Entra ID

Azure integration · 25 node(s).

00Overview

Manage your Microsoft Entra ID directory straight from a flow — create, update, delete and restore users, invite external B2B guests, and revoke a user's sessions the moment they leave or an account is compromised. Build and maintain groups, add or remove members in bulk, set managers, and check exactly who belongs to what, including nested memberships. Read the tenant's subscribed licence SKUs and assign or remove them, so a joiner-mover-leaver process can run end to end without anyone opening the admin centre.

Every field below is exactly what you see in the Flomation editor. Fields marked ● live picker let you choose from a list pulled live from your account — no IDs to look up.

01Connecting Entra ID

In the Microsoft Entra admin center, go to Identity → Applications → App registrations → New registration, give the app a name and register it. On the app's Overview page, copy the Directory (tenant) ID into Tenant ID and the Application (client) ID into Client ID.
Open API permissions → Add a permission → Microsoft Graph → Application permissions and add the permissions for the actions you plan to use (for example User.ReadWrite.All, Group.ReadWrite.All, GroupMember.ReadWrite.All, Organization.Read.All). Each action's reference row lists the exact permission it needs. Then click Grant admin consent — app-only permissions do nothing until an admin consents.
Open Certificates & secrets → New client secret, add one, and copy its Value straight away — the secret Value, not its Secret ID, and it is only shown once.
In Flomation, store that value as an environment secret (e.g. entra_secret) and pick it in the node's Client Secret field. Leave Graph Endpoint blank for a standard tenant; set it only to reach a sovereign cloud (e.g. https://graph.microsoft.us), and the sign-in is scoped to that host automatically.

Field	Type		Details
Client Secret	`secret`	Required	App registration ▸ Certificates & secrets — the secret Value, not its ID
Tenant ID	`string`	Required	Directory (tenant) ID — a GUID or your-tenant.onmicrosoft.com
Client ID	`string`	Required	Application (client) ID of the app registration
Graph Endpoint	`string`		https://graph.microsoft.com — override for sovereign clouds (e.g. https://graph.microsoft.us)

Pick an Environment on your flow (Flow Settings → Environment) so the secret resolves. Secret fields never show the value — they reference ${secrets.your_secret}.

02Deleted

Entra ID: Restore Deleted Object

azure/entra/deleted_item_restore · Action

Restore a soft-deleted user or Microsoft 365 group from the directory recycle bin (objects stay restorable for 30 days after deletion). Requires the User.ReadWrite.All (users) or Group.ReadWrite.All (groups) application permission.

Field	Type		Details
Deleted Object ID	`string`	Required	Object ID (GUID) of the deleted user or group

Returns: id, result, tool_result, success, error

03Group

Entra ID: Add Group Members

azure/entra/group_add_members · Action

Add many users to a group in one action. Graph accepts at most 20 member references per request, so longer lists are batched automatically. A user who is already a member fails the whole batch — the error says how far it got. Requires the GroupMember.ReadWrite.All application permission.

Field	Type		Details
Group ID	`string`	Required	Group object ID (GUID)
User IDs	`string`	Required	Comma-separated user object IDs (batched 20 per request)

Returns: id, result, tool_result, success, error

Entra ID: Create Group

azure/entra/group_create · Action

Create a Security or Microsoft 365 group. Setting a Dynamic Membership Rule makes the group dynamic (rule processing is switched on). Requires the Group.ReadWrite.All application permission.

Field	Type		Details
Display Name	`string`	Required	Sales Team (max 256 characters)
Mail Nickname	`string`	Required	sales-team — local part only, no @ (max 64 characters)
Group Type	`string`		choices: Security, Microsoft 365
Description	`text`
Visibility	`string`		choices: Default (tenant setting), Public, Private
Dynamic Membership Rule	`text`		(user.department -eq "Sales") — setting a rule makes the group dynamic and turns rule processing on
Owners	`string`		Comma-separated user object IDs to set as owners
Additional Fields (JSON)	`object`		{"isAssignableToRole":true,"preferredDataLocation":"EUR"}

Returns: id, result, tool_result, success, error

Entra ID: Delete Group

azure/entra/group_delete · Action

Delete a Microsoft Entra ID group. A Microsoft 365 group moves to the directory recycle bin for 30 days (restorable with Restore Deleted Object); a Security group is deleted permanently. Requires the Group.ReadWrite.All application permission.

