Microsoft Graph User

The Entra ID Users integration (formerly Azure Active Directory Users) is a Unified gateway to security insights - all from a unified Microsoft Graph User API.

Analytics & SIEM · Microsoft Graph User

Details

ID	`Microsoft Graph User`
Provider	Microsoft
Category	Analytics & SIEM
From Version	5.0.0
Docker Image	`demisto/crypto:1.0.0.11658507`
Supported Modules	Agentix Cloud Runtime Security Cloud Posture Security XSIAM EDR Cortex Cloud

README

The Entra ID Users integration (formerly Azure Active Directory Users) is a Unified gateway to security insights - all from a unified Microsoft Graph User API.

Authentication

For more details about the authentication used in this integration, see Microsoft Integrations - Authentication.

Required Permissions:

Directory.Read.All - Delegated
User.ReadWrite.All - Application
User.Read - Delegated

Authorize Cortex XSOAR for Entra ID Users (Self deployed Azure App)

There are two different authentication methods for a self-deployed configuration:

We recommend using the Client Credentials flow.
In order to use the msgraph-user-change-password command, you must configure with the Authorization Code flow.

Note: When using the Authorization Code flow, make sure the user you authenticate with has the correct roles in Azure AD in order to use the command.

Configure Entra ID Users in Cortex

Parameter	Description	Required
Azure Cloud	See option table below.
Host URL (e.g., https://graph.microsoft.com)		True
ID / client ID		False
Token / Tenant ID		False
Key / Client Secret		False
Certificate Thumbprint	Used for certificate authentication. As appears in the “Certificates & secrets” page of the app.	False
Private Key	Used for certificate authentication. The private key of the registered certificate.	False
Use a self-deployed Azure application		False
Application redirect URI (for Self Deployed - Authorization Code Flow)		False
Authorization code (for Self Deployed - Authorization Code Flow)		False
Use Azure Managed Identities	Relevant only if the integration is running on Azure VM. If selected, authenticates based on the value provided for the Azure Managed Identities Client ID field. If no value is provided for the Azure Managed Identities Client ID field, authenticates based on the System Assigned Managed Identity. For additional information, see the Help tab.	False
Azure Managed Identities Client ID	The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM.	False
Trust any certificate (not secure)		False
Use system proxy settings		False
Suppress Errors for Non Found Users		False
Allow secret generators commands execution	Checking this box will allow running commands that generate and print secrets. Make sure to add restrictions to the related commands. For more information please refer to the following guide - MFA guide	False

Azure cloud options

Azure Cloud	Description
Worldwide	The publicly accessible Azure Cloud
US GCC	Azure cloud for the USA Government Cloud Community (GCC)
US GCC-High	Azure cloud for the USA Government Cloud Community High (GCC-High)
DoD	Azure cloud for the USA Department of Defense (DoD)
Germany	Azure cloud for the German Government
China	Azure cloud for the Chinese Government
Custom	Custom endpoint configuration to the Azure cloud. See note below.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

msgraph-user-account-disable

Disables a user from all Office 365 applications, and prevents sign in. Note: This command disables the user
but does not terminate an existing session. Supported only in a self deployed app flow with the
Permission: Directory.AccessAsUser.All(Delegated).

Base Command

msgraph-user-account-disable

Input

Argument Name	Description	Required
user	User ID or userPrincipalName.	Required

Context Output

There is no context output for this command.

msgraph-user-unblock

Unblock a user.

Base Command

msgraph-user-unblock

Input

Argument Name	Description	Required
user	User ID or userPrincipalName.	Required

Command example

!msgraph-user-unblock user=123456-abcd-7890-erty-987qwe987

Human Readable Output

“123456-abcd-7890-erty-987qwe987” unblocked. It might take several minutes for the changes to take affect across all applications.

msgraph-user-update

Updates the properties of a user object.
Permissions: - User.ReadWrite (Delegated & Application)
Permission For unblocking an admin/privileged user: User.EnableDisableAccount.All (Application).

Base Command

msgraph-user-update

Input

Argument Name	Description	Required
user	User ID or userPrincipalName to update properties for.	Required
updated_fields	User fields to update (in a key=value format. Example: displayName=John.	Required
updated_fields_delimiter	Delimiter to use for passing multiple fields to the ‘updated_fields’ argument. Example using ‘,’ as a delimiter: displayName=John,givenName=John,surname=Doe. Default is ,.	Optional

Context Output

Path	Type	Description
MSGraphUser.ID	String	User’s ID.
MSGraphUser.DisplayName	String	User’s display name.
MSGraphUser.GivenName	String	User’s given name.
MSGraphUser.BusinessPhones	String	User’s business phone numbers.
MSGraphUser.JobTitle	String	User’s job title.
MSGraphUser.Mail	String	User’s mail address.
MSGraphUser.MobilePhone	String	User’s mobile phone number.
MSGraphUser.OfficeLocation	String	User’s office location.
MSGraphUser.PreferredLanguage	String	User’s preferred language.
MSGraphUser.Surname	String	User’s surname.
MSGraphUser.UserPrincipalName	String	User’s principal name.

Command example

!msgraph-user-update user=123456-abcd-7890-erty-987qwe987 updated_fields="MobilePhone=050123456"

Context Example

{
    "Account": {
        "DisplayName": "Test 1",
        "Email": {
            "Address": null
        },
        "ID": "123456-abcd-7890-erty-987qwe987",
        "JobTitle": null,
        "Office": null,
        "TelephoneNumber": "050123456",
        "Type": "Azure AD",
        "Username": "test1@demistodev.onmicrosoft.com"
    },
    "MSGraphUser": {
        "BusinessPhones": [],
        "DisplayName": "Test 1",
        "GivenName": "Test",
        "ID": "123456-abcd-7890-erty-987qwe987",
        "JobTitle": null,
        "Mail": null,
        "MobilePhone": "050123456",
        "OfficeLocation": null,
        "PreferredLanguage": null,
        "Surname": "Test",
        "UserPrincipalName": "test1@demistodev.onmicrosoft.com"
    }
}

Human Readable Output

123456-abcd-7890-erty-987qwe987 data

Display Name Given Name ID Mobile Phone Surname User Principal Name

Test 1 Test 123456-abcd-7890-erty-987qwe987 050123456 Test test1@demistodev.onmicrosoft.com

Display Name	Given Name	ID	Mobile Phone	Surname	User Principal Name
Test 1	Test	123456-abcd-7890-erty-987qwe987	050123456	Test	test1@demistodev.onmicrosoft.com

msgraph-user-delete

Deletes an existing user.
Permissions: Directory.AccessAsUser.All (Delegated), User.ReadWrite.All (Application)

Base Command

msgraph-user-delete

Input

Argument Name	Description	Required
user	User ID or userPrincipalName to delete.	Required

msgraph-user-create

Creates a new user.
Permissions: User.ReadWrite.All (Delegated & Application)

Base Command

msgraph-user-create

Input

Argument Name	Description	Required
account_enabled	true if the account is enabled; otherwise, false. Possible values are: true, false. Default is true.	Optional
display_name	The name to display in the address book.	Required
on_premises_immutable_id	Only needs to be specified when creating a new user account if you are using a federated domain for the user’s userPrincipalName (UPN) property.	Optional
mail_nickname	The mail alias for the user.	Required
password	The password profile for the user.	Required
user_principal_name	The user principal name, for example: foo@test.com. .	Required
other_properties	Optional properties for the user, for example: “displayName=name,mobilePhone=phone-num” .	Optional

Context Output

Path	Type	Description
MSGraphUser.ID	String	User’s ID.
MSGraphUser.DisplayName	String	User’s display name.
MSGraphUser.GivenName	String	User’s given name.
MSGraphUser.BusinessPhones	String	User’s business phone numbers.
MSGraphUser.JobTitle	String	User’s job title.
MSGraphUser.Mail	String	User’s mail address.
MSGraphUser.MobilePhone	String	User’s mobile phone number.
MSGraphUser.OfficeLocation	String	User’s office location.
MSGraphUser.PreferredLanguage	String	User’s preferred language.
MSGraphUser.Surname	String	User’s surname.
MSGraphUser.UserPrincipalName	String	User’s principal name.
Account.ID	String	User’s ID.
Account.DisplayName	String	User’s display name.
Account.Username	String	User’s principal name.
Account.JobTitle	String	User’s job title.
Account.Email.Address	String	User’s mail address.
Account.TelephoneNumber	String	User’s mobile phone number.
Account.Office	String	User’s office location.
Account.Type	String	The account entity type.

msgraph-user-get

Retrieves the properties and relationships of a user object. For more information, visit: https://learn.microsoft.com/en-us/graph/api/user-get?view=graph-rest-1.0&tabs=http.
Permissions: User.Read (Delegated), User.Read.All (Application).

Base Command

msgraph-user-get

Input

Argument Name	Description	Required
user	User ID or userPrincipalName.	Required
properties	A CSV list of properties by which to filter the results, for example: “displayName,jobTitle,mobilePhone”. For the list of possible properties and the relevant permissions, if needed, visit: https://learn.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0#properties.	Optional

Context Output

Path	Type	Description
MSGraphUser.ID	String	User’s ID.
MSGraphUser.DisplayName	String	User’s display name.
MSGraphUser.GivenName	String	User’s given name.
MSGraphUser.BusinessPhones	String	User’s business phone numbers.
MSGraphUser.JobTitle	String	User’s job title.
MSGraphUser.Mail	String	User’s mail address.
MSGraphUser.MobilePhone	String	User’s mobile phone number.
MSGraphUser.OfficeLocation	String	User’s office location.
MSGraphUser.PreferredLanguage	String	User’s preferred language.
MSGraphUser.Surname	String	User’s surname.
MSGraphUser.UserPrincipalName	String	User’s principal name.
Account.ID	String	User’s ID.
Account.DisplayName	String	User’s display name.
Account.Username	String	User’s principal name.
Account.JobTitle	String	User’s job title.
Account.Email.Address	String	User’s mail address.
Account.TelephoneNumber	String	User’s mobile phone number.
Account.Office	String	User’s office location.
Account.Type	String	The account entity type.

Command example

!msgraph-user-get user=123456-abcd-7890-erty-987qwe987

Context Example

{
    "Account": {
        "DisplayName": "Test 1",
        "Email": {
            "Address": null
        },
        "ID": "123456-abcd-7890-erty-987qwe987",
        "JobTitle": null,
        "Office": null,
        "TelephoneNumber": "050123456",
        "Type": "Azure AD",
        "Username": "test1@demistodev.onmicrosoft.com"
    },
    "MSGraphUser": {
        "BusinessPhones": [],
        "DisplayName": "Test 1",
        "GivenName": "Test",
        "ID": "123456-abcd-7890-erty-987qwe987",
        "JobTitle": null,
        "Mail": null,
        "MobilePhone": "050123456",
        "OfficeLocation": null,
        "PreferredLanguage": null,
        "Surname": "Test",
        "UserPrincipalName": "test1@demistodev.onmicrosoft.com"
    }
}

Human Readable Output

123456-abcd-7890-erty-987qwe987 data

Display Name Given Name ID Mobile Phone Surname User Principal Name

Test 1 Test 123456-abcd-7890-erty-987qwe987 050123456 Test test1@demistodev.onmicrosoft.com

Display Name	Given Name	ID	Mobile Phone	Surname	User Principal Name
Test 1	Test	123456-abcd-7890-erty-987qwe987	050123456	Test	test1@demistodev.onmicrosoft.com

msgraph-user-list

Retrieves a list of user objects.
Permissions: User.ReadBasic.All (Delegated), User.Read.All (Application)

Base Command

msgraph-user-list

Input

Argument Name	Description	Required
properties	A CSV list of properties by which to filter the results, for example: “displayName,jobTitle,mobilePhone”.	Optional
next_page	The URL for the next page in the list.	Optional
filter	Filter to be plugged directly into the API. For more information about the Filter syntax, see the Microsoft documentation: https://learn.microsoft.com/en-us/graph/filter-query-parameter?tabs=http.	Optional

Context Output

Path	Type	Description
MSGraphUser.ID	String	User’s ID.
MSGraphUser.DisplayName	String	User’s display name.
MSGraphUser.GivenName	String	User’s given name.
MSGraphUser.BusinessPhones	String	User’s business phone numbers.
MSGraphUser.JobTitle	String	User’s job title.
MSGraphUser.Mail	String	User’s mail address.
MSGraphUser.MobilePhone	String	User’s mobile phone number.
MSGraphUser.OfficeLocation	String	User’s office location.
MSGraphUser.PreferredLanguage	String	User’s preferred language.
MSGraphUser.Surname	String	User’s surname.
MSGraphUser.UserPrincipalName	String	User’s principal name.
MSGraphUser.NextPage	String	A token to pass to the next list command to retrieve additional results.
Account.ID	String	User’s ID.
Account.DisplayName	String	User’s display name.
Account.Username	String	User’s principal name.
Account.JobTitle	String	User’s job title.
Account.Email.Address	String	User’s mail address.
Account.TelephoneNumber	String	User’s mobile phone number.
Account.Office	String	User’s office location.
Account.Type	String	The account entity type.

