Skip to content

Microsoft Entra ID

Examples for working with Microsoft Entra ID (formerly Azure AD) via the Microsoft Graph API — users, groups, applications, service principals, directory roles, policies, and audit logs.

Prerequisites

Requirement Description Reference
User.Read.All Read user profiles and directory data User permissions
User.ReadWrite.All Update users, reset passwords, manage licenses User permissions
User.Invite.All Invite guest users (B2B) User Invite permissions
Group.Read.All Read group members and properties Group permissions
Group.ReadWrite.All Create, manage, and delete groups Group permissions
Application.Read.All Read app registrations Application permissions
Application.ReadWrite.All Register and manage applications Application permissions
AppRoleAssignment.ReadWrite.All Grant and revoke API permissions AppRoleAssignment permissions
RoleManagement.ReadWrite.Directory Read and assign directory roles RoleManagement permissions
Policy.Read.All Read tenant policies Policy permissions
IdentityProvider.Read.All Read identity providers (SAML, social) IdentityProvider permissions
AuditLog.Read.All Read sign-in logs and audit logs AuditLog permissions
IdentityRiskyUser.Read.All Read risky users and risk detections Identity Protection permissions
AccessReview.Read.All Read access reviews history Access review permissions
Domain.ReadWrite.All Add and verify custom domains Domain permissions
UserAuthenticationMethod.Read.All Read registered MFA,FIDO2,passwordless methods Authentication methods permissions

Admin consent is required for most permissions above.

How Entra ID is organized

flowchart LR
    A[Tenant] --> B[Users]
    A --> C[Groups]
    A --> D[Applications / Service Principals]
    A --> E[Directory Roles]
    A --> F[Policies]
    A --> G[Identity Providers]
    A --> H[Audit Logs]

The Entra ID Graph API covers identity and access management — users, groups, app registrations, service principals, role assignments, tenant-level policies, and audit logs.

Learning path

Each folder is a guided tour; work through them roughly in this order.

# Tour Covers
1 Users Create, update, disable, restore; passwords, managers, guests, MFA
2 Groups Security vs Microsoft 365 groups, membership, owners, lifecycle
3 Licenses View and assign licenses, bulk assignment
4 Applications Register apps, rotate credentials, consent, governance reports
5 Roles Directory roles, membership, PIM assignments
6 Audit Sign-in and directory audit logs
7 Policies Authorization, Conditional Access, authentication methods
8 Identity Identity providers, named locations, user flows
9 Protection Risky users and risk detections
10 Governance Access reviews, Terms of Use, entitlement management
11 Subscriptions Graph change notifications (webhooks)
12 Domains, Devices, Tenant Infrastructure inventory

Recipes that combine a few scripts into a task you would actually schedule.

Task Start here
Onboard a user — create, license, add to groups users/create.py, licenses/assign.py, groups/add_member.py
Offboard a user — disable, remove licenses, delete users/update.py, users/delete.py
Guest (B2B) hygiene — invite, then audit inactivity users/invite_guest.py, users/find_inactive_guests.py
MFA readiness — who lacks strong auth users/mfa_status_report.py
Privileged access review — who is an admin roles/privileged_users.py, roles/pim_report.py
Credential expiry — secrets and certs about to break applications/credentials_report.py
Rotate expired secrets applications/rotate_all_expired.py, applications/cleanup_old.py
Register an app end to end — credentials, permissions, consent applications/provision.py
Permission audit — requested vs granted, per resource applications/permissions_report.py
Consent governance — review, grant, revoke applications/consent_grants.py, applications/grant_delegated_perms.py
Break-glass audit — CA exclusions and permanent admins users/break_glass_report.py

API coverage gaps

  • B2X user flows are supported. Self-service sign-up flows for Entra External ID are exposed through office365.directory.identities.userflows.b2x and listed by identity/list_user_flows.py.
  • B2C has no dedicated Graph surface. Microsoft Entra External ID (B2C) historically lives on the separate Azure AD B2C Graph API (b2cUserFlow, b2cIdentityUserFlow); the v1.0 Microsoft Graph model generated here does not include those types. Use the B2X user-flow API for the newer model, and the B2C-specific API for existing B2C tenants.
  • PIM eligible assignments need RoleManagement.Read.Directory. The roles/pim_report.py example degrades gracefully when only Directory.Read.All is available.