Field	Type		Details
Group ID	`string`	Required	Group object ID (GUID)

Returns: id, result, tool_result, success, error

Entra ID: Get Group

azure/entra/group_get · Action

Get one Microsoft Entra ID group by object ID. Narrow the returned properties with Select Fields. Requires the Group.Read.All application permission.

Field	Type		Details
Group ID	`string`	Required	Group object ID (GUID)
Select Fields	`string`		Comma-separated properties, e.g. id,displayName,visibility — leave blank for Graph's default set

Returns: id, result, tool_result, success, error

Entra ID: Get Many Groups

azure/entra/group_get_all · Action

List Microsoft Entra ID groups with raw OData $filter/$search passthrough. Advanced queries (endsWith, filter on null, $search) work — ConsistencyLevel: eventual and $count=true are sent on every request. Requires the Group.Read.All application permission.

Field	Type	Details
Filter ($filter)	`string`	startswith(displayName,'Sales') — raw OData filter; advanced operators supported
Search ($search)	`string`	"displayName:sales" — quoted property:value clauses
Select Fields	`string`	Comma-separated properties, e.g. id,displayName,mailNickname
Return All (follow every page)	`boolean`
Limit	`integer`	50 (max 999); ignored when Return All is on

Returns: results, count, tool_result, success, error

Entra ID: List Group Members

azure/entra/group_list_members · Action

List a group's members with proper paging. Turn on Transitive to include members inherited through nested groups. Requires the GroupMember.Read.All application permission.

Field	Type		Details
Group ID	`string`	Required	Group object ID (GUID)
Include Transitive (nested) Members	`boolean`		Also return members inherited through nested groups
Select Fields	`string`		Comma-separated properties, e.g. id,displayName,userPrincipalName
Return All (follow every page)	`boolean`
Limit	`integer`		50 (max 999); ignored when Return All is on

Returns: results, count, tool_result, success, error

Entra ID: List Group Owners

azure/entra/group_list_owners · Action

List a group's owners — the users allowed to manage it. Requires the Group.Read.All application permission.

Field	Type		Details
Group ID	`string`	Required	Group object ID (GUID)
Return All (follow every page)	`boolean`
Limit	`integer`		50 (max 999); ignored when Return All is on

Returns: results, count, tool_result, success, error

Entra ID: Remove Group Member

azure/entra/group_remove_member · Action

Remove one member from a group. The member itself is untouched. Requires the GroupMember.ReadWrite.All application permission.

Field	Type		Details
Group ID	`string`	Required	Group object ID (GUID)
Member (User ID)	`string`	Required	User object ID (GUID) to remove

Returns: id, result, tool_result, success, error

Entra ID: Update Group

azure/entra/group_update · Action

Update a Microsoft Entra ID group's properties (description, displayName, visibility, membershipRule, …) as raw JSON. Requires the Group.ReadWrite.All application permission.

Field	Type		Details
Group ID	`string`	Required	Group object ID (GUID)
Update Fields (JSON)	`object`	Required	{"description":"Handles inbound sales","visibility":"Private"}

Returns: id, result, tool_result, success, error

04Guest

Entra ID: Invite Guest

azure/entra/guest_invite · Action

Invite an external (B2B) guest user by email. A guest account is created immediately; the redeem link is returned so you can send it yourself if you turn the invitation email off. Requires the User.Invite.All application permission.

Field	Type		Details
Email Address	`string`	Required	guest@partner.com
Redirect URL	`string`		https://myapplications.microsoft.com (default) — where the guest lands after redeeming
Display Name	`string`		Shown in the directory and the invitation email
Send Invitation Email	`boolean`		On (default): Microsoft emails the invite; off: use the returned redeem URL yourself
Custom Message	`text`		Personal note included in the invitation email

Returns: id, result, invite_redeem_url, invited_user_id, tool_result, success, error

05Subscribed

Entra ID: Get Subscribed SKUs

azure/entra/subscribed_skus_get_all · Action

List the licence SKUs the tenant has subscribed to — skuId, skuPartNumber, consumed vs available units. Feed the skuId GUIDs into Assign License. Requires the Organization.Read.All application permission.