Command example


#### Context Example

```json
{
    "Account": [
        {
            "DisplayName": "Test1",
            "Email": {
                "Address": "test1@demistodev.onmicrosoft.com"
            },
            "ID": "123456-abcd-7890-erty-987qwe988",
            "JobTitle": null,
            "Office": null,
            "TelephoneNumber": "050505050",
            "Type": "Azure AD",
            "Username": null
        },
        {
            "DisplayName": "Test2",
            "Email": {
                "Address": "test2@demistodev.onmicrosoft.com"
            },
            "ID": "123456-abcd-7890-erty-987qwe989",
            "JobTitle": null,
            "Office": null,
            "TelephoneNumber": null,
            "Type": "Azure AD",
            "Username": null
        },
        {
            "DisplayName": "Test3",
            "Email": {
                "Address": null
            },
            "ID": "123456-abcd-7890-erty-987qwe990",
            "JobTitle": null,
            "Office": null,
            "TelephoneNumber": null,
            "Type": "Azure AD",
            "Username": null
        }
    ],
    "MSGraphUser": [
        {
            "NextPage": "https://graph.microsoft.com/v1.0/users?$select=id%2cdisplayName%2cjobTitle%2cmobilePhone%2cmail&$count=true&$skiptoken=m~AQAnO2Q2MjljMzcwNjFjOTQ4NTE4ZjNkODBlYTZjMDc2NTVmOzswOzA7"
        },
        {
            "DisplayName": "Test 1",
            "ID": "123456-abcd-7890-erty-987qwe991",
            "JobTitle": null,
            "Mail": "test1@demistodev.onmicrosoft.com",
            "MobilePhone": "050505050"
        },
        {
            "DisplayName": "Test 2",
            "ID": "123456-abcd-7890-erty-987qwe992",
            "JobTitle": null,
            "Mail": "test2@demistodev.onmicrosoft.com",
            "MobilePhone": null
        },
        {
            "DisplayName": "Test 3",
            "ID": "123456-abcd-7890-erty-987qwe993",
            "JobTitle": null,
            "Mail": null,
            "MobilePhone": null
        }
    ]
}

Human Readable Output

All Graph Users

To get further results, enter this to the next_page parameter:
https://graph.microsoft.com/v1.0/users?$select=id%2cdisplayName%2cjobTitle%2cmobilePhone%2cmail&$count=true&$skiptoken=m~AQAnO2Q2MjljMzcwNjFjOTQ4NTE4ZjNkODBlYTZjMDc2NTVmOzswOzA7

Display Name ID Job Title Mail Mobile Phone

Test 1 023096d0-595e-47b5-80dd-ea5886ab9294 test1@demistodev.onmicrosoft.com 050505050

Test 2 0628c545-94f6-4d07-8bc6-e6718ba1bc95 test2@demistodev.onmicrosoft.com

Test 3 082b3bc9-bb2d-4d12-8b1a-d84a53229696

Display Name	ID	Mail	Mobile Phone
Test 1	023096d0-595e-47b5-80dd-ea5886ab9294	test1@demistodev.onmicrosoft.com	050505050
Test 2	0628c545-94f6-4d07-8bc6-e6718ba1bc95	test2@demistodev.onmicrosoft.com
Test 3	082b3bc9-bb2d-4d12-8b1a-d84a53229696

msgraph-direct-reports

Retrieves the direct reports for a user. Direct reports are the people who have that user configured as their manager.

Base Command

msgraph-direct-reports

Input

Argument Name	Description	Required
user	The User ID or userPrincipalName of the user for which to retrieve direct reports.	Required

Context Output

Path	Type	Description
MSGraphUserDirectReports.Manager	String	The manager’s user principal name (UPN).
MSGraphUserDirectReports.Reports.@Odata.Type	String	A string value that can be used to classify user types in your directory, such as “Member” and “Guest”.
MSGraphUserDirectReports.Reports.DisplayName	String	The name displayed in the address book for the user. This is usually the combination of the user’s first name, middle initial and last name.
MSGraphUserDirectReports.Reports.GivenName	String	The given name (first name) of the user.
MSGraphUserDirectReports.Reports.ID	String	The user ID in Microsoft Graph User.
MSGraphUserDirectReports.Reports.JobTitle	String	The user’s job title.
MSGraphUserDirectReports.Reports.Mail	String	The email address of the user.
MSGraphUserDirectReports.Reports.MobilePhone	String	The primary cellular telephone number for the user.
MSGraphUserDirectReports.Reports.OfficeLocation	String	The office location in the user’s place of business.
MSGraphUserDirectReports.Reports.PreferredLanguage	String	The preferred language for the user. Should follow ISO 639-1 Code; for example: en-US.
MSGraphUserDirectReports.Reports.Surname	String	The user’s surname (family name or last name).
MSGraphUserDirectReports.Reports.UserPrincipalName	String	The user principal name (UPN) of the user. The UPN is an Internet-style login name for the user based on the Internet standard RFC 822. By convention, this should map to the user’s email name. The general format is alias@domain, where domain must be present in the tenant’s collection of verified domains. This property is required when a user is created. The verified domains for the tenant can be accessed from the verifiedDomains property of organization.

Command example

!msgraph-direct-reports user=123456-abcd-7890-erty-987qwe987

Context Example

{
    "MSGraphUserDirectReports": {
        "Manager": "123456-abcd-7890-erty-987qwe987",
        "Reports": [
            {
                "@Odata.Type": "#microsoft.graph.user",
                "BusinessPhones": [],
                "DisplayName": "Test 1",
                "GivenName": "Test",
                "ID": "123456-abcd-7890-erty-987qwe987",
                "JobTitle": null,
                "Mail": null,
                "MobilePhone": "050123456",
                "OfficeLocation": null,
                "PreferredLanguage": null,
                "Surname": "Test",
                "UserPrincipalName": "test1@demistodev.onmicrosoft.com"
            }
        ]
    }
}

Human Readable Output

259d2a3c-167b-411c-b2ee-88646ce6e054 - direct reports

@Odata.Type Display Name Given Name ID Mobile Phone Surname User Principal Name

#microsoft.graph.user Test 1 Test 123456-abcd-7890-erty-987qwe987 050123456 Test test1@demistodev.onmicrosoft.com

@Odata.Type	Display Name	Given Name	ID	Mobile Phone	Surname	User Principal Name
#microsoft.graph.user	Test 1	Test	123456-abcd-7890-erty-987qwe987	050123456	Test	test1@demistodev.onmicrosoft.com

msgraph-user-get-manager

Retrieves the properties from the manager of a user.

Base Command

msgraph-user-get-manager

Input

Argument Name	Description	Required
user	The User ID or userPrincipalName of the user for which to get the manager properties.	Required

Context Output

Path	Type	Description
MSGraphUserManager.ID	String	User’s user ID.
MSGraphUserManager.Manager.ID	String	Manager’s user ID.
MSGraphUserManager.Manager.DisplayName	String	User’s display name.
MSGraphUserManager.Manager.GivenName	String	User’s given name.
MSGraphUserManager.Manager.BusinessPhones	String	User’s business phone numbers.
MSGraphUserManager.Manager.JobTitle	String	User’s job title.
MSGraphUserManager.Manager.Mail	String	User’s mail address.
MSGraphUserManager.Manager.MobilePhone	String	User’s mobile phone number.
MSGraphUserManager.Manager.OfficeLocation	String	User’s office location.
MSGraphUserManager.Manager.PreferredLanguage	String	User’s preferred language.
MSGraphUserManager.Manager.Surname	String	User’s surname.
MSGraphUserManager.Manager.UserPrincipalName	String	User’s principal name.

Command example

!msgraph-user-get-manager user=123456-abcd-7890-erty-987qwe987

Context Example

{
    "MSGraphUserManager": {
        "Manager": {
            "BusinessPhones": [],
            "DisplayName": "Test 2",
            "GivenName": "Test",
            "ID": "259d2a3c-167b-411c-b2ee-88646ce6e054",
            "JobTitle": null,
            "Mail": null,
            "MobilePhone": "050505050",
            "OfficeLocation": null,
            "PreferredLanguage": null,
            "Surname": "Test",
            "UserPrincipalName": "test2@demistodev.onmicrosoft.com"
        },
        "User": "123456-abcd-7890-erty-987qwe987"
    }
}

Human Readable Output

123456-abcd-7890-erty-987qwe987 - manager

Display Name Given Name ID Mobile Phone Surname User Principal Name

Test 2 Test 259d2a3c-167b-411c-b2ee-88646ce6e054 050505050 Test test2@demistodev.onmicrosoft.com

Display Name	Given Name	ID	Mobile Phone	Surname	User Principal Name
Test 2	Test	259d2a3c-167b-411c-b2ee-88646ce6e054	050505050	Test	test2@demistodev.onmicrosoft.com

msgraph-user-assign-manager

Assigns a manager to the specified user.
Permission: - User.ReadWrite (Delegated) or - User.ReadWrite (Application)

Base Command

msgraph-user-assign-manager

Input

Argument Name	Description	Required
user	User ID or userPrincipalName of the user to which to assign a manager.	Required
manager	User ID or userPrincipalName of the manager.	Required

Context Output

There is no context output for this command.

Command example

!msgraph-user-assign-manager user=123456-abcd-7890-erty-987qwe987 manager=9627hp-sq12-b65m-4256h6h

Human Readable Output

A manager was assigned to user “123456-abcd-7890-erty-987qwe987”. It might take several minutes for the changes to take effect across all applications.

msgraph-user-change-password

Changes the user password.
Supported only in a self deployed app flow with the Permission: Directory.AccessAsUser.All(Delegated)
Note: In order to change the password, you need additional permissions: Auth Admin, Privileged Auth Admin or Global Admin, depending on the target user’s role.

Base Command

msgraph-user-change-password

Input

Argument Name	Description	Required
user	User ID or userPrincipalName to update password for.	Required
password	The new password.	Required
force_change_password_next_sign_in	Whether the password will be changed on the next sign in. Possible values are: true, false. Default is true.	Optional
force_change_password_with_mfa	Whether to change the password with MFA. Possible values are: true, false. Default is false.	Optional

msgraph-user-test

Tests connectivity to Microsoft Graph User.

Base Command

msgraph-user-test

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command example

!msgraph-user-test

Human Readable Output

msgraph-user-session-revoke

Revoke a user session by invalidating all refresh tokens issued to applications for a user.
This command requires an administrator role.
Permission required: Directory.AccessAsUser.All (Delegated).

Base Command

msgraph-user-session-revoke

Input

Argument Name	Description	Required
user	User ID or userPrincipalName.	Required

Context Output

There is no context output for this command.
There is no context output for this command.

msgraph-user-generate-login-url

Generate the login url used for Authorization code flow.

Base Command

msgraph-user-generate-login-url

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example

msgraph-user-generate-login-url

Human Readable Output

Authorization instructions

Click on the login URL to sign in and grant Cortex XSOAR permissions for your Azure Service Management.
You will be automatically redirected to a link with the following structure:
REDIRECT_URI?code=AUTH_CODE&session_state=SESSION_STATE

Copy the AUTH_CODE (without the code= prefix, and the session_state parameter)
and paste it in your instance configuration under the Authorization code parameter.

msgraph-user-auth-reset

Run this command if for some reason you need to rerun the authentication process.

Base Command

msgraph-user-auth-reset

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

msgraph-user-tap-policy-delete

Deletes a specific TAP policy.
Permissions: UserAuthenticationMethod.ReadWrite.All (Delegated), UserAuthenticationMethod.ReadWrite.All (Application).

Base Command

msgraph-user-tap-policy-delete

Input

Argument Name	Description	Required
user_id	The Azure AD user ID.	Required
policy_id	Policy ID.	Required

Context Output

There is no context output for this command.

Command example

!msgraph-user-tap-policy-delete policy_id=r4y67u4-69nh-h671-a4bj8922 user_id=123456-abcd-7890-erty-987qwe987"

msgraph-user-tap-policy-create

Create a new TAP policy for a user.
During the command execution, a password-protected zip file will be generated, including the new TAP password. You can download the file, use your password to unlock it, and get the TAP password.
A user can only have one Temporary Access Pass that’s usable within its specified lifetime.
Permissions: UserAuthenticationMethod.ReadWrite.All (Delegated), UserAuthenticationMethod.ReadWrite.All (Application).

Base Command

msgraph-user-tap-policy-create

Input

Argument Name	Description	Required
user_id	The Azure AD user ID.	Required
zip_password	A password for the password-protected zip file that will include the password of the new TAP.	Required
lifetime_in_minutes	The duration of the TAP. Must be between 10 and 43200 (equivalent to 30 days). Default is 60.	Optional
