

### Delete a group

Delete a group. It can be restored for 30 days with 'Restore a deleted user or group'.

**Inputs**

- Group ID (`group`, text, required): The group's object ID, shown on its Overview page or returned by a List groups step. A link to the group copied from the Entra admin center also works.

**Outputs**

- `deleted` (true/false)
- `group_id` (text)

**Example output**

```json
{
  "deleted": true,
  "group_id": "02bd9fd6-8f93-4758-87c3-1fb73740a315"
}
```

### Delete a user

Delete a user. They can be restored, with their group memberships, for 30 days with 'Restore a deleted user or group'.

**Inputs**

- User (`user`, text, required): The user's sign-in name (name@yourdomain.com) or object ID. A link to the user copied from the Entra admin center also works.

**Outputs**

- `deleted` (true/false)
- `user` (text)

**Example output**

```json
{
  "deleted": true,
  "user": "adele@contoso.onmicrosoft.com"
}
```

### Get a group

Look up one group's name, description and type.

**Inputs**

- Group ID (`group`, text, required): The group's object ID, shown on its Overview page or returned by a List groups step. A link to the group copied from the Entra admin center also works.

**Outputs**

- `created_date_time` (text)
- `description` (text)
- `display_name` (text)
- `group_type` (text)
- `group_types` (list)
- `id` (text)
- `is_assignable_to_role` (true/false)
- `mail` (text)
- `mail_enabled` (true/false)
- `mail_nickname` (text)
- `membership_rule` (text)
- `security_enabled` (true/false)
- `visibility` (text)

**Example output**

```json
{
  "created_date_time": "2026-09-21T09:00:00Z",
  "description": "Everyone in Retail",
  "display_name": "Retail team",
  "group_type": "security",
  "group_types": [],
  "id": "02bd9fd6-8f93-4758-87c3-1fb73740a315",
  "is_assignable_to_role": null,
  "mail": null,
  "mail_enabled": false,
  "mail_nickname": "retail-team",
  "membership_rule": null,
  "security_enabled": true,
  "visibility": null
}
```

### Get a user

Look up one user's profile and account status.

**Inputs**

- User (`user`, text, required): The user's sign-in name (name@yourdomain.com) or object ID. A link to the user copied from the Entra admin center also works.

**Outputs**

- `account_enabled` (true/false)
- `business_phones` (list)
- `city` (text)
- `company_name` (text)
- `country` (text)
- `created_date_time` (text)
- `department` (text)
- `display_name` (text)
- `employee_id` (text)
- `given_name` (text)
- `id` (text)
- `job_title` (text)
- `mail` (text)
- `mail_nickname` (text)
- `mobile_phone` (text)
- `office_location` (text)
- `preferred_language` (text)
- `surname` (text)
- `usage_location` (text)
- `user_principal_name` (text)
- `user_type` (text)

**Example output**

```json
{
  "account_enabled": true,
  "business_phones": [
    "+1 425 555 0109"
  ],
  "city": "Seattle",
  "company_name": "Contoso",
  "country": "United States",
  "created_date_time": "2026-09-21T09:00:00Z",
  "department": "Retail",
  "display_name": "Adele Vance",
  "employee_id": "E1042",
  "given_name": "Adele",
  "id": "87d349ed-44d7-43e1-9a83-5f2406dee5bd",
  "job_title": "Retail Manager",
  "mail": "AdeleV@contoso.onmicrosoft.com",
  "mail_nickname": "AdeleV",
  "mobile_phone": null,
  "office_location": "18/2111",
  "preferred_language": "en-US",
  "surname": "Vance",
  "usage_location": "US",
  "user_principal_name": "AdeleV@contoso.onmicrosoft.com",
  "user_type": "Member"
}
```

### List a user's groups and roles

The groups, admin roles and administrative units a user belongs to directly (not through a nested group).

**Inputs**

- User (`user`, text, required): The user's sign-in name (name@yourdomain.com) or object ID. A link to the user copied from the Entra admin center also works.
- Groups only (`groups_only`, true/false): Leave out admin roles and administrative units. Default: `false`.
- Maximum results (`max_results`, number): How many to return at most. Defaults to 100 if left blank. From 1 to 999.