Returns: results, count, tool_result, success, error

06User

Entra ID: Add User to Group

azure/entra/user_add_to_group · Action

Add one user to a group's members. Adding a user who is already a member fails softly with a clear message. To add several users at once, use Add Group Members. Requires the GroupMember.ReadWrite.All application permission.

Field	Type		Details
Group ID	`string`	Required	Group object ID (GUID)
User ID	`string`	Required	User object ID (GUID)

Returns: id, result, tool_result, success, error

Entra ID: Assign License

azure/entra/user_assign_license · Action

Add and/or remove licence SKUs on a user. Find skuId GUIDs with Get Subscribed SKUs. The user must have a usageLocation set first, or Graph refuses the assignment (the error says how to fix it). Requires the User.ReadWrite.All application permission.

Field	Type		Details
User ID or UPN	`string`	Required	Object ID (GUID) or jane.doe@your-tenant.onmicrosoft.com
Add SKU IDs	`string`		Comma-separated skuId GUIDs to assign (see Get Subscribed SKUs)
Remove SKU IDs	`string`		Comma-separated skuId GUIDs to remove
Disabled Plans	`string`		Comma-separated servicePlanId GUIDs to disable on the ADDED SKUs

Returns: id, result, tool_result, success, error

Entra ID: Check Group Membership

azure/entra/user_check_group_membership · Action

Check whether a user is a member of the given groups (transitive — nested membership counts). Is Member is true when the user is in ANY of the listed groups; Member Of lists exactly which ones matched. Graph checks at most 20 group IDs per call, so longer lists are batched automatically. Requires the User.Read.All and GroupMember.Read.All application permissions.

Field	Type		Details
User ID or UPN	`string`	Required	Object ID (GUID) or jane.doe@your-tenant.onmicrosoft.com
Group IDs	`string`	Required	Comma-separated group object IDs (checked in batches of 20)

Returns: id, result, member_of, is_member, tool_result, success, error

Entra ID: Create User

azure/entra/user_create · Action

Create a Microsoft Entra ID user with an initial password. Set any other Graph property (givenName, surname, jobTitle, department, usageLocation, …) via Additional Fields. Requires the User.ReadWrite.All application permission (admin-consented).

Field	Type		Details
Display Name	`string`	Required	Jane Doe (max 256 characters)
User Principal Name	`string`	Required	jane.doe@your-tenant.onmicrosoft.com
Mail Nickname	`string`	Required	jane.doe — local part only, no @ (max 64 characters)
Password	`secret`	Required	Initial password — must meet the tenant's password policy
Account Enabled	`boolean`		On (default): the user can sign in immediately
Force Password Change	`boolean`		Require a new password at next sign-in
Additional Fields (JSON)	`object`		{"givenName":"Jane","surname":"Doe","jobTitle":"Engineer","department":"R&D","usageLocation":"GB"}

Returns: id, result, tool_result, success, error

Entra ID: Delete User

azure/entra/user_delete · Action

Delete a Microsoft Entra ID user. The user moves to the directory recycle bin for 30 days and can be brought back with Restore Deleted Object. Requires the User.ReadWrite.All application permission.

Field	Type		Details
User ID or UPN	`string`	Required	Object ID (GUID) or jane.doe@your-tenant.onmicrosoft.com

Returns: id, result, tool_result, success, error

Entra ID: Get User

azure/entra/user_get · Action

Get one Microsoft Entra ID user by object ID or userPrincipalName. Returns a rich default property set (Graph only returns a handful without an explicit $select); narrow it with Select Fields. Requires the User.Read.All application permission.

Field	Type		Details
User ID or UPN	`string`	Required	Object ID (GUID) or jane.doe@your-tenant.onmicrosoft.com
Select Fields	`string`		Comma-separated properties, e.g. id,displayName,mail — leave blank for the rich default set

Returns: id, result, tool_result, success, error

Entra ID: Get Many Users

azure/entra/user_get_all · Action

List Microsoft Entra ID users with raw OData $filter/$search passthrough. Advanced queries (endsWith, filter on null, $search) work — ConsistencyLevel: eventual and $count=true are sent on every request. Requires the User.Read.All application permission.