is_usable_once	Determines if the pass is limited to a one-time use. If true, the pass can be used once; if false, the TAP can be used multiple times within its ‘lifetime_in_minutes’ setting. A multi-use Temporary Access Pass (isUsableOnce = false) can only be created and used for sign-in if it is allowed by the Temporary Access Pass authentication method policy. . Possible values are: true, false.	Optional
start_time	The start time for the TAP (has to be a time in the future). Can be specified in ISO 8601 format - “YYYY-MM-DDThh:mm:ssZ”, for example: “2025-03-26T00:00:00.000Z” or in a future relative time format, for example: “now”, “in 2 days”. Default is now.	Optional

Context Output

Path	Type	Description
MSGraphUser.TAPPolicy.ID	String	TAP policy’s ID.
MSGraphUser.TAPPolicy.IsUsable	Bool	TAP policy’s usability.
MSGraphUser.TAPPolicy.IsUsableOnce	Bool	TAP policy’s once - usability.
MSGraphUser.TAPPolicy.CreatedDateTime	String	TAP policy’s creation date and time.
MSGraphUser.TAPPolicy.MethodUsabilityReason	String	TAP policy’s method usability reason.
MSGraphUser.TAPPolicy.LifetimeInMinutes	Int	TAP policy’s lifetime in minutes.
MSGraphUser.TAPPolicy.StartDateTime	String	TAP policy’s start date and time.

Command example

!msgraph-user-tap-policy-create user_id=123456-abcd-7890-erty-987qwe987 zip_password=123

msgraph-user-tap-policy-list

Lists all TAP policies for a user.
This command will only return a single object in the collection as a user can have only one Temporary Access Pass (TAP) method.
Permissions: UserAuthenticationMethod.Read.All (Delegated), UserAuthenticationMethod.Read.All (Application).

Base Command

msgraph-user-tap-policy-list

Input

Argument Name	Description	Required
user_id	The Azure AD user ID.	Required

Context Output

Path	Type	Description
MSGraphUser.TAPPolicy.ID	String	TAP policy’s ID.
MSGraphUser.TAPPolicy.IsUsable	Bool	TAP policy’s usability.
MSGraphUser.TAPPolicy.IsUsableOnce	Bool	TAP policy’s once - usability.
MSGraphUser.TAPPolicy.CreatedDateTime	String	TAP policy’s creation date and time.
MSGraphUser.TAPPolicy.MethodUsabilityReason	String	TAP policy’s method usability reason.
MSGraphUser.TAPPolicy.LifetimeInMinutes	Int	TAP policy’s lifetime in minutes.
MSGraphUser.TAPPolicy.StartDateTime	String	TAP policy’s start date and time.

Command example

!msgraph-user-tap-policy-list user_id=123456-abcd-7890-erty-987qwe987

msgraph-user-change-password-on-premise

Changes the password of an on-premise user. Requires the following permissions: -UserAuthenticationMethod.Read.All - delegated, Users.Read.All - delegated.
Providing a password is required (password auto-generation is not supported).

Prerequisites and Configuration Requirements:

Authentication Flow: Must use Authorization Code flow with a self-deployed Azure app. Client Credentials flow is not supported for this command.
Required App Permissions: The Azure app must have the following delegated permissions:
- UserAuthenticationMethod.ReadWrite.All - Delegated
- Users.Read.All - Delegated
Azure App Role Configuration:
- The app must have the Authorization Administrator role granted to it through the Microsoft Entra Admin Center:
  - Navigate to Roles and administrators → Search for Authorization Administrator
  - Click Authorization Administrator → Add assignments.
  - Select the app you want to configure the instance with and click Save.
- Additionally, create a new app role in the Azure Portal for the app you want to configure the instance with:
  - Navigate to App roles → Create Role App
  - Set Value to UserAuthenticationMethod.ReadWrite.All
  - Set Allowed member types to Both.
  - Click on Create.
User Role Requirements: The logged-in user (authenticating via Authorization Code flow) must have the Authorization Administrator role in Azure AD.

Base Command

msgraph-user-change-password-on-premise

Input

Argument Name	Description	Required
user	User ID or userPrincipalName to update password for.	Required
password	The new password.	Optional
nonsensitive_password	The new password. This argument can be used in playbooks, but note its value will NOT be hidden in logs.	Optional

Context Output

There is no context output for this command.

Command example

!msgraph-user-change-password-on-premise user=123456-abcd-7890-erty-987qwe987 password=123456

msgraph-user-force-reset-password

Forces a user to reset their password the next time they log in.
Note that this action does not terminate the user’s current session.
If you also want to force the user to sign in again, use the msgraph-user-session-revoke command.
This operation is supported only when using a self-deployed app flow with the Directory.AccessAsUser.All and User-PasswordProfile.ReadWrite.All delegated permissions. For further info, see https://learn.microsoft.com/en-us/graph/api/user-update?view=graph-rest-1.0&tabs=http#example-3-update-the-passwordprofile-of-a-user-and-reset-their-password
Furthermore, the signed in user must have a higher privileged administrator role than the user who’s password is being reset. The admin hierarchy table can be viewed here: https://learn.microsoft.com/en-us/graph/api/resources/users?view=graph-rest-1.0#who-can-reset-passwords

Base Command

msgraph-user-force-reset-password

Input

Argument Name	Description	Required
user	User ID or userPrincipalName.	Required

Context Output

There is no context output for this command.

msgraph-user-get-groups

Retrieves the groups a user is part of.

Base Command

msgraph-user-get-groups

Input

Argument Name	Description	Required
user	User ID or userPrincipalName.	Required

Context Output

Path	Type	Description
MSGraphUserGroups.ID	String	The user ID.
MSGraphUserGroups.Groups.Classification	String	Value used to classify data types in your groups.
MSGraphUserGroups.Groups.@Odata.Type	String	A string value that can be used to classify the user’s groups.
MSGraphUserGroups.Groups.CreatedDateTime	String	Group creation date and time.
MSGraphUserGroups.Groups.CreationOptions	String	Group creation options.
MSGraphUserGroups.Groups.DeletedDateTime	String	Group deletion date and time.
MSGraphUserGroups.Groups.Description	String	Group description string.
MSGraphUserGroups.Groups.DisplayName	String	Group display name.
MSGraphUserGroups.Groups.ExpirationDateTime	String	Group expiration date and time.
MSGraphUserGroups.Groups.GroupTypes	String	The types assigned to the group.
MSGraphUserGroups.Groups.ID	String	Group id.
MSGraphUserGroups.Groups.IsAssignableToRole	Bool	Indicates whether the group can be assigned to roles.
MSGraphUserGroups.Groups.Mail	String	Group associated mail.
MSGraphUserGroups.Groups.MailEnabled	Bool	Indicates whether the group has mail enabled.
MSGraphUserGroups.Groups.MailNickname	String	Mail nickname of the group.
MSGraphUserGroups.Groups.MembershipRule	String	Membership rule applied to the group.
MSGraphUserGroups.Groups.MembershipRuleProcessingState	String	Processing state of the group’s membership rule.
MSGraphUserGroups.Groups.OnPremisesDomainName	String	On-premises domain name associated with the group.
MSGraphUserGroups.Groups.OnPremisesLastSyncDateTime	String	Date and time when the group was last synchronized from on-premises.
MSGraphUserGroups.Groups.OnPremisesNetBiosName	String	On-premises NetBIOS name of the group.
MSGraphUserGroups.Groups.OnPremisesProvisioningErrors	String	Errors encountered during on-premises provisioning of the group.
MSGraphUserGroups.Groups.OnPremisesSamAccountName	String	SAM account name of the group in on-premises Active Directory.
MSGraphUserGroups.Groups.OnPremisesSecurityIdentifier	String	Security identifier (SID) of the group in on-premises Active Directory.
MSGraphUserGroups.Groups.OnPremisesSyncEnabled	String	Indicates whether the group is synchronized from on-premises.
MSGraphUserGroups.Groups.PreferredDataLocation	String	Preferred geographic location for the group’s data.
MSGraphUserGroups.Groups.PreferredLanguage	String	Preferred language for the group.
MSGraphUserGroups.Groups.ProxyAddresses	String	Email addresses associated with the group.
MSGraphUserGroups.Groups.RenewedDateTime	String	Date and time the group was last renewed.
MSGraphUserGroups.Groups.ResourceBehaviorOptions	String	Options defining the group’s behavior as a resource.
MSGraphUserGroups.Groups.ResourceProvisioningOptions	String	Options used for provisioning the group as a resource.
MSGraphUserGroups.Groups.SecurityEnabled	Bool	Indicates whether the group is security-enabled.
MSGraphUserGroups.Groups.SecurityIdentifier	String	Security identifier of the group.
MSGraphUserGroups.Groups.ServiceProvisioningErrors	String	Errors encountered during service provisioning of the group.
MSGraphUserGroups.Groups.Theme	String	Theme associated with the group.
MSGraphUserGroups.Groups.UniqueName	String	Unique name of the group.
MSGraphUserGroups.Groups.Visibility	String	Groups visibility.
MSGraphUserGroups.Groups.WellKnownObject	String	Indicates if the group is a well-known system object.

msgraph-user-get-auth-methods

Retrieve a list of authentication methods registered to a user.

Base Command

msgraph-user-get-auth-methods

Input

Argument Name	Description	Required
user	User ID or userPrincipalName.	Required

Context Output

Path	Type	Description
MSGraphUserAuthMethods.ID	String	The user ID.
MSGraphUserAuthMethods.Methods.CreatedDateTime	String	Authentication method’s creation date and time.
MSGraphUserAuthMethods.Methods.ID	String	The unique identifier for the authentication method.
MSGraphUserAuthMethods.Methods.@Odata.Type	String	The type of the authentication method.
MSGraphUserAuthMethods.Methods.Password	String	The password associated with the authentication method, if applicable.
MSGraphUserAuthMethods.Methods.DisplayName	String	Authentication methods displayName.
MSGraphUserAuthMethods.Methods.DeviceTag	String	The device tag associated with the authentication method.
MSGraphUserAuthMethods.Methods.IsUsable	String	Indicates whether the authentication method is currently usable.
MSGraphUserAuthMethods.Methods.IsUsableOnce	String	Indicates whether the authentication method can be used only once.
MSGraphUserAuthMethods.Methods.MethodUsabilityReason	String	The reason why the authentication method is or is not usable.

msgraph-user-owned-devices-list

Lists the devices that are owned by the user.
Permission:User.Read.All, Directory.Read.All - Delegated
Note: When using the XSOAR app, this command returns partial data. To retrieve full data, use a self-deployed Azure app with the appropriate permissions.

Base Command

msgraph-user-owned-devices-list

Input

Argument Name	Description	Required
user	The Azure AD user ID.	Required
limit	Number of devices in the list. Maximum is 50. Default is 50.	Optional
next_page	The URL for the next page in the list.	Optional
filter	Filter to be plugged directly into the API. For more information about the Filter syntax, see the Microsoft documentation: https://learn.microsoft.com/en-us/graph/filter-query-parameter?tabs=http.	Optional

Context Output

Path	Type	Description
MSGraphUser.ID	String	User’s ID.
MSGraphUser.OwnedDevice.ID	String	Owned device’s ID.
MSGraphUser.OwnedDevice.PhysicalIds	String	Physical IDs of the device.
MSGraphUser.OwnedDevice.DeviceVersion	String	The version of the device.
MSGraphUser.OwnedDevice.ProfileType	String	The profile type of the device.
MSGraphUser.OwnedDevice.CreatedDateTime	String	The date and time when the device was created.
MSGraphUser.OwnedDevice.ApproximateLastSignInDateTime	String	The approximate date and time of the last sign-in.
MSGraphUser.OwnedDevice.OperatingSystemVersion	String	The version of the operating system.
MSGraphUser.OwnedDevice.AlternativeSecurityIds	String	Alternative security IDs of the device.
MSGraphUser.OwnedDevice.DisplayName	String	The display name of the device.
MSGraphUser.OwnedDevice.OperatingSystem	String	The operating system of the device.
MSGraphUser.OwnedDevice.DeviceId	String	The unique identifier for the device.
MSGraphUser.OwnedDevice.TrustType	String	The trust type of the device.
MSGraphUser.OwnedDevice.RegistrationDateTime	String	The date and time when the device was registered.

msgraph-user-fido2-method-list

Lists the FIDO2 authentication methods registered to a user, or retrieves a specific FIDO2 method by ID.
Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All

Base Command

msgraph-user-fido2-method-list

Input

Argument Name	Description	Required
user	User ID or userPrincipalName.	Required
method_id	The ID of a specific FIDO2 authentication method to retrieve.	Optional
limit	Maximum number of FIDO2 methods to return when listing all methods.	Optional

Context Output

Path	Type	Description
MSGraphUser.FIDO2Method.ID	String	The unique identifier of the FIDO2 authentication method.
MSGraphUser.FIDO2Method.DisplayName	String	The display name of the key as given by the user.
MSGraphUser.FIDO2Method.CreatedDateTime	String	The timestamp when this key was registered.
MSGraphUser.FIDO2Method.AaGuid	String	Authenticator Attestation GUID, an identifier that indicates the type of authenticator.
