Overview
Azure Entra ID (formerly Azure Active Directory) is Microsoft's identity + access management platform. The Automize Entra ID connector covers users, groups, applications, service principals, and audit logs.
- Regions: Global service. Tenant lives in one regional cluster but APIs are multi-region.
- Plans: Free tier + paid (P1, P2) for advanced features (Conditional Access, PIM, Identity Protection).
Setting up the connection
Auth type: OAuth 2.0 (Authorization Code).
- Entra ID → App registrations → New registration.
- API permissions: Microsoft Graph → Application permissions → User.Read.All, Group.Read.All, Directory.Read.All etc. Grant admin consent.
- Set Redirect URI from Automize Entra ID dialog.
- Copy Application ID + Client Secret.
- In Automize → Settings → Connectors → Azure Entra ID. Paste credentials + tenant ID.
Find your credentials at https://entra.microsoft.com/.
Rate limits
Microsoft Graph rate limits (~10k req/10 min per app per tenant). Connector retries 429 + 503 with Retry-After.
Data model
Identity primitives:
Tenant ─┬─ Users
├─ Groups (security + Microsoft 365)
├─ Applications (app registrations)
├─ Service Principals (apps + managed identities)
└─ Audit Logs / Sign-in LogsAvailable operations
22 operations available. Click any row to jump to its detail.
| Operation | Category | What it does |
|---|---|---|
| Add Group Member | General | Add a member to a group |
| Assign License | General | Assign or remove licenses for a user |
| Create Group | General | Create a new group |
| Create User | General | Create a new user |
| Delete Group | General | Delete a group |
| Delete User | General | Delete a user |
| Get Application | General | Get app registration details |
| Get Group | General | Get group details |
| Get User | General | Get user details by ID or UPN |
| List Applications | General | List app registrations |
| List Audit Logs | General | List directory audit logs |
| List Deleted Users | General | List recently deleted users |
| List Directory Roles | General | List activated directory roles |
| List Domains | General | List verified domains |
| List Group Members | General | List members of a group |
| List Groups | General | List all groups |
| List Service Principals | General | List service principals |
| List Sign-Ins | General | List sign-in activity logs |
| List Users | General | List all users in the directory |
| Remove Group Member | General | Remove a member from a group |
| Restore Deleted User | General | Restore a deleted user |
| Update User | General | Update user properties |
Operations
Add Group Member
Add a member to a group
| Parameter | Required | Type | Description |
|---|---|---|---|
Group Id group_id | Yes | text |
Assign License
Assign or remove licenses for a user
| Parameter | Required | Type | Description |
|---|---|---|---|
User Id user_id | Yes | text |
Create Group
Create a new group
No input parameters.
Create User
Create a new user
No input parameters.
Tips
- accountEnabled + displayName + userPrincipalName + mailNickname + passwordProfile required.
- Bulk create via Microsoft Graph batch endpoint (separate API).
Delete Group
Delete a group
| Parameter | Required | Type | Description |
|---|---|---|---|
Group Id group_id | Yes | text |
Delete User
Delete a user
| Parameter | Required | Type | Description |
|---|---|---|---|
User Id user_id | Yes | text |
Get Application
Get app registration details
| Parameter | Required | Type | Description |
|---|---|---|---|
Application Id application_id | Yes | text |
Get Group
Get group details
| Parameter | Required | Type | Description |
|---|---|---|---|
Group Id group_id | Yes | text |
Get User
Get user details by ID or UPN
| Parameter | Required | Type | Description |
|---|---|---|---|
User Id user_id | Yes | text |
List Applications
List app registrations
No input parameters.
Tips
- App registrations. Different from Service Principals (which are tenant instances of apps).
List Audit Logs
List directory audit logs
No input parameters.
Tips
- Filter via $filter on activityDateTime, initiatedBy, etc.
- 30-day retention default. Stream to Log Analytics for longer.
List Deleted Users
List recently deleted users
No input parameters.
List Directory Roles
List activated directory roles
No input parameters.
List Domains
List verified domains
No input parameters.
List Group Members
List members of a group
| Parameter | Required | Type | Description |
|---|---|---|---|
Group Id group_id | Yes | text |
List Groups
List all groups
No input parameters.
Tips
- Filter by groupTypes (Unified for M365 groups, securityEnabled for security groups).
List Service Principals
List service principals
No input parameters.
List Sign-Ins
List sign-in activity logs
No input parameters.
List Users
List all users in the directory
No input parameters.
Tips
- Pages via $top + $skiptoken. Filter via $filter (e.g. accountEnabled eq true).
- Returns up to 100 users per page (max 999 with $top).
Remove Group Member
Remove a member from a group
| Parameter | Required | Type | Description |
|---|---|---|---|
Group Id group_id | Yes | text | |
Member Id member_id | Yes | text |
Restore Deleted User
Restore a deleted user
| Parameter | Required | Type | Description |
|---|---|---|---|
User Id user_id | Yes | text |
Update User
Update user properties
| Parameter | Required | Type | Description |
|---|---|---|---|
User Id user_id | Yes | text |
Tips
- PATCH-style. Changing userPrincipalName triggers Entra-wide propagation (5-30 min).
FAQ
- Delegated vs Application permissions?
- Delegated: acts as a signed-in user. Application: acts as the app itself (no user). Automation usually wants Application (Client Credentials flow).
- Sign-in logs vs Audit logs?
- Sign-in logs: authentication events. Audit logs: directory changes (user created, role assigned, etc.).