> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Entra

> Reference for the Tracecat Microsoft Entra integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Add user to group

Action ID: `tools.microsoft_entra.add_user_to_group`

Add a Microsoft Entra ID user to a group.

Reference: [https://learn.microsoft.com/en-us/graph/api/group-post-members?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/group-post-members?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_USER_TOKEN`.
* `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_SERVICE_TOKEN`.

### Input fields

<ParamField path="group_id" type="string" required>
  The unique identifier of the group.
</ParamField>

<ParamField path="user_id" type="string" required>
  The unique identifier of the user (directory object) to add.
</ParamField>

<ParamField path="api_version" type="string">
  Microsoft Graph API version.

  Default: `"v1.0"`.
</ParamField>

<ParamField path="base_url" type="string">
  Base URL for the Microsoft Graph API.

  Default: `"https://graph.microsoft.com"`.

  Allowed values: `https://graph.microsoft.com`, `https://graph.microsoft.us`.
</ParamField>

## Create group

Action ID: `tools.microsoft_entra.create_group`

Create a Microsoft Entra ID group.

Reference: [https://learn.microsoft.com/en-us/graph/api/group-post-groups?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/group-post-groups?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_USER_TOKEN`.
* `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_SERVICE_TOKEN`.

### Input fields

<ParamField path="group" type="object" required>
  Properties for the new group resource (displayName, mailEnabled, mailNickname, securityEnabled, etc.).
</ParamField>

<ParamField path="api_version" type="string">
  Microsoft Graph API version.

  Default: `"v1.0"`.
</ParamField>

<ParamField path="base_url" type="string">
  Base URL for the Microsoft Graph API.

  Default: `"https://graph.microsoft.com"`.

  Allowed values: `https://graph.microsoft.com`, `https://graph.microsoft.us`.
</ParamField>

## Create user

Action ID: `tools.microsoft_entra.create_user`

Create a Microsoft Entra ID user account.

Reference: [https://learn.microsoft.com/en-us/graph/api/user-post-users?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/user-post-users?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_USER_TOKEN`.
* `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_SERVICE_TOKEN`.

### Input fields

<ParamField path="user" type="object" required>
  User properties for the request body (e.g. accountEnabled, displayName, mailNickname, userPrincipalName, passwordProfile).
</ParamField>

<ParamField path="api_version" type="string">
  Microsoft Graph API version.

  Default: `"v1.0"`.
</ParamField>

<ParamField path="base_url" type="string">
  Base URL for the Microsoft Graph API.

  Default: `"https://graph.microsoft.com"`.

  Allowed values: `https://graph.microsoft.com`, `https://graph.microsoft.us`.
</ParamField>

## Delete group

Action ID: `tools.microsoft_entra.delete_group`

Delete a Microsoft Entra ID group.

Reference: [https://learn.microsoft.com/en-us/graph/api/group-delete?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/group-delete?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_USER_TOKEN`.
* `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_SERVICE_TOKEN`.

### Input fields

<ParamField path="group_id" type="string" required>
  The unique identifier of the group to delete.
</ParamField>

<ParamField path="api_version" type="string">
  Microsoft Graph API version.

  Default: `"v1.0"`.
</ParamField>

<ParamField path="base_url" type="string">
  Base URL for the Microsoft Graph API.

  Default: `"https://graph.microsoft.com"`.

  Allowed values: `https://graph.microsoft.com`, `https://graph.microsoft.us`.
</ParamField>

## Delete user

Action ID: `tools.microsoft_entra.delete_user`

Delete a Microsoft Entra ID user.

Reference: [https://learn.microsoft.com/en-us/graph/api/user-delete?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/user-delete?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_USER_TOKEN`.
* `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_SERVICE_TOKEN`.

### Input fields

<ParamField path="user_id" type="string" required>
  The unique identifier of the user to delete.
</ParamField>

<ParamField path="api_version" type="string">
  Microsoft Graph API version.

  Default: `"v1.0"`.
</ParamField>

<ParamField path="base_url" type="string">
  Base URL for the Microsoft Graph API.

  Default: `"https://graph.microsoft.com"`.

  Allowed values: `https://graph.microsoft.com`, `https://graph.microsoft.us`.
</ParamField>

## Get group

Action ID: `tools.microsoft_entra.get_group`

Retrieve details for a Microsoft Entra ID group.

Reference: [https://learn.microsoft.com/en-us/graph/api/group-get?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/group-get?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_USER_TOKEN`.
* `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_SERVICE_TOKEN`.

### Input fields

<ParamField path="group_id" type="string" required>
  The unique identifier of the group to retrieve.
</ParamField>

<ParamField path="api_version" type="string">
  Microsoft Graph API version.