MSGraphUser.FIDO2Method.Model	String	The manufacturer-assigned model of the FIDO2 security key.
MSGraphUser.FIDO2Method.AttestationCertificates	String	The attestation certificate(s) attached to this security key.
MSGraphUser.FIDO2Method.AttestationLevel	String	The attestation level of this FIDO2 security key.

msgraph-user-fido2-method-delete

Deletes a FIDO2 authentication method from a user.
Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Base Command

msgraph-user-fido2-method-delete

Input

Argument Name	Description	Required
user	User ID or userPrincipalName.	Required
method_id	The ID of the FIDO2 authentication method to delete.	Required

Context Output

There is no context output for this command.

msgraph-user-email-method-list

Lists the email authentication methods registered to a user, or retrieves a specific email method by ID.
Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Base Command

msgraph-user-email-method-list

Input

Argument Name	Description	Required
user	User ID or userPrincipalName.	Required
method_id	The ID of a specific email authentication method to retrieve.	Optional

Context Output

Path	Type	Description
MSGraphUser.EmailAuthMethod.ID	String	The unique identifier of the email authentication method.
MSGraphUser.EmailAuthMethod.EmailAddress	String	The email address registered to this user.

msgraph-user-email-method-delete

Deletes an email authentication method from a user.
Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Base Command

msgraph-user-email-method-delete

Input

Argument Name	Description	Required
user	User ID or userPrincipalName.	Required
method_id	The ID of the email authentication method to delete. Default is 3ddfcfc8-9383-446f-83cc-3ab9be4be18f.	Required

Context Output

There is no context output for this command.

msgraph-user-authenticator-method-list

Lists the Microsoft Authenticator authentication methods registered to a user, or retrieves a specific method by ID.
Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Base Command

msgraph-user-authenticator-method-list

Input

Argument Name	Description	Required
user	User ID or userPrincipalName.	Required
method_id	The ID of a specific Microsoft Authenticator authentication method to retrieve.	Optional
limit	Maximum number of results to return when listing all methods. Default is 50.	Optional
next_page	The URL for the next page in the list.	Optional

Context Output

Path	Type	Description
MSGraphUser.UserAuthMethod.ID	String	The unique identifier of the Microsoft Authenticator authentication method.
MSGraphUser.UserAuthMethod.DisplayName	String	The name of the device on which Microsoft Authenticator is registered.
MSGraphUser.UserAuthMethod.PhoneAppVersion	String	The version of Microsoft Authenticator installed on the device.
MSGraphUser.UserAuthMethod.DeviceTag	String	Tags containing app metadata.
MSGraphUser.UserAuthMethod.CreatedDateTime	String	The timestamp when this method was registered to the user.
MSGraphUser.UserAuthMethod.NextPage	String	A token to pass to the next list command to retrieve additional results.

msgraph-user-authenticator-method-delete

Deletes a Microsoft Authenticator authentication method from a user.
Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Base Command

msgraph-user-authenticator-method-delete

Input

Argument Name	Description	Required
user	User ID or userPrincipalName.	Required
method_id	The ID of the Microsoft Authenticator authentication method to delete.	Required

Context Output

There is no context output for this command.

msgraph-user-phone-method-list

Lists the phone authentication methods registered to a user, or retrieves a specific phone method by ID.
Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Base Command

msgraph-user-phone-method-list

Input

Argument Name	Description	Required
user	User ID or userPrincipalName.	Required
method_id	The ID of a specific phone authentication method to retrieve.	Optional
next_page	The URL for the next page in the list.	Optional

Context Output

Path	Type	Description
MSGraphUser.PhoneAuthMethod.ID	String	The unique identifier of the phone authentication method.
MSGraphUser.PhoneAuthMethod.PhoneNumber	String	The phone number registered to this user.
MSGraphUser.PhoneAuthMethod.PhoneType	String	The type of phone (mobile, alternateMobile, or office).
MSGraphUser.PhoneAuthMethod.SmsSignInState	String	Whether the phone is ready to be used for SMS sign-in.
MSGraphUser.PhoneAuthMethod.NextPage	String	A token to pass to the next list command to retrieve additional results.

msgraph-user-phone-method-delete

Deletes a phone authentication method from a user.
Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Base Command

msgraph-user-phone-method-delete

Input

Argument Name	Description	Required
user	User ID or userPrincipalName.	Required
method_id	The ID of the phone authentication method to delete.	Required

Context Output

There is no context output for this command.

msgraph-user-software-oath-method-list

Lists the software OATH authentication methods registered to a user, or retrieves a specific method by ID.
Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Base Command

msgraph-user-software-oath-method-list

Input

Argument Name	Description	Required
user	User ID or userPrincipalName.	Required
method_id	The ID of a specific software OATH authentication method to retrieve.	Optional

Context Output

Path	Type	Description
MSGraphUser.SoftOathAuthMethod.ID	String	The unique identifier of the software OATH authentication method.

msgraph-user-software-oath-method-delete

Deletes a software OATH authentication method from a user.
Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Base Command

msgraph-user-software-oath-method-delete

Input

Argument Name	Description	Required
user	User ID or userPrincipalName.	Required
method_id	The ID of the software OATH authentication method to delete.	Required

Context Output

There is no context output for this command.

msgraph-user-windows-hello-method-list

Lists the Windows Hello for Business authentication methods registered to a user, or retrieves a specific method by ID.
Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Base Command

msgraph-user-windows-hello-method-list

Input

Argument Name	Description	Required
user	User ID or userPrincipalName.	Required
method_id	The ID of a specific Windows Hello for Business authentication method to retrieve.	Optional

Context Output

Path	Type	Description
MSGraphUser.WindowsHelloAuthMethod.ID	String	The unique identifier of the Windows Hello for Business authentication method.
MSGraphUser.WindowsHelloAuthMethod.DisplayName	String	The name of the device on which Windows Hello is registered.
MSGraphUser.WindowsHelloAuthMethod.KeyStrength	String	The key strength of the Windows Hello for Business key (normal or weak).
MSGraphUser.WindowsHelloAuthMethod.CreatedDateTime	String	The timestamp when this method was registered to the user.

msgraph-user-windows-hello-method-delete

Deletes a Windows Hello for Business authentication method from a user.
Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Base Command

msgraph-user-windows-hello-method-delete

Input

Argument Name	Description	Required
user	User ID or userPrincipalName.	Required
method_id	The ID of the Windows Hello for Business authentication method to delete.	Required

Context Output

There is no context output for this command.

msgraph-user-temp-access-pass-method-list

Lists the Temporary Access Pass authentication methods registered to a user, or retrieves a specific method by ID.
Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Base Command

msgraph-user-temp-access-pass-method-list

Input

Argument Name	Description	Required
user	User ID or userPrincipalName.	Required
method_id	The ID of a specific Temporary Access Pass authentication method to retrieve.	Optional

Context Output

Path	Type	Description
MSGraphUser.TempAccessPassAuthMethod.ID	String	The unique identifier of the Temporary Access Pass authentication method.
MSGraphUser.TempAccessPassAuthMethod.IsUsable	Bool	Indicates whether the authentication method is currently usable.

msgraph-user-temp-access-pass-method-delete

Deletes a Temporary Access Pass authentication method from a user.
Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Base Command

msgraph-user-temp-access-pass-method-delete

Input

Argument Name	Description	Required
user	User ID or userPrincipalName.	Required
method_id	The ID of the Temporary Access Pass authentication method to delete.	Required

Context Output

There is no context output for this command.

Configuration parameters

azure_cloud — Azure Cloud
host — Server URL (e.g., https://graph.microsoft.com) (required)
creds_auth_id —
creds_tenant_id —
creds_enc_key —
auth_id — ID (received from the admin consent - see Detailed Instructions (?)
tenant_id — Token (received from the admin consent - see Detailed Instructions (?) section)
enc_key — Key (received from the admin consent - see Detailed Instructions (?)
creds_certificate — Certificate Thumbprint
certificate_thumbprint — Certificate Thumbprint
private_key — Private Key
self_deployed — Use a self-deployed Azure application
redirect_uri — Application redirect URI (for Self Deployed - Authorization Code Flow)
creds_auth_code —
auth_code — Authorization code (for Authorization Code flow mode - received from the authorization step. see Detailed Instructions (?) section)
use_managed_identities — Use Azure Managed Identities
managed_identities_client_id —
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
allow_secret_generators — Allow secret generators commands execution
handle_error — Suppress Errors for Non Found Users

Commands (43)

msgraph-direct-reports
Retrieves the direct reports for a user. Direct reports are the people who have that user configured as their manager.
msgraph-user-account-disable
Disables a user from all Office 365 applications, and prevents sign in. Note: This command disables the user but does not terminate an existing session. Supported only in a self deployed app flow with the Permission: Directory.AccessAsUser.All(Delegated).
msgraph-user-assign-manager
Assigns a manager to the specified user. Permission: - User.ReadWrite (Delegated) or - User.ReadWrite (Application).
msgraph-user-auth-reset
Run this command if for some reason you need to rerun the authentication process.
msgraph-user-authenticator-method-delete
Deletes a Microsoft Authenticator authentication method from a user. Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application
msgraph-user-authenticator-method-list
Lists the Microsoft Authenticator authentication methods registered to a user, or retrieves a specific method by ID. Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application
msgraph-user-change-password
Changes the user password. Supported only in a self deployed app flow with the Permission: Directory.AccessAsUser.All(Delegated).
msgraph-user-change-password-on-premise
Changes the password of an on-premise user. See documentation for full permissions and roles to execute this command. Providing a password is required (password auto-generation is not supported).
msgraph-user-create
Creates a new user. Permissions: - User.ReadWrite.All (Delegated & Application).
msgraph-user-create-mfa-client-access-token
Issue a new access token for the MFA app.
msgraph-user-create-mfa-client-secret
Issue a new client secret for the MFA app.
msgraph-user-delete
Deletes an existing user. Permissions: - Directory.AccessAsUser.All (Delegated) - User.ReadWrite.All (Application).
msgraph-user-email-method-delete
Deletes an email authentication method from a user. Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application
msgraph-user-email-method-list
Lists the email authentication methods registered to a user, or retrieves a specific email method by ID. Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application
msgraph-user-fido2-method-delete
Deletes a FIDO2 authentication method from a user. Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application
msgraph-user-fido2-method-list
Lists the FIDO2 authentication methods registered to a user or retrieves a specific method by ID. Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All
msgraph-user-force-reset-password
Forces a user to reset their password the next time they log in. Note that this action does not terminate the user’s current session. If you also want to force the user to sign in again, use the msgraph-user-session-revoke command. This operation is supported only when using a self-deployed app flow with the Directory.AccessAsUser.All and User-PasswordProfile.ReadWrite.All delegated permissions. For further info, see https://learn.microsoft.com/en-us/graph/api/user-update?view=graph-rest-1.0&tabs=http#example-3-update-the-passwordprofile-of-a-user-and-reset-their-password Furthermore, the signed in user must have a higher privileged administrator role than the user who's password is being reset. The admin hierarchy table can be viewed here: https://learn.microsoft.com/en-us/graph/api/resources/users?view=graph-rest-1.0#who-can-reset-passwords