**Outputs**

- `count` (number)
- `has_more` (true/false)
- `items` (list)

**Example output**

```json
{
  "count": 1,
  "has_more": false,
  "items": [
    {
      "deleted_date_time": null,
      "description": "Everyone in Retail",
      "display_name": "Retail team",
      "group_types": [],
      "id": "02bd9fd6-8f93-4758-87c3-1fb73740a315",
      "job_title": null,
      "mail": null,
      "type": "group",
      "user_principal_name": null
    }
  ]
}
```

### List app registrations

The apps registered in your directory, with their client IDs.

**Inputs**

- Name contains (`search`, text): Only those with a word in their display name starting with this.
- Maximum results (`max_results`, number): How many to return at most. Defaults to 100 if left blank. From 1 to 999.

**Outputs**

- `count` (number)
- `has_more` (true/false)
- `items` (list)

**Example output**

```json
{
  "count": 1,
  "has_more": false,
  "items": [
    {
      "app_id": "00001111-aaaa-2222-bbbb-3333cccc4444",
      "created_date_time": "2026-09-21T08:00:00Z",
      "description": null,
      "display_name": "Lodol",
      "id": "acc848e9-e8ec-4feb-a521-8d58b5482e09",
      "notes": null,
      "publisher_domain": "contoso.onmicrosoft.com",
      "sign_in_audience": "AzureADMyOrg",
      "tags": [],
      "type": "application"
    }
  ]
}
```

### List deleted users or groups

Users or groups deleted in the last 30 days, which can still be restored.

**Inputs**

- Show (`object_type`, text, required): Deleted users, or deleted groups. One of: `user` (Users), `group` (Groups). Default: `user`.
- Maximum results (`max_results`, number): How many to return at most. Defaults to 100 if left blank. From 1 to 999.

**Outputs**

- `count` (number)
- `has_more` (true/false)
- `items` (list)

**Example output**

```json
{
  "count": 1,
  "has_more": false,
  "items": [
    {
      "deleted_date_time": "2026-09-21T10:00:00Z",
      "description": null,
      "display_name": "Adele Vance",
      "group_types": null,
      "id": "87d349ed-44d7-43e1-9a83-5f2406dee5bd",
      "job_title": "Retail Manager",
      "mail": "AdeleV@contoso.onmicrosoft.com",
      "type": "user",
      "user_principal_name": "AdeleV@contoso.onmicrosoft.com"
    }
  ]
}
```

### List group members

The users, groups and devices directly in a group.

**Inputs**

- Group ID (`group`, text, required): The group's object ID, shown on its Overview page or returned by a List groups step. A link to the group copied from the Entra admin center also works.
- Users only (`users_only`, true/false): Leave out nested groups, devices and apps. Default: `false`.
- Maximum results (`max_results`, number): How many to return at most. Defaults to 100 if left blank. From 1 to 999.

**Outputs**

- `count` (number)
- `has_more` (true/false)
- `items` (list)

**Example output**

```json
{
  "count": 1,
  "has_more": false,
  "items": [
    {
      "deleted_date_time": null,
      "description": null,
      "display_name": "Adele Vance",
      "group_types": null,
      "id": "87d349ed-44d7-43e1-9a83-5f2406dee5bd",
      "job_title": "Retail Manager",
      "mail": "AdeleV@contoso.onmicrosoft.com",
      "type": "user",
      "user_principal_name": "AdeleV@contoso.onmicrosoft.com"
    }
  ]
}
```

### List groups

List the groups in your directory, optionally by name or type.

**Inputs**

- Name contains (`search`, text): Only those with a word in their display name starting with this.
- Group type (`group_type`, text): Only security groups, or only Microsoft 365 groups. One of: `security` (Security groups), `microsoft_365` (Microsoft 365 groups).
- Maximum results (`max_results`, number): How many to return at most. Defaults to 100 if left blank. From 1 to 999.