Examples — Users

Operation File Required role API reference
Import generated users users/import.py User.ReadWrite.All create user
Import users from CSV users/import_users_csv.py User.ReadWrite.All create user
Get total user count users/get_count.py User.Read.All get user
Get disabled user accounts users/get_disabled.py User.Read.All list users
Get users with expired passwords users/password_expiry_report.py User.Read.All list users
Get user's recent activities users/get_my_activities.py User.Read.All activities
Update a user's profile users/update.py User.ReadWrite.All update user
Update users in batch users/update_batch.py User.ReadWrite.All update user
Reset a user's password users/reset_password.py User.ReadWrite.All reset password
Assign a manager to a user users/assign_manager.py User.ReadWrite.All update manager
Get a user's manager users/get_manager.py User.Read.All get manager
Disable MFA for a user users/disable_mfa.py User.ReadWrite.All update authentication
Get assigned licenses licenses/whose.py User.Read.All get license
Assign a license to a user licenses/assign.py User.ReadWrite.All assign license
Export users to file users/export.py User.Read.All list users
Export personal data (GDPR) users/export_personal_data.py User.Read.All export data
List app role assignments users/list_app_role_assignments.py User.Read.All app role assignments
Create a user users/create.py User.ReadWrite.All create user
Delete a user users/delete.py User.ReadWrite.All delete user
Get user's group memberships users/get_group_memberships.py User.Read.All memberOf
Invite a guest (B2B) user users/invite_guest.py User.Invite.All invitation
User report — sign-in activity, inactive, no MFA users/report.py User.Read.All, AuditLog.Read.All user list
MFA status report — users without strong auth registered users/mfa_status_report.py UserAuthenticationMethod.Read.All auth methods
Last sign-in report — users without recent sign-in users/last_signin_report.py User.Read.All, AuditLog.Read.All signInActivity
Find inactive guest accounts users/find_inactive_guests.py User.Read.All, AuditLog.Read.All user list
Break-glass account audit — CA exclusions, permanent Global Admins users/break_glass_report.py Policy.Read.All, RoleManagement.Read.All CA policies
Assign a license to a group licenses/group_license.py Group.ReadWrite.All assign license

Examples — Groups

Operation File Required role API reference
Create a Microsoft 365 group groups/create_m365.py Group.ReadWrite.All create group
Create a security group groups/create_security.py Group.ReadWrite.All create group
Create a group with a team groups/create_with_team.py Group.ReadWrite.All create group
Update group properties groups/update_group.py Group.ReadWrite.All update group
List all groups groups/list.py Group.ReadWrite.All list groups
List group members groups/list_members.py Group.Read.All list members
Add/remove group members groups/add_member.py Group.ReadWrite.All group members
Add/remove group owners groups/add_owner.py Group.ReadWrite.All group owners
List group owners groups/list_owners.py Group.Read.All list owners
Delete groups by name groups/delete_groups.py Group.ReadWrite.All delete group
Preview & bulk-delete retired groups groups/delete_batch.py Group.ReadWrite.All delete group
Export groups to CSV groups/export_csv.py Group.Read.All list groups
Find orphaned groups — no owners or members groups/find_orphans.py Group.Read.All, User.Read.All group list
Group lifecycle policies groups/lifecycle_policies.py GroupLifecyclePolicy.ReadWrite.All lifecycle policy
Group membership changes audit — who was added/removed audit/group_membership_changes.py AuditLog.Read.All directory audit