msgraph-user-generate-login-url
Generate the login url used for Authorization code flow.
msgraph-user-get
Retrieves the properties and relationships of a user object. For more information, visit: https://learn.microsoft.com/en-us/graph/api/user-get?view=graph-rest-1.0&tabs=http. Permissions: - User.Read (Delegated) - User.Read.All (Application).
msgraph-user-get-auth-methods
Retrieve a list of authentication methods registered to a user.
msgraph-user-get-delta Deprecated
Deprecated. This command only returns a single page. Use the msgraph-user-list command instead, which gets newly created, updated, or deleted users without performing a full read of the entire user collection. Permissions: - User.Read (Delegated) - User.Read.All (Application).
msgraph-user-get-groups
Retrieves the groups a user is part of.
msgraph-user-get-manager
Retrieves the properties from the manager of a user.
msgraph-user-get-user-default-auth-method
Retrieves the authentication preferences for a user, including the default method.
msgraph-user-list
Retrieves a list of user objects. Permissions: - User.ReadBasic.All (Delegated) - User.Read.All (Application).
msgraph-user-owned-devices-list
Lists the devices that are owned by the user. Permission: User.Read.All,Directory.Read.All - Delegated
msgraph-user-phone-method-delete
Deletes a phone authentication method from a user. Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application
msgraph-user-phone-method-list
Lists the phone authentication methods registered to a user, or retrieves a specific phone method by ID. Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application
msgraph-user-request-mfa
Pops a synchronous MFA request for the given user. This is a blocking call that waits for user response or timeout.
msgraph-user-session-revoke
Revoke a user session by invalidating all refresh tokens issued to applications for a user. This command requires an administrator role. Permission required: Directory.AccessAsUser.All (Delegated).
msgraph-user-software-oath-method-delete
Deletes a software OATH authentication method from a user. Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application
msgraph-user-software-oath-method-list
Lists the software OATH authentication methods registered to a user, or retrieves a specific method by ID. Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application
msgraph-user-tap-policy-create
Create a new TAP policy for a user. During the command execution, a password-protected zip file will be generated, including the new TAP password. You can download the file, use your password to unlock it, and get the TAP password. A user can only have one Temporary Access Pass that's usable within its specified lifetime. Permission:UserAuthenticationMethod.ReadWrite.All
msgraph-user-tap-policy-delete
Deletes a specific TAP policy. Permission:UserAuthenticationMethod.ReadWrite.All
msgraph-user-tap-policy-list
Lists all TAP policies for a user. This command will only return a single object in the collection as a user can have only one Temporary Access Pass (TAP) method. Permission:UserAuthenticationMethod.Read.All
msgraph-user-temp-access-pass-method-delete
Deletes a Temporary Access Pass authentication method from a user. Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application
msgraph-user-temp-access-pass-method-list
Lists the Temporary Access Pass authentication methods registered to a user, or retrieves a specific method by ID. Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application
msgraph-user-terminate-session Deprecated
Deprecated. Use the msgraph-user-account-disable command instead.
msgraph-user-test
Tests connectivity to Microsoft Graph User.
msgraph-user-unblock
Unblock a user.
msgraph-user-update
Updates the properties of a user object. Permissions: - User.ReadWrite (Delegated & Application).
msgraph-user-windows-hello-method-delete
Deletes a Windows Hello for Business authentication method from a user. Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application
msgraph-user-windows-hello-method-list
Lists the Windows Hello for Business authentication methods registered to a user, or retrieves a specific method by ID. Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Source

MicrosoftGraphUser.py MicrosoftGraphUser_test.py MicrosoftGraphUser.yml MicrosoftGraphUser_description.md command_examples.txt

Download History Raw

category: Analytics & SIEM
provider: Microsoft
sectionorder:
- Connect
- Collect
commonfields:
  id: Microsoft Graph User
  version: -1
configuration:
- defaultvalue: Worldwide
  display: Azure Cloud
  name: azure_cloud
  required: false
  type: 15
  options:
  - Worldwide
  - US GCC
  - US GCC-High
  - DoD
  - Germany
  - China
  additionalinfo: When selecting the Custom option, the Server URL parameter must be filled. More information about National clouds can be found here - https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#using-national-cloud
  section: Connect
  advanced: true
- defaultvalue: https://graph.microsoft.com
  display: Server URL (e.g., https://graph.microsoft.com)
  name: host
  required: true
  type: 0
  section: Connect
  additionalinfo: Use this option when required to customize the URL to the Microsoft Graph User endpoint. More information can be found here - https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#using-national-cloud
- name: creds_auth_id
  type: 9
  displaypassword: ID / client ID
  hiddenusername: true
  section: Connect
  required: false
- name: creds_tenant_id
  type: 9
  displaypassword: Token / Tenant ID
  hiddenusername: true
  section: Connect
  required: false
- name: creds_enc_key
  type: 9
  displaypassword: Key / Client Secret
  hiddenusername: true
  section: Connect
  required: false
- display: ID (received from the admin consent - see Detailed Instructions (?)
  name: auth_id
  type: 4
  hidden: true
  section: Connect
  required: false
- display: Token (received from the admin consent - see Detailed Instructions (?) section)
  name: tenant_id
  type: 4
  section: Connect
  hidden: true
  required: false
- display: Key (received from the admin consent - see Detailed Instructions (?)
  name: enc_key
  type: 4
  section: Connect
  hidden: true
  required: false
- display: Certificate Thumbprint
  name: creds_certificate
  type: 9
  displaypassword: Private Key
  section: Connect
  required: false
- display: Certificate Thumbprint
  name: certificate_thumbprint
  type: 4
  section: Connect
  advanced: true
  additionalinfo: Used for certificate authentication. As appears in the "Certificates & secrets" page of the app.
  hidden: true
  required: false
- display: Private Key
  name: private_key
  type: 14
  additionalinfo: Used for certificate authentication. The private key of the registered certificate.
  hidden: true
  section: Connect
  required: false
- additionalinfo: Select this checkbox if you are using a self-deployed Azure application.
  display: Use a self-deployed Azure application
  name: self_deployed
  type: 8
  section: Connect
  advanced: false
  required: false
- display: Application redirect URI (for Self Deployed - Authorization Code Flow)
  name: redirect_uri
  type: 0
  section: Connect
  required: false
- name: creds_auth_code
  type: 9
  section: Connect
  displaypassword: Authorization code (for Self Deployed - Authorization Code Flow)
  hiddenusername: true
  required: false
- display: Authorization code (for Authorization Code flow mode - received from the authorization step. see Detailed Instructions (?) section)
  name: auth_code
  type: 4
  hidden: true
  section: Connect
  required: false
- additionalinfo: Relevant only if the integration is running on Azure VM. If selected, authenticates based on the value provided for the Azure Managed Identities Client ID field. If no value is provided for the Azure Managed Identities Client ID field, authenticates based on the System Assigned Managed Identity. For additional information, see the Help tab.
  display: Use Azure Managed Identities
  name: use_managed_identities
  type: 8
  section: Connect
  required: false
- additionalinfo: The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM.
  displaypassword: Azure Managed Identities Client ID
  name: managed_identities_client_id
  hiddenusername: true
  type: 9
  section: Connect
  required: false
- defaultvalue: 'false'
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- defaultvalue: 'false'
  display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Allow secret generators commands execution
  name: allow_secret_generators
  defaultvalue: 'false'
  type: 8
  section: Connect
  advanced: true
  required: false
  additionalinfo: Checking this box will allow running commands that generate and print secrets. Make sure to add restrictions to the related commands. For more information please refer to the following guide - <MFA guide>
- display: Suppress Errors for Non Found Users
  name: handle_error
  defaultvalue: 'true'
  type: 8
  section: Collect
  advanced: true
  required: false
description: The Entra ID Users integration (formerly Azure Active Directory Users) is a Unified gateway to security insights - all from a unified Microsoft Graph User API.
display: Entra ID Users
name: Microsoft Graph User
script:
  commands:
  - arguments:
    - description: User ID or userPrincipalName.
      name: user
      required: true
    deprecated: true
    description: |-
      Deprecated. Use the msgraph-user-account-disable command instead.
    name: msgraph-user-terminate-session
  - arguments:
    - description: User ID or userPrincipalName.
      name: user
      prettyname: User
      prettypredefined:
        UPN: ${issue.original_alert_json.raw_abioc.event.auth_normalized_user.upn}
      required: true
    description: |-
      Disables a user from all Office 365 applications, and prevents sign in. Note: This command disables the user 
      but does not terminate an existing session. Supported only in a self deployed app flow with the
      Permission: Directory.AccessAsUser.All(Delegated).
    name: msgraph-user-account-disable
    prettyname: Disable User Account [EntraID]
    quickaction: false
    quickaction:platform: true
    compliantpolicies:
    - User Hard Remediation
  - arguments:
    - description: User ID or userPrincipalName.
      name: user
      required: true
    description: Unblock a user.
    name: msgraph-user-unblock
    prettyname: Enable User Account [EntraID]
    quickaction: false
    quickaction:platform: true
    compliantpolicies:
    - User Soft Remediation
  - arguments:
    - description: User ID or userPrincipalName to update properties for.
      name: user
      required: true
    - description: "User fields to update (in a key=value format. Example: displayName=John."
      name: updated_fields
      required: true
    - description: "Delimiter to use for passing multiple fields to the 'updated_fields' argument. Example using ',' as a delimiter: displayName=John,givenName=John,surname=Doe."
      defaultValue: ','
      name: updated_fields_delimiter
    description: |-
      Updates the properties of a user object.
      Permissions: - User.ReadWrite (Delegated & Application).
    name: msgraph-user-update
    outputs:
    - contextPath: MSGraphUser.ID
      description: User's ID.
      type: String
    - contextPath: MSGraphUser.DisplayName
      description: User's display name.
      type: String
    - contextPath: MSGraphUser.GivenName
      description: User's given name.
      type: String
    - contextPath: MSGraphUser.BusinessPhones
      description: User's business phone numbers.
      type: String
    - contextPath: MSGraphUser.JobTitle
      description: User's job title.
      type: String
    - contextPath: MSGraphUser.Mail
      description: User's mail address.
      type: String
    - contextPath: MSGraphUser.MobilePhone
      description: User's mobile phone number.
      type: String
    - contextPath: MSGraphUser.OfficeLocation
      description: User's office location.
      type: String
    - contextPath: MSGraphUser.PreferredLanguage
      description: User's preferred language.
      type: String
    - contextPath: MSGraphUser.Surname
      description: User's surname.
      type: String
    - contextPath: MSGraphUser.UserPrincipalName
      description: User's principal name.
      type: String
  - arguments:
    - description: User ID or userPrincipalName to delete.
      name: user
      required: true
    description: |-
      Deletes an existing user.
      Permissions: - Directory.AccessAsUser.All (Delegated) - User.ReadWrite.All (Application).
    execution: true
    name: msgraph-user-delete
