Microsoft Graph User

Retrieves the direct reports for a user. Direct reports are the people who have that user configured as their manager.

Disables a user from all Office 365 applications, and prevents sign in. Note: This command disables the user but does not terminate an existing session. Supported only in a self deployed app flow with the Permission: Directory.AccessAsUser.All(Delegated).

Assigns a manager to the specified user. Permission: - User.ReadWrite (Delegated) or - User.ReadWrite (Application).

Run this command if for some reason you need to rerun the authentication process.

Deletes a Microsoft Authenticator authentication method from a user. Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Lists the Microsoft Authenticator authentication methods registered to a user, or retrieves a specific method by ID. Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Changes the user password. Supported only in a self deployed app flow with the Permission: Directory.AccessAsUser.All(Delegated).

Changes the password of an on-premise user. See documentation for full permissions and roles to execute this command. Providing a password is required (password auto-generation is not supported).

Creates a new user. Permissions: - User.ReadWrite.All (Delegated & Application).

Issue a new access token for the MFA app.

Issue a new client secret for the MFA app.

Deletes an existing user. Permissions: - Directory.AccessAsUser.All (Delegated) - User.ReadWrite.All (Application).

Deletes an email authentication method from a user. Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Lists the email authentication methods registered to a user, or retrieves a specific email method by ID. Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Deletes a FIDO2 authentication method from a user. Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Lists the FIDO2 authentication methods registered to a user or retrieves a specific method by ID. Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All

Forces a user to reset their password the next time they log in. Note that this action does not terminate the user’s current session. If you also want to force the user to sign in again, use the msgraph-user-session-revoke command. This operation is supported only when using a self-deployed app flow with the Directory.AccessAsUser.All and User-PasswordProfile.ReadWrite.All delegated permissions. For further info, see https://learn.microsoft.com/en-us/graph/api/user-update?view=graph-rest-1.0&tabs=http#example-3-update-the-passwordprofile-of-a-user-and-reset-their-password Furthermore, the signed in user must have a higher privileged administrator role than the user who's password is being reset. The admin hierarchy table can be viewed here: https://learn.microsoft.com/en-us/graph/api/resources/users?view=graph-rest-1.0#who-can-reset-passwords

Generate the login url used for Authorization code flow.

Retrieves the properties and relationships of a user object. For more information, visit: https://learn.microsoft.com/en-us/graph/api/user-get?view=graph-rest-1.0&tabs=http. Permissions: - User.Read (Delegated) - User.Read.All (Application).

Retrieve a list of authentication methods registered to a user.

Deprecated. This command only returns a single page. Use the msgraph-user-list command instead, which gets newly created, updated, or deleted users without performing a full read of the entire user collection. Permissions: - User.Read (Delegated) - User.Read.All (Application).

Retrieves the groups a user is part of.

Retrieves the properties from the manager of a user.

Retrieves the authentication preferences for a user, including the default method.

Retrieves a list of user objects. Permissions: - User.ReadBasic.All (Delegated) - User.Read.All (Application).

Lists the devices that are owned by the user. Permission: User.Read.All,Directory.Read.All - Delegated

Deletes a phone authentication method from a user. Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Lists the phone authentication methods registered to a user, or retrieves a specific phone method by ID. Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Pops a synchronous MFA request for the given user. This is a blocking call that waits for user response or timeout.

Revoke a user session by invalidating all refresh tokens issued to applications for a user. This command requires an administrator role. Permission required: Directory.AccessAsUser.All (Delegated).

Deletes a software OATH authentication method from a user. Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Lists the software OATH authentication methods registered to a user, or retrieves a specific method by ID. Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Create a new TAP policy for a user. During the command execution, a password-protected zip file will be generated, including the new TAP password. You can download the file, use your password to unlock it, and get the TAP password. A user can only have one Temporary Access Pass that's usable within its specified lifetime. Permission:UserAuthenticationMethod.ReadWrite.All

Deletes a specific TAP policy. Permission:UserAuthenticationMethod.ReadWrite.All

Lists all TAP policies for a user. This command will only return a single object in the collection as a user can have only one Temporary Access Pass (TAP) method. Permission:UserAuthenticationMethod.Read.All

Deletes a Temporary Access Pass authentication method from a user. Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Lists the Temporary Access Pass authentication methods registered to a user, or retrieves a specific method by ID. Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Deprecated. Use the msgraph-user-account-disable command instead.

Tests connectivity to Microsoft Graph User.

Unblock a user.

Updates the properties of a user object. Permissions: - User.ReadWrite (Delegated & Application).

Deletes a Windows Hello for Business authentication method from a user. Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Lists the Windows Hello for Business authentication methods registered to a user, or retrieves a specific method by ID. Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application