---
title: "Microsoft Entra"
description: "Reference for the Tracecat Microsoft Entra integration: registered actions, required secrets, expected inputs, and example workflow usage."
---

{/* Auto-generated by scripts/generate_tool_docs.py; do not edit by hand. */}
## Add user to group

Action ID: `tools.microsoft_entra.add_user_to_group`

Add a Microsoft Entra ID user to a group.

Reference: [https://learn.microsoft.com/en-us/graph/api/group-post-members?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/group-post-members?view=graph-rest-1.0)

### Secrets

Optional secrets:

- `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_USER_TOKEN`.
- `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_SERVICE_TOKEN`.

### Input fields

<ParamField path="group_id" type="string" required>

The unique identifier of the group.

</ParamField>

<ParamField path="user_id" type="string" required>

The unique identifier of the user (directory object) to add.

</ParamField>

<ParamField path="api_version" type="string">

Microsoft Graph API version.

Default: `"v1.0"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Microsoft Graph API.

Default: `"https://graph.microsoft.com"`.

Allowed values: `https://graph.microsoft.com`, `https://graph.microsoft.us`.

</ParamField>

## Create group

Action ID: `tools.microsoft_entra.create_group`

Create a Microsoft Entra ID group.

Reference: [https://learn.microsoft.com/en-us/graph/api/group-post-groups?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/group-post-groups?view=graph-rest-1.0)

### Secrets

Optional secrets:

- `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_USER_TOKEN`.
- `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_SERVICE_TOKEN`.

### Input fields

<ParamField path="group" type="object" required>

Properties for the new group resource (displayName, mailEnabled, mailNickname, securityEnabled, etc.).

</ParamField>

<ParamField path="api_version" type="string">

Microsoft Graph API version.

Default: `"v1.0"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Microsoft Graph API.

Default: `"https://graph.microsoft.com"`.

Allowed values: `https://graph.microsoft.com`, `https://graph.microsoft.us`.

</ParamField>

## Create user

Action ID: `tools.microsoft_entra.create_user`

Create a Microsoft Entra ID user account.

Reference: [https://learn.microsoft.com/en-us/graph/api/user-post-users?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/user-post-users?view=graph-rest-1.0)

### Secrets

Optional secrets:

- `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_USER_TOKEN`.
- `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_SERVICE_TOKEN`.

### Input fields

<ParamField path="user" type="object" required>

User properties for the request body (e.g. accountEnabled, displayName, mailNickname, userPrincipalName, passwordProfile).

</ParamField>

<ParamField path="api_version" type="string">

Microsoft Graph API version.

Default: `"v1.0"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Microsoft Graph API.

Default: `"https://graph.microsoft.com"`.

Allowed values: `https://graph.microsoft.com`, `https://graph.microsoft.us`.

</ParamField>

## Delete group

Action ID: `tools.microsoft_entra.delete_group`

Delete a Microsoft Entra ID group.

Reference: [https://learn.microsoft.com/en-us/graph/api/group-delete?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/group-delete?view=graph-rest-1.0)

### Secrets

Optional secrets:

- `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_USER_TOKEN`.
- `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_SERVICE_TOKEN`.

### Input fields

<ParamField path="group_id" type="string" required>

The unique identifier of the group to delete.

</ParamField>

<ParamField path="api_version" type="string">

Microsoft Graph API version.

Default: `"v1.0"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Microsoft Graph API.

Default: `"https://graph.microsoft.com"`.

Allowed values: `https://graph.microsoft.com`, `https://graph.microsoft.us`.

</ParamField>

## Delete user

Action ID: `tools.microsoft_entra.delete_user`

Delete a Microsoft Entra ID user.

Reference: [https://learn.microsoft.com/en-us/graph/api/user-delete?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/user-delete?view=graph-rest-1.0)

### Secrets

Optional secrets:

- `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_USER_TOKEN`.
- `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_SERVICE_TOKEN`.

### Input fields

<ParamField path="user_id" type="string" required>

The unique identifier of the user to delete.

</ParamField>

<ParamField path="api_version" type="string">

Microsoft Graph API version.

Default: `"v1.0"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Microsoft Graph API.

Default: `"https://graph.microsoft.com"`.

Allowed values: `https://graph.microsoft.com`, `https://graph.microsoft.us`.

</ParamField>

## Get group

Action ID: `tools.microsoft_entra.get_group`

Retrieve details for a Microsoft Entra ID group.

