Microsoft Entra

Reference for the Tracecat Microsoft Entra integration: registered actions, required secrets, expected inputs, and example workflow usage.

Add user to group

Action ID: tools.microsoft_entra.add_user_to_group

Add a Microsoft Entra ID user to a group.

Reference: https://learn.microsoft.com/en-us/graph/api/group-post-members?view=graph-rest-1.0

Secrets

Optional secrets:

• microsoft_entra_oauth: OAuth token MICROSOFT_ENTRA_USER_TOKEN.
• microsoft_entra_oauth: OAuth token MICROSOFT_ENTRA_SERVICE_TOKEN.

Input fields

group_id · string · required

The unique identifier of the group.

user_id · string · required

The unique identifier of the user (directory object) to add.

api_version · string

Microsoft Graph API version.

Default: "v1.0".

base_url · string

Base URL for the Microsoft Graph API.

Default: "https://graph.microsoft.com".

Allowed values: https://graph.microsoft.com, https://graph.microsoft.us.

Create group

Action ID: tools.microsoft_entra.create_group

Create a Microsoft Entra ID group.

Reference: https://learn.microsoft.com/en-us/graph/api/group-post-groups?view=graph-rest-1.0

Secrets

Optional secrets:

• microsoft_entra_oauth: OAuth token MICROSOFT_ENTRA_USER_TOKEN.
• microsoft_entra_oauth: OAuth token MICROSOFT_ENTRA_SERVICE_TOKEN.

Input fields

group · object · required

Properties for the new group resource (displayName, mailEnabled, mailNickname, securityEnabled, etc.).

api_version · string

Microsoft Graph API version.

Default: "v1.0".

base_url · string

Base URL for the Microsoft Graph API.

Default: "https://graph.microsoft.com".

Allowed values: https://graph.microsoft.com, https://graph.microsoft.us.

Create user

Action ID: tools.microsoft_entra.create_user

Create a Microsoft Entra ID user account.

Reference: https://learn.microsoft.com/en-us/graph/api/user-post-users?view=graph-rest-1.0

Secrets

Optional secrets:

• microsoft_entra_oauth: OAuth token MICROSOFT_ENTRA_USER_TOKEN.
• microsoft_entra_oauth: OAuth token MICROSOFT_ENTRA_SERVICE_TOKEN.

Input fields

user · object · required

User properties for the request body (e.g. accountEnabled, displayName, mailNickname, userPrincipalName, passwordProfile).

api_version · string

Microsoft Graph API version.

Default: "v1.0".

base_url · string

Base URL for the Microsoft Graph API.

Default: "https://graph.microsoft.com".

Allowed values: https://graph.microsoft.com, https://graph.microsoft.us.

Delete group

Action ID: tools.microsoft_entra.delete_group

Delete a Microsoft Entra ID group.

Reference: https://learn.microsoft.com/en-us/graph/api/group-delete?view=graph-rest-1.0

Secrets

Optional secrets:

• microsoft_entra_oauth: OAuth token MICROSOFT_ENTRA_USER_TOKEN.
• microsoft_entra_oauth: OAuth token MICROSOFT_ENTRA_SERVICE_TOKEN.

Input fields

group_id · string · required

The unique identifier of the group to delete.

api_version · string

Microsoft Graph API version.

Default: "v1.0".

base_url · string

Base URL for the Microsoft Graph API.

Default: "https://graph.microsoft.com".

Allowed values: https://graph.microsoft.com, https://graph.microsoft.us.

Delete user

Action ID: tools.microsoft_entra.delete_user

Delete a Microsoft Entra ID user.

Reference: https://learn.microsoft.com/en-us/graph/api/user-delete?view=graph-rest-1.0

Secrets

Optional secrets:

• microsoft_entra_oauth: OAuth token MICROSOFT_ENTRA_USER_TOKEN.
• microsoft_entra_oauth: OAuth token MICROSOFT_ENTRA_SERVICE_TOKEN.

Input fields

user_id · string · required

The unique identifier of the user to delete.

api_version · string

Microsoft Graph API version.

Default: "v1.0".

base_url · string

Base URL for the Microsoft Graph API.

Default: "https://graph.microsoft.com".