    compliantpolicies:
    - User Hard Remediation
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'true'
      description: true if the account is enabled; otherwise, false.
      name: account_enabled
      predefined:
      - 'true'
      - 'false'
    - description: The name to display in the address book.
      name: display_name
      required: true
    - description: Only needs to be specified when creating a new user account if you are using a federated domain for the user's userPrincipalName (UPN) property.
      name: on_premises_immutable_id
    - description: The mail alias for the user.
      name: mail_nickname
      required: true
    - description: The password profile for the user.
      name: password
      required: true
    - description: ' The user principal name, for example: foo@test.com. '
      name: user_principal_name
      required: true
    - description: 'Optional properties for the user, for example: "displayName=name,mobilePhone=phone-num".'
      name: other_properties
    description: |-
      Creates a new user.
      Permissions: - User.ReadWrite.All (Delegated & Application).
    name: msgraph-user-create
    outputs:
    - contextPath: MSGraphUser.ID
      description: User's ID.
      type: String
    - contextPath: MSGraphUser.DisplayName
      description: User's display name.
      type: String
    - contextPath: MSGraphUser.GivenName
      description: User's given name.
      type: String
    - contextPath: MSGraphUser.BusinessPhones
      description: User's business phone numbers.
      type: String
    - contextPath: MSGraphUser.JobTitle
      description: User's job title.
      type: String
    - contextPath: MSGraphUser.Mail
      description: User's mail address.
      type: String
    - contextPath: MSGraphUser.MobilePhone
      description: User's mobile phone number.
      type: String
    - contextPath: MSGraphUser.OfficeLocation
      description: User's office location.
      type: String
    - contextPath: MSGraphUser.PreferredLanguage
      description: User's preferred language.
      type: String
    - contextPath: MSGraphUser.Surname
      description: User's surname.
      type: String
    - contextPath: MSGraphUser.UserPrincipalName
      description: User's principal name.
      type: String
    - contextPath: Account.ID
      description: User’s ID.
      type: String
    - contextPath: Account.DisplayName
      description: User’s display name.
      type: String
    - contextPath: Account.Username
      description: User’s principal name.
      type: String
    - contextPath: Account.JobTitle
      description: User’s job title.
      type: String
    - contextPath: Account.Email.Address
      description: User’s mail address.
      type: String
    - contextPath: Account.TelephoneNumber
      description: User’s mobile phone number.
      type: String
    - contextPath: Account.Office
      description: User’s office location.
      type: String
    - contextPath: Account.Type
      description: The account entity type.
      type: String
  - arguments:
    - description: 'A CSV list of properties by which to filter the results, for example: "displayName,jobTitle,mobilePhone".'
      name: properties
    deprecated: true
    description: |-
      Deprecated. This command only returns a single page. Use the msgraph-user-list command instead, which gets newly created, updated, or deleted users without performing a full read of the entire user collection.
      Permissions: - User.Read (Delegated) - User.Read.All (Application).
    name: msgraph-user-get-delta
    outputs:
    - contextPath: MSGraphUser.ID
      description: User's ID.
      type: String
    - contextPath: MSGraphUser.DisplayName
      description: User's display name.
      type: String
    - contextPath: MSGraphUser.GivenName
      description: User's given name.
      type: String
    - contextPath: MSGraphUser.BusinessPhones
      description: User's business phone numbers.
      type: String
    - contextPath: MSGraphUser.JobTitle
      description: User's job title.
      type: String
    - contextPath: MSGraphUser.Mail
      description: User's mail address.
      type: String
    - contextPath: MSGraphUser.MobilePhone
      description: User's mobile phone.
      type: String
    - contextPath: MSGraphUser.OfficeLocation
      description: User's office location.
      type: String
    - contextPath: MSGraphUser.PreferredLanguage
      description: User's preferred language.
      type: String
    - contextPath: MSGraphUser.Surname
      description: User's surname.
      type: String
    - contextPath: MSGraphUser.UserPrincipalName
      description: User's principal name.
      type: String
  - arguments:
    - description: User ID or userPrincipalName.
      name: user
      required: true
    - description: 'A CSV list of properties by which to filter the results, for example: "displayName,jobTitle,mobilePhone". For the list of possible properties and the relevant permissions, if needed, visit: https://learn.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0#properties'
      name: properties
    description: |-
      Retrieves the properties and relationships of a user object. For more information, visit: https://learn.microsoft.com/en-us/graph/api/user-get?view=graph-rest-1.0&tabs=http.
      Permissions: - User.Read (Delegated) - User.Read.All (Application).
    name: msgraph-user-get
    outputs:
    - contextPath: MSGraphUser.ID
      description: User's ID.
      type: String
    - contextPath: MSGraphUser.DisplayName
      description: User's display name.
      type: String
    - contextPath: MSGraphUser.GivenName
      description: User's given name.
      type: String
    - contextPath: MSGraphUser.BusinessPhones
      description: User's business phone numbers.
      type: String
    - contextPath: MSGraphUser.JobTitle
      description: User's job title.
      type: String
    - contextPath: MSGraphUser.Mail
      description: User's mail address.
      type: String
    - contextPath: MSGraphUser.MobilePhone
      description: User's mobile phone number.
      type: String
    - contextPath: MSGraphUser.OfficeLocation
      description: User's office location.
      type: String
    - contextPath: MSGraphUser.PreferredLanguage
      description: User's preferred language.
      type: String
    - contextPath: MSGraphUser.Surname
      description: User's surname.
      type: String
    - contextPath: MSGraphUser.UserPrincipalName
      description: User's principal name.
      type: String
    - contextPath: Account.ID
      description: User’s ID.
      type: String
    - contextPath: Account.DisplayName
      description: User’s display name.
      type: String
    - contextPath: Account.Username
      description: User’s principal name.
      type: String
    - contextPath: Account.JobTitle
      description: User’s job title.
      type: String
    - contextPath: Account.Email.Address
      description: User’s mail address.
      type: String
    - contextPath: Account.TelephoneNumber
      description: User’s mobile phone number.
      type: String
    - contextPath: Account.Office
      description: User’s office location.
      type: String
    - contextPath: Account.Type
      description: The account entity type.
      type: String
  - arguments:
    - description: User ID or userPrincipalName.
      name: user
      required: true
    description: |-
      Retrieves the groups a user is part of.
    name: msgraph-user-get-groups
    outputs:
    - contextPath: MSGraphUserGroups.ID
      description: The user ID.
      type: String
    - contextPath: MSGraphUserGroups.Groups.Classification
      description: Value used to classify data types in your groups.
      type: String
    - contextPath: MSGraphUserGroups.Groups.@Odata.Type
      description: A string value that can be used to classify the user's groups.
      type: String
    - contextPath: MSGraphUserGroups.Groups.CreatedDateTime
      description: Group creation date and time.
      type: String
    - contextPath: MSGraphUserGroups.Groups.CreationOptions
      description: Group creation options.
      type: String
    - contextPath: MSGraphUserGroups.Groups.DeletedDateTime
      description: Group deletion date and time.
      type: String
    - contextPath: MSGraphUserGroups.Groups.Description
      description: Group description string.
      type: String
    - contextPath: MSGraphUserGroups.Groups.DisplayName
      description: Group display name.
      type: String
    - contextPath: MSGraphUserGroups.Groups.ExpirationDateTime
      description: Group expiration date and time.
      type: String
    - contextPath: MSGraphUserGroups.Groups.GroupTypes
      description: The types assigned to the group.
      type: String
    - contextPath: MSGraphUserGroups.Groups.ID
      description: Group id.
      type: String
    - contextPath: MSGraphUserGroups.Groups.IsAssignableToRole
      description: Indicates whether the group can be assigned to roles.
      type: Bool
    - contextPath: MSGraphUserGroups.Groups.Mail
      description: Group associated mail.
      type: String
    - contextPath: MSGraphUserGroups.Groups.MailEnabled
      description: Indicates whether the group has mail enabled.
      type: Bool
    - contextPath: MSGraphUserGroups.Groups.MailNickname
      description: Mail nickname of the group.
      type: String
    - contextPath: MSGraphUserGroups.Groups.MembershipRule
      description: Membership rule applied to the group.
      type: String
    - contextPath: MSGraphUserGroups.Groups.MembershipRuleProcessingState
      description: Processing state of the group’s membership rule.
      type: String
    - contextPath: MSGraphUserGroups.Groups.OnPremisesDomainName
      description: On-premises domain name associated with the group.
      type: String
    - contextPath: MSGraphUserGroups.Groups.OnPremisesLastSyncDateTime
      description: Date and time when the group was last synchronized from on-premises.
      type: String
    - contextPath: MSGraphUserGroups.Groups.OnPremisesNetBiosName
      description: On-premises NetBIOS name of the group.
      type: String
    - contextPath: MSGraphUserGroups.Groups.OnPremisesProvisioningErrors
      description: Errors encountered during on-premises provisioning of the group.
      type: String
    - contextPath: MSGraphUserGroups.Groups.OnPremisesSamAccountName
      description: SAM account name of the group in on-premises Active Directory.
      type: String
    - contextPath: MSGraphUserGroups.Groups.OnPremisesSecurityIdentifier
      description: Security identifier (SID) of the group in on-premises Active Directory.
      type: String
    - contextPath: MSGraphUserGroups.Groups.OnPremisesSyncEnabled
      description: Indicates whether the group is synchronized from on-premises.
      type: String
    - contextPath: MSGraphUserGroups.Groups.PreferredDataLocation
      description: Preferred geographic location for the group’s data.
      type: String
    - contextPath: MSGraphUserGroups.Groups.PreferredLanguage
      description: Preferred language for the group.
      type: String
    - contextPath: MSGraphUserGroups.Groups.ProxyAddresses
      description: Email addresses associated with the group.
      type: String
    - contextPath: MSGraphUserGroups.Groups.RenewedDateTime
      description: Date and time the group was last renewed.
      type: String
    - contextPath: MSGraphUserGroups.Groups.ResourceBehaviorOptions
      description: Options defining the group’s behavior as a resource.
      type: String
    - contextPath: MSGraphUserGroups.Groups.ResourceProvisioningOptions
      description: Options used for provisioning the group as a resource.
      type: String
    - contextPath: MSGraphUserGroups.Groups.SecurityEnabled
      description: Indicates whether the group is security-enabled.
      type: Bool
    - contextPath: MSGraphUserGroups.Groups.SecurityIdentifier
      description: Security identifier of the group.
      type: String
    - contextPath: MSGraphUserGroups.Groups.ServiceProvisioningErrors
      description: Errors encountered during service provisioning of the group.
      type: String
    - contextPath: MSGraphUserGroups.Groups.Theme
      description: Theme associated with the group.
      type: String
    - contextPath: MSGraphUserGroups.Groups.UniqueName
      description: Unique name of the group.
      type: String
    - contextPath: MSGraphUserGroups.Groups.Visibility
      description: Groups visibility.
      type: String
    - contextPath: MSGraphUserGroups.Groups.WellKnownObject
      description: Indicates if the group is a well-known system object.
      type: String
  - arguments:
    - description: User ID or userPrincipalName.
      name: user
      required: true
    description: |-
      Retrieve a list of authentication methods registered to a user.