Reference: [https://learn.microsoft.com/en-us/graph/api/group-get?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/group-get?view=graph-rest-1.0)

### Secrets

Optional secrets:

- `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_USER_TOKEN`.
- `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_SERVICE_TOKEN`.

### Input fields

<ParamField path="group_id" type="string" required>

The unique identifier of the group to retrieve.

</ParamField>

<ParamField path="api_version" type="string">

Microsoft Graph API version.

Default: `"v1.0"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Microsoft Graph API.

Default: `"https://graph.microsoft.com"`.

Allowed values: `https://graph.microsoft.com`, `https://graph.microsoft.us`.

</ParamField>

<ParamField path="expand" type="array[string]">

Optional related entities to expand in the response.

Default: `null`.

</ParamField>

<ParamField path="select" type="array[string]">

Optional set of group properties to return.

Default: `null`.

</ParamField>

## Get user

Action ID: `tools.microsoft_entra.get_user`

Retrieve details for a Microsoft Entra ID user.

Reference: [https://learn.microsoft.com/en-us/graph/api/user-get?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/user-get?view=graph-rest-1.0)

### Secrets

Optional secrets:

- `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_USER_TOKEN`.
- `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_SERVICE_TOKEN`.

### Input fields

<ParamField path="user_id" type="string" required>

The unique identifier of the user to retrieve.

</ParamField>

<ParamField path="api_version" type="string">

Microsoft Graph API version.

Default: `"v1.0"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Microsoft Graph API.

Default: `"https://graph.microsoft.com"`.

Allowed values: `https://graph.microsoft.com`, `https://graph.microsoft.us`.

</ParamField>

<ParamField path="expand" type="array[string]">

Optional related entities to expand in the response.

Default: `null`.

</ParamField>

<ParamField path="select" type="array[string]">

Optional set of user properties to return.

Default: `null`.

</ParamField>

## Get user ID by email

Action ID: `tools.microsoft_entra.get_user_id_by_email`

Get a user's ID by searching for their email address in mail or userPrincipalName.

Reference: [https://learn.microsoft.com/en-us/graph/api/user-list?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/user-list?view=graph-rest-1.0)

### Secrets

Optional secrets:

- `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_USER_TOKEN`.
- `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_SERVICE_TOKEN`.

### Input fields

<ParamField path="email" type="string" required>

The email address to search for.

</ParamField>

<ParamField path="api_version" type="string">

Microsoft Graph API version.

Default: `"v1.0"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Microsoft Graph API.

Default: `"https://graph.microsoft.com"`.

Allowed values: `https://graph.microsoft.com`, `https://graph.microsoft.us`.

</ParamField>

## List groups

Action ID: `tools.microsoft_entra.list_groups`

List Microsoft Entra ID groups with optional OData queries.

Reference: [https://learn.microsoft.com/en-us/graph/api/group-list?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/group-list?view=graph-rest-1.0)

### Secrets

Optional secrets:

- `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_USER_TOKEN`.
- `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_SERVICE_TOKEN`.

### Input fields

<ParamField path="api_version" type="string">

Microsoft Graph API version.

Default: `"v1.0"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Microsoft Graph API.

Default: `"https://graph.microsoft.com"`.

Allowed values: `https://graph.microsoft.com`, `https://graph.microsoft.us`.

</ParamField>

<ParamField path="consistency_level_eventual" type="boolean">

Set ConsistencyLevel=eventual for advanced queries when required by Microsoft Graph.

Default: `false`.

</ParamField>

<ParamField path="expand" type="array[string]">

Optional related entities to expand in the response.

Default: `null`.

</ParamField>

<ParamField path="filter" type="string">

Optional OData $filter expression.

Default: `null`.

</ParamField>

<ParamField path="max_page_size" type="integer">

Optional maximum page size to request via Prefer=odata.maxpagesize.

Default: `null`.

</ParamField>

<ParamField path="orderby" type="string">

Optional OData $orderby expression.

Default: `null`.

</ParamField>

<ParamField path="search" type="string">

Optional search phrase. Use quoted property names as documented, for example "displayName:Engineering".

Default: `null`.

</ParamField>

<ParamField path="select" type="array[string]">

Optional set of group properties to return.

Default: `null`.

</ParamField>

<ParamField path="skip_token" type="string">

Opaque continuation token from a previous response ($skiptoken).

Default: `null`.

</ParamField>

<ParamField path="top" type="integer">

Maximum number of results to return in a single page ($top).

Default: `null`.

</ParamField>

## List users

Action ID: `tools.microsoft_entra.list_users`

List Microsoft Entra ID users with optional OData query parameters.

