Integration · Security and identity
AI agents for Microsoft Entra ID
Find people and groups in Microsoft Entra ID (formerly Azure Active Directory), read a person's group and role memberships and their sign-in log, add or remove group members, and run leaver and incident steps.
- Actions
- 10
- Read
- 6
- Write
- 4
Actions
What your agents can do in Microsoft Entra ID
Find people and groups in Microsoft Entra ID (formerly Azure Active Directory), read a person's group and role memberships and their sign-in log, add or remove group members, and run leaver and incident steps: disable or re-enable an account and sign a person out of every session. Signed in as a Microsoft 365 admin.
Read 6
Look things up. Nothing changes.
Find users
Finds people in the directory.
Get a user
Reads one person by object ID or sign-in name (user principal name, usually their work email).
List a user's groups and roles
Lists the groups, directory roles and administrative units a person is a direct member of.
Find groups
Finds groups by name or email (search, matching the start of words) or an OData filter (securityEnabled eq true, mailEnabled eq true, groupTypes/any(c:c eq 'Unified')).
List a group's members
Lists the direct members of a group by its ID: people, devices, service principals and nested groups.
List sign-ins
Reads the Entra sign-in log since a time (Microsoft keeps 30 days with Entra ID P1 or P2, 7 days on the free tier), newest first, optionally for one person or only failures.
Write 4
Create, change or send.
Add someone to a group
Adds a person (or a device, group or service principal) to a security or Microsoft 365 group, by the group's ID and the member's object ID (from Find users).
Remove someone from a groupDeletes data
Removes a member from a group by the group's ID and the member's object ID, which takes away whatever the group grants (apps, licenses, sites, Teams).
Disable or enable an accountDeletes data
Blocks a person from signing in (enabled false), or lets them sign in again (enabled true), by object ID or sign-in name.
Sign out everywhereDeletes data
Ends every session a person has: refresh tokens and browser session cookies are invalidated, so apps ask them to sign in again (it can take a few minutes to reach every app).
A person can approve first
Any write action can be set to wait for a person's approval before it runs, so an agent asks before it changes anything. Actions that delete data ask first by default.
Connection
How it connects
Connect it once in the console, then give it to the agents and workflows that need it.
Sign in with Microsoft and approve access (OAuth).
Kept safe
- Credentials are stored encrypted with your organization's own keys.
- They are opened only by the process that makes the call, at the moment it runs, and never go into a prompt or the browser.
- Calls go only to the tool's own servers.
Ideas
Ideas to start with
Starting points made only from the actions above. Mix them with any other tool your agents can use.
- 01
Ask about your Microsoft Entra ID data
Ask a question in plain words. The agent can find users, get a user or list a user's groups and roles in Microsoft Entra ID, then answers with what it found.
- 02
Let an agent update Microsoft Entra ID
Have the agent add someone to a group or remove someone from a group in Microsoft Entra ID as part of a larger task. Turn on approval and a person signs off on each change first.
- 03
Share what it finds in Slack
Give one agent Microsoft Entra ID and Slack: it can find users in Microsoft Entra ID and post a summary to a Slack channel in the same run.
Works well with
More Security and identity tools
- Okta14 actionsFind people and read their groups, apps, MFA factors and sign-in history in Okta, list groups and members, and run joiner and leaver steps.
- Google Workspace Admin9 actionsManage people and groups in a Google Workspace domain.
- CrowdStrike Falcon8 actionsInvestigate and respond in CrowdStrike Falcon: search the hosts the Falcon sensor protects and read their details, network-contain a compromised host or lift containment, search and read alerts.
- Wiz7 actionsWork cloud security issues in Wiz: list open issues by severity or type, read one issue with the affected resource and its notes, move it to in progress, resolve or reject it with a reason, add a note.
- Vanta8 actionsTrack compliance in Vanta: see which automated tests are failing and the exact resources (users, buckets, laptops, repos) causing it, progress on each framework.
- 1Password4 actionsWatch a 1Password Business account's security activity through the Events API.
FAQ
Microsoft Entra ID and MyDeepAgents
Can MyDeepAgents connect to Microsoft Entra ID?
Yes. The Microsoft Entra ID connector has 10 actions: 6 read and 4 make changes. Your agents can call them as tools, and your workflows can run them as steps.
How do I connect Microsoft Entra ID?
Sign in with Microsoft and approve access (OAuth). Credentials are stored encrypted with your organization's own keys and are opened only at the moment of a call.
Can an agent change data in Microsoft Entra ID without asking?
Only if you let it. Each of the 4 actions that change data can be set to wait for a person's approval before it runs, and the 3 that delete data ask first by default.
Can I use Microsoft Entra ID in workflows as well as agents?
Yes. Every Microsoft Entra ID action also works as a step in a workflow, and the same connection serves your agents and your workflows.
Early access
Put Microsoft Entra ID to work
Connect it in a few minutes, give an agent the actions it needs, and decide which changes wait for a person.