    name: msgraph-user-get-auth-methods
    outputs:
    - contextPath: MSGraphUserAuthMethods.ID
      description: The user ID.
      type: String
    - contextPath: MSGraphUserAuthMethods.Methods.CreatedDateTime
      description: Authentication method's creation date and time.
      type: String
    - contextPath: MSGraphUserAuthMethods.Methods.ID
      description: The unique identifier for the authentication method.
      type: String
    - contextPath: MSGraphUserAuthMethods.Methods.@Odata.Type
      description: The type of the authentication method.
      type: String
    - contextPath: MSGraphUserAuthMethods.Methods.Password
      description: The password associated with the authentication method, if applicable.
      type: String
    - contextPath: MSGraphUserAuthMethods.Methods.DisplayName
      description: Authentication methods displayName.
      type: String
    - contextPath: MSGraphUserAuthMethods.Methods.DeviceTag
      description: The device tag associated with the authentication method.
      type: String
    - contextPath: MSGraphUserAuthMethods.Methods.IsUsable
      description: Indicates whether the authentication method is currently usable.
      type: String
    - contextPath: MSGraphUserAuthMethods.Methods.IsUsableOnce
      description: Indicates whether the authentication method can be used only once.
      type: String
    - contextPath: MSGraphUserAuthMethods.Methods.MethodUsabilityReason
      description: The reason why the authentication method is or is not usable.
      type: String
  - arguments:
    - description: 'A CSV list of properties by which to filter the results, for example: "displayName,jobTitle,mobilePhone".'
      name: properties
    - description: The URL for the next page in the list.
      name: next_page
    - description: 'Filter to be plugged directly into the API. For more information about the Filter syntax, see the Microsoft documentation: https://learn.microsoft.com/en-us/graph/filter-query-parameter?tabs=http.'
      name: filter
    description: |-
      Retrieves a list of user objects.
      Permissions: - User.ReadBasic.All (Delegated) - User.Read.All (Application).
    name: msgraph-user-list
    outputs:
    - contextPath: MSGraphUser.ID
      description: User's ID.
      type: String
    - contextPath: MSGraphUser.DisplayName
      description: User's display name.
      type: String
    - contextPath: MSGraphUser.GivenName
      description: User's given name.
      type: String
    - contextPath: MSGraphUser.BusinessPhones
      description: User's business phone numbers.
      type: String
    - contextPath: MSGraphUser.JobTitle
      description: User's job title.
      type: String
    - contextPath: MSGraphUser.Mail
      description: User's mail address.
      type: String
    - contextPath: MSGraphUser.MobilePhone
      description: User's mobile phone number.
      type: String
    - contextPath: MSGraphUser.OfficeLocation
      description: User's office location.
      type: String
    - contextPath: MSGraphUser.PreferredLanguage
      description: User's preferred language.
      type: String
    - contextPath: MSGraphUser.Surname
      description: User's surname.
      type: String
    - contextPath: MSGraphUser.UserPrincipalName
      description: User's principal name.
      type: String
    - contextPath: MSGraphUser.NextPage
      description: A token to pass to the next list command to retrieve additional results.
      type: String
    - contextPath: Account.ID
      description: User’s ID.
      type: String
    - contextPath: Account.DisplayName
      description: User’s display name.
      type: String
    - contextPath: Account.Username
      description: User’s principal name.
      type: String
    - contextPath: Account.JobTitle
      description: User’s job title.
      type: String
    - contextPath: Account.Email.Address
      description: User’s mail address.
      type: String
    - contextPath: Account.TelephoneNumber
      description: User’s mobile phone number.
      type: String
    - contextPath: Account.Office
      description: User’s office location.
      type: String
    - contextPath: Account.Type
      description: The account entity type.
      type: String
  - arguments:
    - description: The User ID or userPrincipalName of the user for which to retrieve direct reports.
      name: user
      required: true
    description: Retrieves the direct reports for a user. Direct reports are the people who have that user configured as their manager.
    name: msgraph-direct-reports
    outputs:
    - contextPath: MSGraphUserDirectReports.Manager
      description: The manager's user principal name (UPN).
      type: String
    - contextPath: MSGraphUserDirectReports.Reports.@Odata.Type
      description: A string value that can be used to classify user types in your directory, such as "Member" and "Guest".
      type: String
    - contextPath: MSGraphUserDirectReports.Reports.DisplayName
      description: The name displayed in the address book for the user. This is usually the combination of the user's first name, middle initial and last name.
      type: String
    - contextPath: MSGraphUserDirectReports.Reports.GivenName
      description: The given name (first name) of the user.
      type: String
    - contextPath: MSGraphUserDirectReports.Reports.ID
      description: The user ID in Microsoft Graph User.
      type: String
    - contextPath: MSGraphUserDirectReports.Reports.JobTitle
      description: The user's job title.
      type: String
    - contextPath: MSGraphUserDirectReports.Reports.Mail
      description: The email address of the user.
      type: String
    - contextPath: MSGraphUserDirectReports.Reports.MobilePhone
      description: The primary cellular telephone number for the user.
      type: String
    - contextPath: MSGraphUserDirectReports.Reports.OfficeLocation
      description: The office location in the user's place of business.
      type: String
    - contextPath: MSGraphUserDirectReports.Reports.PreferredLanguage
      description: 'The preferred language for the user. Should follow ISO 639-1 Code; for example: en-US.'
      type: String
    - contextPath: MSGraphUserDirectReports.Reports.Surname
      description: The user's surname (family name or last name).
      type: String
    - contextPath: MSGraphUserDirectReports.Reports.UserPrincipalName
      description: The user principal name (UPN) of the user. The UPN is an Internet-style login name for the user based on the Internet standard RFC 822. By convention, this should map to the user's email name. The general format is alias@domain, where domain must be present in the tenant’s collection of verified domains. This property is required when a user is created. The verified domains for the tenant can be accessed from the verifiedDomains property of organization.
      type: String
  - arguments:
    - description: The User ID or userPrincipalName of the user for which to get the manager properties.
      name: user
      required: true
    description: "Retrieves the properties from the manager of a user."
    name: msgraph-user-get-manager
    outputs:
    - contextPath: MSGraphUserManager.ID
      description: User's user ID.
      type: String
    - contextPath: MSGraphUserManager.Manager.ID
      description: Manager's user ID.
      type: String
    - contextPath: MSGraphUserManager.Manager.DisplayName
      description: User's display name.
      type: String
    - contextPath: MSGraphUserManager.Manager.GivenName
      description: User's given name.
      type: String
    - contextPath: MSGraphUserManager.Manager.BusinessPhones
      description: User's business phone numbers.
      type: String
    - contextPath: MSGraphUserManager.Manager.JobTitle
      description: User's job title.
      type: String
    - contextPath: MSGraphUserManager.Manager.Mail
      description: User's mail address.
      type: String
    - contextPath: MSGraphUserManager.Manager.MobilePhone
      description: User's mobile phone number.
      type: String
    - contextPath: MSGraphUserManager.Manager.OfficeLocation
      description: User's office location.
      type: String
    - contextPath: MSGraphUserManager.Manager.PreferredLanguage
      description: User's preferred language.
      type: String
    - contextPath: MSGraphUserManager.Manager.Surname
      description: User's surname.
      type: String
    - contextPath: MSGraphUserManager.Manager.UserPrincipalName
      description: User's principal name.
      type: String
  - arguments:
    - description: User ID or userPrincipalName of the user to which to assign a manager.
      name: user
      required: true
    - description: User ID or userPrincipalName of the manager.
      name: manager
      required: true
    description: |-
      Assigns a manager to the specified user.
      Permission: - User.ReadWrite (Delegated) or - User.ReadWrite (Application).
    name: msgraph-user-assign-manager
  - arguments:
    - description: User ID or userPrincipalName to update password for.
      name: user
      required: true
    - description: The new password.
      name: password
      required: true
      secret: true
    - auto: PREDEFINED
      defaultValue: 'true'
      description: Whether the password will be changed on the next sign in.
      name: force_change_password_next_sign_in
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether to change the password with MFA.
      name: force_change_password_with_mfa
      predefined:
      - 'true'
      - 'false'
    description: |-
      Changes the user password.
      Supported only in a self deployed app flow with the Permission: Directory.AccessAsUser.All(Delegated).
    execution: true
    name: msgraph-user-change-password
    compliantpolicies:
    - User Soft Remediation
  - name: msgraph-user-change-password-on-premise
    description: |-
      Changes the password of an on-premise user. See documentation for full permissions and roles to execute this command. 
      Providing a password is required (password auto-generation is not supported).
    polling: true
    arguments:
    - description: User ID or userPrincipalName to update password for.
      name: user
      required: true
      secret: false
    - description: The new password.
      name: password
      required: false
      secret: true
    - description: "The new password. This argument can be used in playbooks. Note: the value will NOT be hidden in logs."
      name: nonsensitive_password
      required: false
      secret: false
    - description: User ID or userPrincipalName to update password for.
      name: password_method_id
      hidden: true
    - description: Polling url.
      name: polling_url
      hidden: true
    outputs:
    - contextPath: MSGraphUser.user
      description: The user's ID.
      type: String
    - contextPath: MSGraphUser.status
      description: The status of the operation.
      type: String
    - contextPath: MSGraphUser.polling_url
      description: The polling url.
      type: String
  - description: Tests connectivity to Microsoft Graph User.
    name: msgraph-user-test
  - arguments:
    - description: User ID or userPrincipalName.
      name: user
      prettyname: User
      prettypredefined:
        UPN: ${issue.original_alert_json.raw_abioc.event.auth_normalized_user.upn}
      required: true
    description: |-
      Revoke a user session by invalidating all refresh tokens issued to applications for a user.
      This command requires an administrator role.
      Permission required: Directory.AccessAsUser.All (Delegated).
    name: msgraph-user-session-revoke
    prettyname: Terminate Existing Sessions [EntraID]
    quickaction: false
    quickaction:platform: true
    compliantpolicies:
    - User Soft Remediation
  - arguments:
      - description: User ID or userPrincipalName.
        name: user
        prettyname: User
        prettypredefined:
          UPN: ${issue.original_alert_json.raw_abioc.event.auth_normalized_user.upn}
        required: true
    description: |-
      Forces a user to reset their password the next time they log in.
      Note that this action does not terminate the user’s current session.
      If you also want to force the user to sign in again, use the msgraph-user-session-revoke command.
      This operation is supported only when using a self-deployed app flow with the Directory.AccessAsUser.All and User-PasswordProfile.ReadWrite.All delegated permissions. For further info, see https://learn.microsoft.com/en-us/graph/api/user-update?view=graph-rest-1.0&tabs=http#example-3-update-the-passwordprofile-of-a-user-and-reset-their-password
      Furthermore, the signed in user must have a higher privileged administrator role than the user who's password is being reset. The admin hierarchy table can be viewed here: https://learn.microsoft.com/en-us/graph/api/resources/users?view=graph-rest-1.0#who-can-reset-passwords
