Skip to content

Microsoft Entra ID

Examples for working with Microsoft Entra ID (formerly Azure AD) via the Microsoft Graph API — users, groups, applications, service principals, directory roles, policies, and audit logs.

Prerequisites

Requirement Description Reference
User.Read.All Read user profiles and directory data User permissions
User.ReadWrite.All Update users, reset passwords, manage licenses User permissions
User.Invite.All Invite guest users (B2B) User Invite permissions
Group.Read.All Read group members and properties Group permissions
Group.ReadWrite.All Create, manage, and delete groups Group permissions
Application.Read.All Read app registrations Application permissions
Application.ReadWrite.All Register and manage applications Application permissions
AppRoleAssignment.ReadWrite.All Grant and revoke API permissions AppRoleAssignment permissions
RoleManagement.ReadWrite.Directory Read and assign directory roles RoleManagement permissions
Policy.Read.All Read tenant policies Policy permissions
IdentityProvider.Read.All Read identity providers (SAML, social) IdentityProvider permissions
AuditLog.Read.All Read sign-in logs and audit logs AuditLog permissions
IdentityRiskyUser.Read.All Read risky users and risk detections Identity Protection permissions
AccessReview.Read.All Read access reviews history Access review permissions
Domain.ReadWrite.All Add and verify custom domains Domain permissions
UserAuthenticationMethod.Read.All Read registered MFA,FIDO2,passwordless methods Authentication methods permissions

Admin consent is required for most permissions above.

How Entra ID is organized

flowchart LR
    A[Tenant] --> B[Users]
    A --> C[Groups]
    A --> D[Applications / Service Principals]
    A --> E[Directory Roles]
    A --> F[Policies]
    A --> G[Identity Providers]
    A --> H[Audit Logs]

The Entra ID Graph API covers identity and access management — users, groups, app registrations, service principals, role assignments, tenant-level policies, and audit logs.

Examples — Users

Operation File Required role API reference
Import users from CSV users/import.py User.ReadWrite.All create user
Get total user count users/get_count.py User.Read.All get user
Get disabled user accounts users/get_disabled.py User.Read.All list users
Get users with expired passwords users/password_expiry_report.py User.Read.All list users
Get user's recent activities users/get_my_activities.py User.Read.All activities
Update a user's profile users/update.py User.ReadWrite.All update user
Update users in batch users/update_batch.py User.ReadWrite.All update user
Reset a user's password users/reset_password.py User.ReadWrite.All reset password
Assign a manager to a user users/assign_manager.py User.ReadWrite.All update manager
Get a user's manager users/get_manager.py User.Read.All get manager
Disable MFA for a user users/disable_mfa.py User.ReadWrite.All update authentication
Get assigned licenses licenses/get_licenses.py User.Read.All get license
Assign a license to a user licenses/assign.py User.ReadWrite.All assign license
Export users to file users/export.py User.Read.All list users
Export personal data (GDPR) users/export_personal_data.py User.Read.All export data
List app role assignments users/list_app_role_assignments.py User.Read.All app role assignments
Create a user users/create.py User.ReadWrite.All create user
Delete a user users/delete.py User.ReadWrite.All delete user
Get user's group memberships users/get_group_memberships.py User.Read.All memberOf
Invite a guest (B2B) user users/invite_guest.py User.Invite.All invitation
User report — sign-in activity, inactive, no MFA users/report.py User.Read.All, AuditLog.Read.All user list
MFA status report — users without strong auth registered users/mfa_status_report.py UserAuthenticationMethod.Read.All auth methods
Last sign-in report — users without recent sign-in users/last_signin_report.py User.Read.All, AuditLog.Read.All signInActivity
Find inactive guest accounts users/find_inactive_guests.py User.Read.All, AuditLog.Read.All user list
Break-glass account audit — CA exclusions, permanent Global Admins users/break_glass_report.py Policy.Read.All, RoleManagement.Read.All CA policies
Bulk assign licenses from CSV licenses/bulk_assign_license.py User.ReadWrite.All assign license

Examples — Groups

Operation File Required role API reference
Create a Microsoft 365 group groups/create_m365.py Group.ReadWrite.All create group
Create a security group groups/create_security.py Group.ReadWrite.All create group
Create a group with a team groups/create_with_team.py Group.ReadWrite.All create group
Update group properties groups/update_group.py Group.ReadWrite.All update group
List all groups groups/list.py Group.ReadWrite.All list groups
List group members groups/list_members.py Group.Read.All list members
Add/remove group members groups/add_member.py Group.ReadWrite.All group members
Add/remove group owners groups/add_owner.py Group.ReadWrite.All group owners
List group owners groups/list_owners.py Group.Read.All list owners
Delete groups by name groups/delete_groups.py Group.ReadWrite.All delete group
Delete groups in batch groups/delete_batch.py Group.ReadWrite.All delete group
Export groups to CSV groups/export_csv.py Group.Read.All list groups
Group lifecycle — owners, members, orphans groups/manage.py Group.Read.All, User.Read.All group list
Find orphaned groups — no owners or members groups/find_orphans.py Group.Read.All, User.Read.All group list
Group lifecycle policies groups/lifecycle_policies.py GroupLifecyclePolicy.ReadWrite.All lifecycle policy
Group membership changes audit — who was added/removed audit/group_membership_changes.py AuditLog.Read.All directory audit