Field	Type	Details
Filter ($filter)	`string`	startswith(displayName,'A') — raw OData filter; advanced operators supported
Search ($search)	`string`	"displayName:smith" — quoted property:value clauses
Select Fields	`string`	Comma-separated properties, e.g. id,displayName,userPrincipalName
Return All (follow every page)	`boolean`
Limit	`integer`	50 (max 999); ignored when Return All is on

Returns: results, count, tool_result, success, error

Entra ID: Get Manager

azure/entra/user_get_manager · Action

Get a user's manager. A user with no manager assigned fails softly with a clear message, so a flow can branch on it. Requires the User.Read.All application permission.

Field	Type		Details
User ID or UPN	`string`	Required	Object ID (GUID) or jane.doe@your-tenant.onmicrosoft.com

Returns: id, result, tool_result, success, error

Entra ID: List User's Groups

azure/entra/user_list_groups · Action

List the groups (and directory roles) a user is a member of. Turn on Transitive to include nested memberships — groups the user is in via other groups. Requires the User.Read.All and GroupMember.Read.All application permissions.

Field	Type		Details
User ID or UPN	`string`	Required	Object ID (GUID) or jane.doe@your-tenant.onmicrosoft.com
Include Transitive (nested) Memberships	`boolean`		Also return groups the user belongs to through other groups
Return All (follow every page)	`boolean`
Limit	`integer`		50 (max 999); ignored when Return All is on

Returns: results, count, tool_result, success, error

Entra ID: Remove User from Group

azure/entra/user_remove_from_group · Action

Remove a user from a group's members. The user itself is untouched. Requires the GroupMember.ReadWrite.All application permission.

Field	Type		Details
Group ID	`string`	Required	Group object ID (GUID)
User ID	`string`	Required	User object ID (GUID)

Returns: id, result, tool_result, success, error

Entra ID: Revoke Sign-In Sessions

azure/entra/user_revoke_sessions · Action

Invalidate all of a user's refresh tokens and session cookies, forcing sign-in everywhere — the standard leaver / compromised-account response. Access tokens already issued stay valid until they expire (up to ~1 hour). Requires the User.ReadWrite.All application permission.

Field	Type		Details
User ID or UPN	`string`	Required	Object ID (GUID) or jane.doe@your-tenant.onmicrosoft.com

Returns: id, result, tool_result, success, error

Entra ID: Set Manager

azure/entra/user_set_manager · Action

Assign a user's manager — the core HR-driven provisioning step. Requires the User.ReadWrite.All application permission.

Field	Type		Details
User ID or UPN	`string`	Required	The user whose manager is being set
Manager (User ID)	`string`	Required	Object ID (GUID) of the manager

Returns: id, result, tool_result, success, error

Entra ID: Update User

azure/entra/user_update · Action

Update a Microsoft Entra ID user. Common toggles are first-class; any other Graph property goes in Update Fields (which wins on a key set both ways). SharePoint-backed personal properties (aboutMe, birthday, skills, …) cannot be set app-only and are not supported. Requires the User.ReadWrite.All application permission.

Field	Type		Details
User ID or UPN	`string`	Required	Object ID (GUID) or jane.doe@your-tenant.onmicrosoft.com
Account Enabled	`boolean`		Tick to enable / untick to disable; leave untouched to keep the current state
Display Name	`string`
Job Title	`string`
Department	`string`
Update Fields (JSON)	`object`	Required	{"givenName":"Jane","usageLocation":"GB"} — any Graph user property

Returns: id, result, tool_result, success, error

07Notes & Limitations

Behaviours and constraints worth knowing before you build with these nodes.

The node signs in app-only using a client secret rather than a signed-in user, so every permission it needs must be added as an application permission on the app registration and then admin-consented; delegated or user-consented permissions are never used and will not work.
Microsoft Graph is eventually consistent on writes, so an object you create in one step can be briefly unreadable by the very next step that uses its ID; a create step already waits a short while for its own object to become readable, but if a flow still races add a short Delay before the dependent action.
The SharePoint-backed personal profile properties such as aboutMe, birthday, interests and skills cannot be written over an app-only connection, so they are deliberately not supported and cannot be changed through Update User.
Return All follows Graph's paging up to a 100-page safety cap of roughly 100,000 objects; on a very large tenant it stops there and tells you it did, so narrow the filter to retrieve everything beyond that.