**Outputs**

- `count` (number)
- `has_more` (true/false)
- `items` (list)

**Example output**

```json
{
  "count": 1,
  "has_more": false,
  "items": [
    {
      "created_date_time": "2026-09-21T09:00:00Z",
      "description": "Everyone in Retail",
      "display_name": "Retail team",
      "group_type": "security",
      "group_types": [],
      "id": "02bd9fd6-8f93-4758-87c3-1fb73740a315",
      "is_assignable_to_role": null,
      "mail": null,
      "mail_enabled": false,
      "mail_nickname": "retail-team",
      "membership_rule": null,
      "security_enabled": true,
      "visibility": null
    }
  ]
}
```

### List users

List the people in your directory, optionally filtered by name, by whether they can sign in, or to members or guests.

**Inputs**

- Name contains (`search`, text): Only those with a word in their display name starting with this.
- Sign-in (`account_status`, text): Only users who can, or cannot, sign in. One of: `enabled` (Enabled (can sign in)), `disabled` (Disabled (blocked from signing in)).
- User type (`user_type`, text): Only members of your organization, or only guests. One of: `Member`, `Guest`.
- Advanced filter (`filter_query`, text): An OData $filter expression, combined with the choices above. For example: department eq 'Sales'.
- Maximum results (`max_results`, number): How many to return at most. Defaults to 100 if left blank. From 1 to 999.

**Outputs**

- `count` (number)
- `has_more` (true/false)
- `items` (list)

**Example output**

```json
{
  "count": 1,
  "has_more": false,
  "items": [
    {
      "account_enabled": true,
      "business_phones": [
        "+1 425 555 0109"
      ],
      "city": "Seattle",
      "company_name": "Contoso",
      "country": "United States",
      "created_date_time": "2026-09-21T09:00:00Z",
      "department": "Retail",
      "display_name": "Adele Vance",
      "employee_id": "E1042",
      "given_name": "Adele",
      "id": "87d349ed-44d7-43e1-9a83-5f2406dee5bd",
      "job_title": "Retail Manager",
      "mail": "AdeleV@contoso.onmicrosoft.com",
      "mail_nickname": "AdeleV",
      "mobile_phone": null,
      "office_location": "18/2111",
      "preferred_language": "en-US",
      "surname": "Vance",
      "usage_location": "US",
      "user_principal_name": "AdeleV@contoso.onmicrosoft.com",
      "user_type": "Member"
    }
  ]
}
```

### Remove a group member

Take a user or nested group out of a group. Nothing is deleted.

**Inputs**

- Group ID (`group`, text, required): The group's object ID, shown on its Overview page or returned by a List groups step. A link to the group copied from the Entra admin center also works.
- Member (`member`, text, required): A user's sign-in name or object ID, or a group's object ID to nest that group (security groups only).

**Outputs**

- `group_id` (text)
- `member_id` (text)
- `removed` (true/false)

**Example output**

```json
{
  "group_id": "02bd9fd6-8f93-4758-87c3-1fb73740a315",
  "member_id": "87d349ed-44d7-43e1-9a83-5f2406dee5bd",
  "removed": true
}
```

### Remove a user's manager

Clear who a user reports to.

**Inputs**

- User (`user`, text, required): The user's sign-in name (name@yourdomain.com) or object ID. A link to the user copied from the Entra admin center also works.

**Outputs**

- `removed` (true/false)
- `user` (text)

**Example output**

```json
{
  "removed": true,
  "user": "adele@contoso.onmicrosoft.com"
}
```

### Restore a deleted user or group

Bring back a user or group deleted in the last 30 days, with its memberships.

**Inputs**

- Deleted item ID (`item_id`, text, required): The object ID of the deleted user or group, from a List deleted users or groups step.
- New sign-in name (`new_user_principal_name`, text): Users only: restore under this name@domain instead, if the old one has been taken.
- Drop conflicting email addresses (`auto_reconcile_proxy_conflict`, true/false): Users only: remove any of the user's email addresses now used by someone else, instead of failing. Default: `false`.

**Outputs**

- `deleted_date_time` (text)
- `description` (text)
- `display_name` (text)
- `group_types` (list)
- `id` (text)
- `job_title` (text)
- `mail` (text)
- `restored` (true/false)
- `type` (text)
- `user_principal_name` (text)

**Example output**

```json
{
  "deleted_date_time": null,
  "description": null,
  "display_name": "Adele Vance",
  "group_types": null,
  "id": "87d349ed-44d7-43e1-9a83-5f2406dee5bd",
  "job_title": "Retail Manager",
  "mail": "AdeleV@contoso.onmicrosoft.com",
  "restored": true,
  "type": "user",
  "user_principal_name": "AdeleV@contoso.onmicrosoft.com"
}
```

### Set a user's manager

Set who a user reports to, replacing any current manager.