  Default: `"v1.0"`.
</ParamField>

<ParamField path="base_url" type="string">
  Base URL for the Microsoft Graph API.

  Default: `"https://graph.microsoft.com"`.

  Allowed values: `https://graph.microsoft.com`, `https://graph.microsoft.us`.
</ParamField>

<ParamField path="expand" type="array[string]">
  Optional related entities to expand in the response.

  Default: `null`.
</ParamField>

<ParamField path="select" type="array[string]">
  Optional set of group properties to return.

  Default: `null`.
</ParamField>

## Get user

Action ID: `tools.microsoft_entra.get_user`

Retrieve details for a Microsoft Entra ID user.

Reference: [https://learn.microsoft.com/en-us/graph/api/user-get?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/user-get?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_USER_TOKEN`.
* `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_SERVICE_TOKEN`.

### Input fields

<ParamField path="user_id" type="string" required>
  The unique identifier of the user to retrieve.
</ParamField>

<ParamField path="api_version" type="string">
  Microsoft Graph API version.

  Default: `"v1.0"`.
</ParamField>

<ParamField path="base_url" type="string">
  Base URL for the Microsoft Graph API.

  Default: `"https://graph.microsoft.com"`.

  Allowed values: `https://graph.microsoft.com`, `https://graph.microsoft.us`.
</ParamField>

<ParamField path="expand" type="array[string]">
  Optional related entities to expand in the response.

  Default: `null`.
</ParamField>

<ParamField path="select" type="array[string]">
  Optional set of user properties to return.

  Default: `null`.
</ParamField>

## Get user ID by email

Action ID: `tools.microsoft_entra.get_user_id_by_email`

Get a user's ID by searching for their email address in mail or userPrincipalName.

Reference: [https://learn.microsoft.com/en-us/graph/api/user-list?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/user-list?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_USER_TOKEN`.
* `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_SERVICE_TOKEN`.

### Input fields

<ParamField path="email" type="string" required>
  The email address to search for.
</ParamField>

<ParamField path="api_version" type="string">
  Microsoft Graph API version.

  Default: `"v1.0"`.
</ParamField>

<ParamField path="base_url" type="string">
  Base URL for the Microsoft Graph API.

  Default: `"https://graph.microsoft.com"`.

  Allowed values: `https://graph.microsoft.com`, `https://graph.microsoft.us`.
</ParamField>

## List groups

Action ID: `tools.microsoft_entra.list_groups`

List Microsoft Entra ID groups with optional OData queries.

Reference: [https://learn.microsoft.com/en-us/graph/api/group-list?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/group-list?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_USER_TOKEN`.
* `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_SERVICE_TOKEN`.

### Input fields

<ParamField path="api_version" type="string">
  Microsoft Graph API version.

  Default: `"v1.0"`.
</ParamField>

<ParamField path="base_url" type="string">
  Base URL for the Microsoft Graph API.

  Default: `"https://graph.microsoft.com"`.

  Allowed values: `https://graph.microsoft.com`, `https://graph.microsoft.us`.
</ParamField>

<ParamField path="consistency_level_eventual" type="boolean">
  Set ConsistencyLevel=eventual for advanced queries when required by Microsoft Graph.

  Default: `false`.
</ParamField>

<ParamField path="expand" type="array[string]">
  Optional related entities to expand in the response.

  Default: `null`.
</ParamField>

<ParamField path="filter" type="string">
  Optional OData \$filter expression.

  Default: `null`.
</ParamField>

<ParamField path="max_page_size" type="integer">
  Optional maximum page size to request via Prefer=odata.maxpagesize.

  Default: `null`.
</ParamField>

<ParamField path="orderby" type="string">
  Optional OData \$orderby expression.

  Default: `null`.
</ParamField>

<ParamField path="search" type="string">
  Optional search phrase. Use quoted property names as documented, for example "displayName:Engineering".

  Default: `null`.
</ParamField>

<ParamField path="select" type="array[string]">
  Optional set of group properties to return.

  Default: `null`.
</ParamField>

<ParamField path="skip_token" type="string">
  Opaque continuation token from a previous response (\$skiptoken).

  Default: `null`.
</ParamField>

<ParamField path="top" type="integer">
  Maximum number of results to return in a single page (\$top).

  Default: `null`.
</ParamField>

## List users

Action ID: `tools.microsoft_entra.list_users`

List Microsoft Entra ID users with optional OData query parameters.

Reference: [https://learn.microsoft.com/en-us/graph/api/user-list?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/user-list?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_USER_TOKEN`.
* `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_SERVICE_TOKEN`.