Reference: [https://learn.microsoft.com/en-us/graph/api/user-list?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/user-list?view=graph-rest-1.0)

### Secrets

Optional secrets:

- `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_USER_TOKEN`.
- `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_SERVICE_TOKEN`.

### Input fields

<ParamField path="api_version" type="string">

Microsoft Graph API version.

Default: `"v1.0"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Microsoft Graph API.

Default: `"https://graph.microsoft.com"`.

Allowed values: `https://graph.microsoft.com`, `https://graph.microsoft.us`.

</ParamField>

<ParamField path="consistency_level_eventual" type="boolean">

Set ConsistencyLevel=eventual for advanced queries when required by Microsoft Graph.

Default: `false`.

</ParamField>

<ParamField path="count" type="boolean">

Include @odata.count in the response by setting $count=true.

Default: `false`.

</ParamField>

<ParamField path="expand" type="array[string]">

Optional related entities to expand in the response.

Default: `null`.

</ParamField>

<ParamField path="filter" type="string">

Optional OData $filter expression.

Default: `null`.

</ParamField>

<ParamField path="max_page_size" type="integer">

Optional maximum page size to request via Prefer=odata.maxpagesize.

Default: `null`.

</ParamField>

<ParamField path="orderby" type="string">

Optional OData $orderby expression.

Default: `null`.

</ParamField>

<ParamField path="search" type="string">

Optional search phrase. Use quoted property names per Microsoft Graph syntax, for example "displayName:Alex".

Default: `null`.

</ParamField>

<ParamField path="select" type="array[string]">

Optional set of user properties to return.

Default: `null`.

</ParamField>

<ParamField path="skip_token" type="string">

Opaque continuation token from a previous response ($skiptoken).

Default: `null`.

</ParamField>

<ParamField path="top" type="integer">

Maximum number of results to return in a single page ($top).

Default: `null`.

</ParamField>

## Remove user from group

Action ID: `tools.microsoft_entra.remove_user_from_group`

Remove a Microsoft Entra ID user from a group.

Reference: [https://learn.microsoft.com/en-us/graph/api/group-delete-members?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/group-delete-members?view=graph-rest-1.0)

### Secrets

Optional secrets:

- `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_USER_TOKEN`.
- `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_SERVICE_TOKEN`.

### Input fields

<ParamField path="group_id" type="string" required>

The unique identifier of the group.

</ParamField>

<ParamField path="user_id" type="string" required>

The unique identifier of the user (directory object) to remove.

</ParamField>

<ParamField path="api_version" type="string">

Microsoft Graph API version.

Default: `"v1.0"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Microsoft Graph API.

Default: `"https://graph.microsoft.com"`.

Allowed values: `https://graph.microsoft.com`, `https://graph.microsoft.us`.

</ParamField>

## Update group

Action ID: `tools.microsoft_entra.update_group`

Update properties on a Microsoft Entra ID group.

Reference: [https://learn.microsoft.com/en-us/graph/api/group-update?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/group-update?view=graph-rest-1.0)

### Secrets

Optional secrets:

- `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_USER_TOKEN`.
- `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_SERVICE_TOKEN`.

### Input fields

<ParamField path="group_id" type="string" required>

The unique identifier of the group to update.

</ParamField>

<ParamField path="updates" type="object" required>

Group properties to update as defined in the Microsoft Graph group resource.

</ParamField>

<ParamField path="api_version" type="string">

Microsoft Graph API version.

Default: `"v1.0"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Microsoft Graph API.

Default: `"https://graph.microsoft.com"`.

Allowed values: `https://graph.microsoft.com`, `https://graph.microsoft.us`.

</ParamField>

## Update user

Action ID: `tools.microsoft_entra.update_user`

Update properties on a Microsoft Entra ID user.

Reference: [https://learn.microsoft.com/en-us/graph/api/user-update?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/user-update?view=graph-rest-1.0)

### Secrets

Optional secrets:

- `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_USER_TOKEN`.
- `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_SERVICE_TOKEN`.

### Input fields

<ParamField path="updates" type="object" required>

User properties to update as defined in the Microsoft Graph user resource.

</ParamField>

<ParamField path="user_id" type="string" required>

The unique identifier of the user to update.

</ParamField>

<ParamField path="api_version" type="string">

Microsoft Graph API version.

Default: `"v1.0"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Microsoft Graph API.

Default: `"https://graph.microsoft.com"`.

Allowed values: `https://graph.microsoft.com`, `https://graph.microsoft.us`.

</ParamField>