Allowed values: https://graph.microsoft.com, https://graph.microsoft.us.

Get group

Action ID: tools.microsoft_entra.get_group

Retrieve details for a Microsoft Entra ID group.

Reference: https://learn.microsoft.com/en-us/graph/api/group-get?view=graph-rest-1.0

Secrets

Optional secrets:

• microsoft_entra_oauth: OAuth token MICROSOFT_ENTRA_USER_TOKEN.
• microsoft_entra_oauth: OAuth token MICROSOFT_ENTRA_SERVICE_TOKEN.

Input fields

group_id · string · required

The unique identifier of the group to retrieve.

api_version · string

Microsoft Graph API version.

Default: "v1.0".

base_url · string

Base URL for the Microsoft Graph API.

Default: "https://graph.microsoft.com".

Allowed values: https://graph.microsoft.com, https://graph.microsoft.us.

expand · array[string]

Optional related entities to expand in the response.

Default: null.

select · array[string]

Optional set of group properties to return.

Default: null.

Get user

Action ID: tools.microsoft_entra.get_user

Retrieve details for a Microsoft Entra ID user.

Reference: https://learn.microsoft.com/en-us/graph/api/user-get?view=graph-rest-1.0

Secrets

Optional secrets:

• microsoft_entra_oauth: OAuth token MICROSOFT_ENTRA_USER_TOKEN.
• microsoft_entra_oauth: OAuth token MICROSOFT_ENTRA_SERVICE_TOKEN.

Input fields

user_id · string · required

The unique identifier of the user to retrieve.

api_version · string

Microsoft Graph API version.

Default: "v1.0".

base_url · string

Base URL for the Microsoft Graph API.

Default: "https://graph.microsoft.com".

Allowed values: https://graph.microsoft.com, https://graph.microsoft.us.

expand · array[string]

Optional related entities to expand in the response.

Default: null.

select · array[string]

Optional set of user properties to return.

Default: null.

Get user ID by email

Action ID: tools.microsoft_entra.get_user_id_by_email

Get a user’s ID by searching for their email address in mail or userPrincipalName.

Reference: https://learn.microsoft.com/en-us/graph/api/user-list?view=graph-rest-1.0

Secrets

Optional secrets:

• microsoft_entra_oauth: OAuth token MICROSOFT_ENTRA_USER_TOKEN.
• microsoft_entra_oauth: OAuth token MICROSOFT_ENTRA_SERVICE_TOKEN.

Input fields

email · string · required

The email address to search for.

api_version · string

Microsoft Graph API version.

Default: "v1.0".

base_url · string

Base URL for the Microsoft Graph API.

Default: "https://graph.microsoft.com".

Allowed values: https://graph.microsoft.com, https://graph.microsoft.us.

List groups

Action ID: tools.microsoft_entra.list_groups

List Microsoft Entra ID groups with optional OData queries.

Reference: https://learn.microsoft.com/en-us/graph/api/group-list?view=graph-rest-1.0

Secrets

Optional secrets:

• microsoft_entra_oauth: OAuth token MICROSOFT_ENTRA_USER_TOKEN.
• microsoft_entra_oauth: OAuth token MICROSOFT_ENTRA_SERVICE_TOKEN.

Input fields

api_version · string

Microsoft Graph API version.

Default: "v1.0".

base_url · string

Base URL for the Microsoft Graph API.

Default: "https://graph.microsoft.com".

Allowed values: https://graph.microsoft.com, https://graph.microsoft.us.

consistency_level_eventual · boolean

Set ConsistencyLevel=eventual for advanced queries when required by Microsoft Graph.

Default: false.

expand · array[string]

Optional related entities to expand in the response.

Default: null.

filter · string

Optional OData $filter expression.

Default: null.

max_page_size · integer

Optional maximum page size to request via Prefer=odata.maxpagesize.

Default: null.

orderby · string

Optional OData $orderby expression.

Default: null.

search · string

Optional search phrase. Use quoted property names as documented, for example “displayName:Engineering”.

Default: null.

select · array[string]

Optional set of group properties to return.

Default: null.

skip_token · string

Opaque continuation token from a previous response ($skiptoken).

Default: null.

top · integer

Maximum number of results to return in a single page ($top).