### Input fields

<ParamField path="api_version" type="string">
  Microsoft Graph API version.

  Default: `"v1.0"`.
</ParamField>

<ParamField path="base_url" type="string">
  Base URL for the Microsoft Graph API.

  Default: `"https://graph.microsoft.com"`.

  Allowed values: `https://graph.microsoft.com`, `https://graph.microsoft.us`.
</ParamField>

<ParamField path="consistency_level_eventual" type="boolean">
  Set ConsistencyLevel=eventual for advanced queries when required by Microsoft Graph.

  Default: `false`.
</ParamField>

<ParamField path="count" type="boolean">
  Include @odata.count in the response by setting \$count=true.

  Default: `false`.
</ParamField>

<ParamField path="expand" type="array[string]">
  Optional related entities to expand in the response.

  Default: `null`.
</ParamField>

<ParamField path="filter" type="string">
  Optional OData \$filter expression.

  Default: `null`.
</ParamField>

<ParamField path="max_page_size" type="integer">
  Optional maximum page size to request via Prefer=odata.maxpagesize.

  Default: `null`.
</ParamField>

<ParamField path="orderby" type="string">
  Optional OData \$orderby expression.

  Default: `null`.
</ParamField>

<ParamField path="search" type="string">
  Optional search phrase. Use quoted property names per Microsoft Graph syntax, for example "displayName:Alex".

  Default: `null`.
</ParamField>

<ParamField path="select" type="array[string]">
  Optional set of user properties to return.

  Default: `null`.
</ParamField>

<ParamField path="skip_token" type="string">
  Opaque continuation token from a previous response (\$skiptoken).

  Default: `null`.
</ParamField>

<ParamField path="top" type="integer">
  Maximum number of results to return in a single page (\$top).

  Default: `null`.
</ParamField>

## Remove user from group

Action ID: `tools.microsoft_entra.remove_user_from_group`

Remove a Microsoft Entra ID user from a group.

Reference: [https://learn.microsoft.com/en-us/graph/api/group-delete-members?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/group-delete-members?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_USER_TOKEN`.
* `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_SERVICE_TOKEN`.

### Input fields

<ParamField path="group_id" type="string" required>
  The unique identifier of the group.
</ParamField>

<ParamField path="user_id" type="string" required>
  The unique identifier of the user (directory object) to remove.
</ParamField>

<ParamField path="api_version" type="string">
  Microsoft Graph API version.

  Default: `"v1.0"`.
</ParamField>

<ParamField path="base_url" type="string">
  Base URL for the Microsoft Graph API.

  Default: `"https://graph.microsoft.com"`.

  Allowed values: `https://graph.microsoft.com`, `https://graph.microsoft.us`.
</ParamField>

## Update group

Action ID: `tools.microsoft_entra.update_group`

Update properties on a Microsoft Entra ID group.

Reference: [https://learn.microsoft.com/en-us/graph/api/group-update?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/group-update?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_USER_TOKEN`.
* `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_SERVICE_TOKEN`.

### Input fields

<ParamField path="group_id" type="string" required>
  The unique identifier of the group to update.
</ParamField>

<ParamField path="updates" type="object" required>
  Group properties to update as defined in the Microsoft Graph group resource.
</ParamField>

<ParamField path="api_version" type="string">
  Microsoft Graph API version.

  Default: `"v1.0"`.
</ParamField>

<ParamField path="base_url" type="string">
  Base URL for the Microsoft Graph API.

  Default: `"https://graph.microsoft.com"`.

  Allowed values: `https://graph.microsoft.com`, `https://graph.microsoft.us`.
</ParamField>

## Update user

Action ID: `tools.microsoft_entra.update_user`

Update properties on a Microsoft Entra ID user.

Reference: [https://learn.microsoft.com/en-us/graph/api/user-update?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/user-update?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_USER_TOKEN`.
* `microsoft_entra_oauth`: OAuth token `MICROSOFT_ENTRA_SERVICE_TOKEN`.

### Input fields

<ParamField path="updates" type="object" required>
  User properties to update as defined in the Microsoft Graph user resource.
</ParamField>

<ParamField path="user_id" type="string" required>
  The unique identifier of the user to update.
</ParamField>

<ParamField path="api_version" type="string">
  Microsoft Graph API version.

  Default: `"v1.0"`.
</ParamField>

<ParamField path="base_url" type="string">
  Base URL for the Microsoft Graph API.

  Default: `"https://graph.microsoft.com"`.

  Allowed values: `https://graph.microsoft.com`, `https://graph.microsoft.us`.
</ParamField>