**Inputs**

- User (`user`, text, required): The user's sign-in name (name@yourdomain.com) or object ID. A link to the user copied from the Entra admin center also works.
- Manager (`manager`, text, required): The manager's sign-in name or object ID.

**Outputs**

- `manager_id` (text)
- `updated` (true/false)
- `user` (text)

**Example output**

```json
{
  "manager_id": "5bde3e51-d13b-4db1-9948-fe4b109d11a7",
  "updated": true,
  "user": "adele@contoso.onmicrosoft.com"
}
```

### Sign a user out everywhere

Revoke a user's sign-in sessions and refresh tokens, so every app and device has to sign in again. Use it when an account may be compromised or someone leaves. It can take a few minutes to reach every app.

**Inputs**

- User (`user`, text, required): The user's sign-in name (name@yourdomain.com) or object ID. A link to the user copied from the Entra admin center also works.

**Outputs**

- `revoked` (true/false)
- `user` (text)

**Example output**

```json
{
  "revoked": true,
  "user": "adele@contoso.onmicrosoft.com"
}
```

### Update a group

Rename a group or change its description. Only the fields you fill in change.

**Inputs**

- Group ID (`group`, text, required): The group's object ID, shown on its Overview page or returned by a List groups step. A link to the group copied from the Entra admin center also works.
- Name (`display_name`, text): The group's new name.
- Description (`description`, text): The group's new description.
- Mail alias (`mail_nickname`, text): The group's new mail alias.
- Visibility (`visibility`, text): Microsoft 365 groups only. One of: `Private`, `Public`.

**Outputs**

- `group_id` (text)
- `updated` (true/false)
- `updated_fields` (list)

**Example output**

```json
{
  "group_id": "02bd9fd6-8f93-4758-87c3-1fb73740a315",
  "updated": true,
  "updated_fields": [
    "description"
  ]
}
```

### Update a user

Change a user's profile, block or allow their sign-in, or rename their sign-in name. Only the fields you fill in change. Accounts that hold an admin role can only be changed by an app that has been given a higher Entra role itself.

**Inputs**

- User (`user`, text, required): The user's sign-in name (name@yourdomain.com) or object ID. A link to the user copied from the Entra admin center also works.
- Display name (`display_name`, text): The name shown for the user.
- Sign-in (`account_status`, text): Enable or block this user's sign-in. Leave unselected to keep it as it is. One of: `enabled` (Enabled (can sign in)), `disabled` (Disabled (blocked from signing in)).
- First name (`given_name`, text): The user's first name.
- Last name (`surname`, text): The user's last name.
- Job title (`job_title`, text): The user's job title.
- Department (`department`, text): The department the user works in.
- Office (`office_location`, text): The user's office location.
- Company (`company_name`, text): Company name, at most 64 characters.
- Employee ID (`employee_id`, text): Your HR id for the user, at most 16 characters.
- Employee type (`employee_type`, text): For example Employee or Contractor.
- Usage location (`usage_location`, text): Two-letter country code (such as US or GB). Required before the user can be assigned a licence.
- Street address (`street_address`, text): Street address of the user's workplace.
- City (`city`, text): The city the user works in.
- State or province (`state`, text): The state or province the user works in.
- Postal code (`postal_code`, text): Postal code of the user's workplace.
- Country (`country`, text): The country the user works in, such as United States.
- Preferred language (`preferred_language`, text): Language code such as en-US or fr-FR.
- User type (`user_type`, text): Make the user a member of your organization or a guest. One of: `Member`, `Guest`.
- Mail alias (`mail_nickname`, text): The user's mail alias.
- New sign-in name (`user_principal_name`, text): The whole new name@domain; the domain must be verified.

**Outputs**

- `updated` (true/false)
- `updated_fields` (list)
- `user` (text)

**Example output**

```json
{
  "updated": true,
  "updated_fields": [
    "jobTitle"
  ],
  "user": "adele@contoso.onmicrosoft.com"
}
```