Default: null.

List users

Action ID: tools.microsoft_entra.list_users

List Microsoft Entra ID users with optional OData query parameters.

Reference: https://learn.microsoft.com/en-us/graph/api/user-list?view=graph-rest-1.0

Secrets

Optional secrets:

• microsoft_entra_oauth: OAuth token MICROSOFT_ENTRA_USER_TOKEN.
• microsoft_entra_oauth: OAuth token MICROSOFT_ENTRA_SERVICE_TOKEN.

Input fields

api_version · string

Microsoft Graph API version.

Default: "v1.0".

base_url · string

Base URL for the Microsoft Graph API.

Default: "https://graph.microsoft.com".

Allowed values: https://graph.microsoft.com, https://graph.microsoft.us.

consistency_level_eventual · boolean

Set ConsistencyLevel=eventual for advanced queries when required by Microsoft Graph.

Default: false.

count · boolean

Include @odata.count in the response by setting $count=true.

Default: false.

expand · array[string]

Optional related entities to expand in the response.

Default: null.

filter · string

Optional OData $filter expression.

Default: null.

max_page_size · integer

Optional maximum page size to request via Prefer=odata.maxpagesize.

Default: null.

orderby · string

Optional OData $orderby expression.

Default: null.

search · string

Optional search phrase. Use quoted property names per Microsoft Graph syntax, for example “displayName:Alex”.

Default: null.

select · array[string]

Optional set of user properties to return.

Default: null.

skip_token · string

Opaque continuation token from a previous response ($skiptoken).

Default: null.

top · integer

Maximum number of results to return in a single page ($top).

Default: null.

Remove user from group

Action ID: tools.microsoft_entra.remove_user_from_group

Remove a Microsoft Entra ID user from a group.

Reference: https://learn.microsoft.com/en-us/graph/api/group-delete-members?view=graph-rest-1.0

Secrets

Optional secrets:

• microsoft_entra_oauth: OAuth token MICROSOFT_ENTRA_USER_TOKEN.
• microsoft_entra_oauth: OAuth token MICROSOFT_ENTRA_SERVICE_TOKEN.

Input fields

group_id · string · required

The unique identifier of the group.

user_id · string · required

The unique identifier of the user (directory object) to remove.

api_version · string

Microsoft Graph API version.

Default: "v1.0".

base_url · string

Base URL for the Microsoft Graph API.

Default: "https://graph.microsoft.com".

Allowed values: https://graph.microsoft.com, https://graph.microsoft.us.

Update group

Action ID: tools.microsoft_entra.update_group

Update properties on a Microsoft Entra ID group.

Reference: https://learn.microsoft.com/en-us/graph/api/group-update?view=graph-rest-1.0

Secrets

Optional secrets:

• microsoft_entra_oauth: OAuth token MICROSOFT_ENTRA_USER_TOKEN.
• microsoft_entra_oauth: OAuth token MICROSOFT_ENTRA_SERVICE_TOKEN.

Input fields

group_id · string · required

The unique identifier of the group to update.

updates · object · required

Group properties to update as defined in the Microsoft Graph group resource.

api_version · string

Microsoft Graph API version.

Default: "v1.0".

base_url · string

Base URL for the Microsoft Graph API.

Default: "https://graph.microsoft.com".

Allowed values: https://graph.microsoft.com, https://graph.microsoft.us.

Update user

Action ID: tools.microsoft_entra.update_user

Update properties on a Microsoft Entra ID user.

Reference: https://learn.microsoft.com/en-us/graph/api/user-update?view=graph-rest-1.0

Secrets

Optional secrets:

• microsoft_entra_oauth: OAuth token MICROSOFT_ENTRA_USER_TOKEN.
• microsoft_entra_oauth: OAuth token MICROSOFT_ENTRA_SERVICE_TOKEN.

Input fields

updates · object · required

User properties to update as defined in the Microsoft Graph user resource.

user_id · string · required

The unique identifier of the user to update.

api_version · string

Microsoft Graph API version.

Default: "v1.0".

base_url · string

Base URL for the Microsoft Graph API.

Default: "https://graph.microsoft.com".

Allowed values: https://graph.microsoft.com, https://graph.microsoft.us.