Examples — Applications

Operation File Required role API reference
Register a new application applications/create.py Application.ReadWrite.All create app
List all applications applications/list.py Application.Read.All list apps
Get an application by client ID applications/get_by_app_id.py Application.ReadWrite.All get application
Add a certificate to an app applications/rotate_cert.py Application.ReadWrite.All add certificate
Add a client secret (password) applications/rotate_secret.py Application.ReadWrite.All add password
Check application permissions applications/has_application_perms.py AppRoleAssignment.ReadWrite.All app permissions
Check delegated permissions applications/has_delegated_perms.py AppRoleAssignment.ReadWrite.All delegated perms
List application permissions applications/list_application_perms.py AppRoleAssignment.ReadWrite.All list app perms
List delegated permissions applications/list_delegated_perms.py AppRoleAssignment.ReadWrite.All list delegated
Grant application permissions applications/grant_application_perms.py AppRoleAssignment.ReadWrite.All grant
Grant delegated permissions applications/grant_delegated_perms.py AppRoleAssignment.ReadWrite.All grant
Revoke application permissions applications/revoke_application_perms.py AppRoleAssignment.ReadWrite.All revoke
Revoke delegated permissions applications/revoke_delegated_perms.py AppRoleAssignment.ReadWrite.All revoke
Service principal report — apps, perms, expiring secrets applications/sp_report.py Application.Read.All SP list
App secret expiry report — certs/passwords expiring soon applications/credentials_report.py Application.Read.All app credentials
OAuth consent grants — review delegated permissions per app applications/consent_grants.py DelegatedPermissionGrant.Read.All consent grants
Find orphaned apps — registrations/SPs without owners applications/find_orphans.py Application.Read.All app list

Examples — Roles & Identity

Operation File Required role API reference
List directory roles roles/list.py RoleManagement.ReadWrite.Directory list roles
Get roles assigned to a user roles/for_user.py RoleManagement.ReadWrite.Directory user roles
Assign a role to a user roles/assign_role.py RoleManagement.ReadWrite.Directory assign role
List identity providers identity/list_provider.py IdentityProvider.Read.All list providers
List named locations identity/list_named_locations.py Policy.Read.All namedLocation list
List conditional access policies identity/list_conditional_access_policies.py Policy.Read.All conditionalAccessPolicy list
List self-service sign-up user flows identity/list_user_flows.py IdentityUserFlow.Read.All b2xUserFlows list
PIM report — privileged role assignments roles/pim_report.py RoleManagement.Read.All role assignments

Examples — Policies

Operation File Required role API reference
Get authorization policy policies/get_auth_settings.py Policy.Read.All auth policy
List Conditional Access policies policies/conditional_access/list.py Policy.Read.All list CA policies
Get authentication methods policy policies/authentication_methods.py Policy.Read.All auth methods
Get admin consent request policy policies/admin_consent_request.py Policy.Read.All admin consent
Get device registration policy policies/device_registration.py Policy.Read.All device reg
Get cross-tenant access policy policies/cross_tenant_access.py Policy.Read.All cross-tenant
CA policy report — break-glass accounts, enforcement state policies/conditional_access/list.py Policy.Read.All CA policy list
Stale device report — devices without recent sign-in devices/stale_report.py Device.Read.All device list

Examples — Audit Logs

Operation File Required role API reference
List user sign-in logs audit/list_signins.py AuditLog.Read.All list signins
Risky users — Identity Protection review, risk detections, dismiss / confirm-compromise protection/risky_users.py IdentityRiskyUser.Read.All, IdentityRiskDetection.Read.All risky users
Access reviews — history definitions, instances, decisions, compliance reporting governance/access_reviews.py AccessReview.Read.All access reviews
Domain management — add, verify DNS, check service records domains/manage.py Domain.ReadWrite.All domains API
Auth methods — tenant MFA/passwordless readiness, per-user methods (FIDO2, phone, Authenticator) users/auth_methods.py UserAuthenticationMethod.Read.All, AuditLog.Read.All auth methods overview
Security alerts — list, filter, triage M365 Defender alerts, update classification/status security/alerts.py SecurityAlert.ReadWrite.All security alerts
Change notifications — subscribe to Graph webhooks, manage subscription lifecycle governance/change_notifications.py Depends on resource subscriptions
Terms of use — list agreements, track user acceptances, compliance check governance/terms_of_use.py Agreement.Read.All agreements

Quick start

from office365.graph_client import GraphClient

client = GraphClient(tenant="contoso.onmicrosoft.com").with_client_secret(
    "client_id", "client_secret"
)

# List all users
users = client.users.top(10).get().execute_query()
for user in users:
    print(f"{user.user_principal_name:40s}  {user.display_name}")

Official docs