Examples — Applications

Operation File Required role API reference
Register a new application applications/create.py Application.ReadWrite.All create app
List all applications applications/list.py Application.Read.All list apps
Get an application by client ID applications/get_by_app_id.py Application.ReadWrite.All get application
Add or generate a certificate on an app applications/rotate_cert.py Application.ReadWrite.All add certificate
Add a client secret (password) applications/rotate_secret.py Application.ReadWrite.All add password
Check application permissions applications/has_application_perms.py AppRoleAssignment.ReadWrite.All app permissions
Check delegated permissions applications/has_delegated_perms.py AppRoleAssignment.ReadWrite.All delegated perms
List application permissions applications/list_application_perms.py AppRoleAssignment.ReadWrite.All list app perms
List delegated permissions applications/list_delegated_perms.py AppRoleAssignment.ReadWrite.All list delegated
Grant application permissions applications/grant_application_perms.py AppRoleAssignment.ReadWrite.All grant
Grant delegated permissions applications/grant_delegated_perms.py AppRoleAssignment.ReadWrite.All grant
Revoke application permissions applications/revoke_application_perms.py AppRoleAssignment.ReadWrite.All revoke
Revoke delegated permissions applications/revoke_delegated_perms.py AppRoleAssignment.ReadWrite.All revoke
Service principal report — apps, perms, expiring secrets applications/sp_report.py Application.Read.All SP list
App secret expiry report — certs/passwords expiring soon applications/credentials_report.py Application.Read.All app credentials
OAuth consent grants — review delegated permissions per app applications/consent_grants.py DelegatedPermissionGrant.Read.All consent grants
Find orphaned apps — registrations/SPs without owners applications/find_orphans.py Application.Read.All app list
Provision an app end to end — credentials, permissions, consent applications/provision.py Application.ReadWrite.All, DelegatedPermissionGrant.ReadWrite.All create app
Permission inventory — requested vs granted, per resource applications/permissions_report.py Directory.Read.All app role assignments
Find stale apps — no valid credentials applications/find_stale_apps.py Application.Read.All app list
Rotate every expired secret applications/rotate_all_expired.py Application.ReadWrite.All add password
Remove superseded secrets applications/cleanup_old.py Application.ReadWrite.All remove password
Delete stale apps applications/cleanup_stale.py Application.ReadWrite.All delete app
Restore a soft-deleted app applications/restore_app.py Application.ReadWrite.All deletedItems restore
Update redirect URIs applications/redirect_uris.py Application.ReadWrite.All update app
List certificates with validity status applications/list_certificates.py Directory.Read.All app credentials
Grant app access to one SharePoint site (Sites.Selected) applications/grant_site_selected_permission.py SharePoint admin site permissions
Over-privileged service principals applications/high_privilege_service_principals.py Directory.Read.All role assignments
App sign-in activity applications/app_signins.py AuditLog.Read.All signIn list

Examples — Roles & Identity

Operation File Required role API reference
List directory roles roles/list.py RoleManagement.ReadWrite.Directory list roles
Get roles assigned to a user roles/for_user.py RoleManagement.ReadWrite.Directory user roles
Assign a role to a user roles/assign_role.py RoleManagement.ReadWrite.Directory assign role
List identity providers identity/list_provider.py IdentityProvider.Read.All list providers
List named locations identity/list_named_locations.py Policy.Read.All namedLocation list
List conditional access policies identity/list_conditional_access_policies.py Policy.Read.All conditionalAccessPolicy list
List self-service sign-up user flows identity/list_user_flows.py IdentityUserFlow.Read.All b2xUserFlows list
PIM report — privileged role assignments roles/pim_report.py RoleManagement.Read.All role assignments
Privileged-users report — every user and the admin roles they hold roles/privileged_users.py Directory.Read.All directoryRole list members

Examples — Policies

Operation File Required role API reference
Get authorization policy policies/get_auth_settings.py Policy.Read.All auth policy
List Conditional Access policies policies/conditional_access/list.py Policy.Read.All list CA policies
Get authentication methods policy policies/authentication_methods.py Policy.Read.All auth methods
Get admin consent request policy policies/admin_consent_request.py Policy.Read.All admin consent
Get device registration policy policies/device_registration.py Policy.Read.All device reg
Get cross-tenant access policy policies/cross_tenant_access.py Policy.Read.All cross-tenant
CA policy report — break-glass accounts, enforcement state policies/conditional_access/list.py Policy.Read.All CA policy list
Stale device report — devices without recent sign-in devices/stale_report.py Device.Read.All device list

Examples — Audit Logs

Operation File Required role API reference
List user sign-in logs audit/list_signins.py AuditLog.Read.All list signins
Risky users — Identity Protection review, risk detections, dismiss / confirm-compromise protection/risky_users.py IdentityRiskyUser.Read.All, IdentityRiskDetection.Read.All risky users
Access reviews — history definitions, instances, decisions, compliance reporting governance/access_reviews.py AccessReview.Read.All access reviews
Domain management — add, verify DNS, check service records domains/manage.py Domain.ReadWrite.All domains API
Auth methods — tenant MFA/passwordless readiness, per-user methods (FIDO2, phone, Authenticator) users/auth_methods.py UserAuthenticationMethod.Read.All, AuditLog.Read.All auth methods overview
Security alerts — list, filter, triage M365 Defender alerts, update classification/status ../security/alerts_triage.py SecurityAlert.ReadWrite.All security alerts
Change notifications — subscribe to Graph webhooks, manage subscription lifecycle subscriptions/change_notifications.py Depends on resource subscriptions
Terms of use — list agreements, track user acceptances, compliance check governance/terms_of_use.py Agreement.Read.All agreements

Quick start

from office365.graph_client import GraphClient

client = GraphClient(tenant="contoso.onmicrosoft.com").with_client_secret("client_id", "client_secret")

# List all users
users = client.users.top(10).get().execute_query()
for user in users:
    print(f"{user.user_principal_name:40s}  {user.display_name}")

Official docs