    name: msgraph-user-force-reset-password
    prettyname: Force Reset Password [EntraID]
    quickaction: false
    quickaction:platform: true
    compliantpolicies:
      - User Soft Remediation
  - arguments:
    - description: The Azure AD user ID.
      name: user_id
      required: true
    description: |-
      Lists all TAP policies for a user.
      This command will only return a single object in the collection as a user can have only one Temporary Access Pass (TAP) method.
      Permission:UserAuthenticationMethod.Read.All
    name: msgraph-user-tap-policy-list
    outputs:
    - contextPath: MSGraphUser.TAPPolicy.ID
      description: TAP policy's ID.
      type: String
    - contextPath: MSGraphUser.TAPPolicy.IsUsable
      description: TAP policy's usability.
      type: Bool
    - contextPath: MSGraphUser.TAPPolicy.IsUsableOnce
      description: TAP policy's once - usability.
      type: Bool
    - contextPath: MSGraphUser.TAPPolicy.CreatedDateTime
      description: TAP policy's creation date and time.
      type: String
    - contextPath: MSGraphUser.TAPPolicy.MethodUsabilityReason
      description: TAP policy's method usability reason.
      type: String
    - contextPath: MSGraphUser.TAPPolicy.LifetimeInMinutes
      description: TAP policy's lifetime in minutes.
      type: Int
    - contextPath: MSGraphUser.TAPPolicy.StartDateTime
      description: TAP policy's start date and time.
      type: String
  - arguments:
    - description: The Azure AD user ID.
      name: user_id
      required: true
    - description: A password for the password-protected zip file that will include the password of the new TAP.
      name: zip_password
      required: true
      secret: true
    - description: The duration of the TAP. Must be between 10 and 43200 (equivalent to 30 days).
      name: lifetime_in_minutes
      required: false
      defaultValue: 60
    - description: |-
        Determines if the pass is limited to a one-time use. If true, the pass can be used once; if false, the TAP can be used multiple times within its 'lifetime_in_minutes' setting.
        A multi-use Temporary Access Pass (isUsableOnce = false) can only be created and used for sign-in if it is allowed by the Temporary Access Pass authentication method policy.
      name: is_usable_once
      required: false
      defaultValue: false
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - description: |-
        The start time for the TAP (has to be a time in the future). Can be specified in ISO 8601 format - "YYYY-MM-DDThh:mm:ssZ",
        for example: "2025-03-26T00:00:00.000Z" or in a future relative time format, for example: "now", "in 2 days".
      name: start_time
      required: false
      defaultValue: now
    description: |-
      Create a new TAP policy for a user.
      During the command execution, a password-protected zip file will be generated, including the new TAP password. You can download the file, use your password to unlock it, and get the TAP password.
      A user can only have one Temporary Access Pass that's usable within its specified lifetime.
      Permission:UserAuthenticationMethod.ReadWrite.All
    name: msgraph-user-tap-policy-create
    outputs:
    - contextPath: MSGraphUser.TAPPolicy.ID
      description: TAP policy's ID.
      type: String
    - contextPath: MSGraphUser.TAPPolicy.IsUsable
      description: TAP policy's usability.
      type: Bool
    - contextPath: MSGraphUser.TAPPolicy.IsUsableOnce
      description: TAP policy's once - usability.
      type: Bool
    - contextPath: MSGraphUser.TAPPolicy.CreatedDateTime
      description: TAP policy's creation date and time.
      type: String
    - contextPath: MSGraphUser.TAPPolicy.MethodUsabilityReason
      description: TAP policy's method usability reason.
      type: String
    - contextPath: MSGraphUser.TAPPolicy.LifetimeInMinutes
      description: TAP policy's lifetime in minutes.
      type: Int
    - contextPath: MSGraphUser.TAPPolicy.StartDateTime
      description: TAP policy's start date and time.
      type: String
  - arguments:
    - description: The Azure AD user ID.
      name: user_id
      required: true
    - description: Policy ID.
      name: policy_id
      required: true
    description: Deletes a specific TAP policy. Permission:UserAuthenticationMethod.ReadWrite.All
    name: msgraph-user-tap-policy-delete
  - description: Generate the login url used for Authorization code flow.
    name: msgraph-user-generate-login-url
    arguments: []
  - description: Run this command if for some reason you need to rerun the authentication process.
    name: msgraph-user-auth-reset
    arguments: []
  - arguments:
    - description: The Azure AD user ID.
      name: user
      required: true
    - description: Number of devices in the list. Maximum is 50.
      name: limit
      required: false
      defaultValue: 50
    - description: The URL for the next page in the list.
      name: next_page
    - description: 'Filter to be plugged directly into the API. For more information about the Filter syntax, see the Microsoft documentation: https://learn.microsoft.com/en-us/graph/filter-query-parameter?tabs=http.'
      name: filter
    description: |-
      Lists the devices that are owned by the user.
      Permission: User.Read.All,Directory.Read.All - Delegated 
    name: msgraph-user-owned-devices-list
    outputs:
    - contextPath: MSGraphUser.ID
      description: User's ID.
      type: String
    - contextPath: MSGraphUser.OwnedDevice.ID
      description: Owned device's ID.
      type: String
    - contextPath: MSGraphUser.OwnedDevice.PhysicalIds
      description: Physical IDs of the device.
      type: String
    - contextPath: MSGraphUser.OwnedDevice.DeviceVersion
      description: The version of the device.
      type: String
    - contextPath: MSGraphUser.OwnedDevice.ProfileType
      description: The profile type of the device.
      type: String
    - contextPath: MSGraphUser.OwnedDevice.CreatedDateTime
      description: The date and time the device was created.
      type: String
    - contextPath: MSGraphUser.OwnedDevice.ApproximateLastSignInDateTime
      description: The approximate date and time of the last sign-in.
      type: String
    - contextPath: MSGraphUser.OwnedDevice.OperatingSystemVersion
      description: The version of the operating system.
      type: String
    - contextPath: MSGraphUser.OwnedDevice.AlternativeSecurityIds
      description: Alternative security IDs of the device.
      type: String
    - contextPath: MSGraphUser.OwnedDevice.DisplayName
      description: The display name of the device.
      type: String
    - contextPath: MSGraphUser.OwnedDevice.OperatingSystem
      description: The operating system of the device.
      type: String
    - contextPath: MSGraphUser.OwnedDevice.DeviceId
      description: The unique identifier for the device.
      type: String
    - contextPath: MSGraphUser.OwnedDevice.TrustType
      description: The trust type of the device.
      type: String
    - contextPath: MSGraphUser.OwnedDevice.RegistrationDateTime
      description: The date and time when the device was registered.
      type: String
  - arguments:
    - description: User ID or userPrincipalName.
      name: user
      required: true
    - description: The ID of a specific FIDO2 authentication method to retrieve.
      name: method_id
      required: false
    description: |-
      Lists the FIDO2 authentication methods registered to a user or retrieves a specific method by ID.
      Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All
    name: msgraph-user-fido2-method-list
    outputs:
    - contextPath: MSGraphUser.FIDO2Method.ID
      description: The unique identifier of the FIDO2 authentication method.
      type: String
    - contextPath: MSGraphUser.FIDO2Method.DisplayName
      description: The display name of the key as given by the user.
      type: String
    - contextPath: MSGraphUser.FIDO2Method.CreatedDateTime
      description: The timestamp when this key was registered.
      type: String
    - contextPath: MSGraphUser.FIDO2Method.AaGuid
      description: Authenticator Attestation GUID, an identifier that indicates the type of authenticator.
      type: String
    - contextPath: MSGraphUser.FIDO2Method.Model
      description: The manufacturer-assigned model of the FIDO2 security key.
      type: String
    - contextPath: MSGraphUser.FIDO2Method.AttestationCertificates
      description: The attestation certificate(s) attached to this security key.
      type: String
    - contextPath: MSGraphUser.FIDO2Method.AttestationLevel
      description: The attestation level of this FIDO2 security key.
      type: String
  - arguments:
    - description: User ID or userPrincipalName.
      name: user
      required: true
    - description: The ID of the FIDO2 authentication method to delete.
      name: method_id
      required: true
    description: |-
      Deletes a FIDO2 authentication method from a user.
      Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application
    name: msgraph-user-fido2-method-delete
  - arguments:
    - description: User ID or userPrincipalName.
      name: user
      required: true
    - description: The ID of a specific email authentication method to retrieve.
      name: method_id
      required: false
    description: |-
      Lists the email authentication methods registered to a user, or retrieves a specific email method by ID.
      Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application
    name: msgraph-user-email-method-list
    outputs:
    - contextPath: MSGraphUser.EmailAuthMethod.ID
      description: The unique identifier of the email authentication method.
      type: String
    - contextPath: MSGraphUser.EmailAuthMethod.EmailAddress
      description: The email address registered to this user.
      type: String
  - arguments:
    - description: User ID or userPrincipalName.
      name: user
      required: true
    - description: The ID of the email authentication method to delete.
      name: method_id
      required: false
      defaultValue: 3ddfcfc8-9383-446f-83cc-3ab9be4be18f
    description: |-
      Deletes an email authentication method from a user.
      Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application
    name: msgraph-user-email-method-delete
  - arguments:
    - description: User ID or userPrincipalName.
      name: user
      required: true
    - description: The ID of a specific Microsoft Authenticator authentication method to retrieve.
      name: method_id
      required: false
    - description: Maximum number of results to return when listing all methods.
      name: limit
      required: false
      defaultValue: 50
    - description: The URL for the next page in the list.
      name: next_page
      required: false
    description: |-
      Lists the Microsoft Authenticator authentication methods registered to a user, or retrieves a specific method by ID.
      Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application
    name: msgraph-user-authenticator-method-list
    outputs:
    - contextPath: MSGraphUser.UserAuthMethod.ID
      description: The unique identifier of the Microsoft Authenticator authentication method.
      type: String
    - contextPath: MSGraphUser.UserAuthMethod.DisplayName
      description: The name of the device on which Microsoft Authenticator is registered.
      type: String
    - contextPath: MSGraphUser.UserAuthMethod.PhoneAppVersion
      description: The version of Microsoft Authenticator installed on the device.
      type: String
    - contextPath: MSGraphUser.UserAuthMethod.DeviceTag
      description: Tags containing app metadata.
      type: String
    - contextPath: MSGraphUser.UserAuthMethod.CreatedDateTime
      description: The timestamp when this method was registered to the user.
      type: String
    - contextPath: MSGraphUser.UserAuthMethod.NextPage
      description: A token to pass to the next list command to retrieve additional results.
      type: String
  - arguments:
    - description: User ID or userPrincipalName.
      name: user
      required: true
    - description: The ID of the Microsoft Authenticator authentication method to delete.
      name: method_id
      required: true
    description: |-
      Deletes a Microsoft Authenticator authentication method from a user.
      Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application
    name: msgraph-user-authenticator-method-delete
  - arguments:
    - description: User ID or userPrincipalName.
      name: user
      required: true
    - description: The ID of a specific phone authentication method to retrieve.
      name: method_id
      required: false
    - description: The URL for the next page in the list.
      name: next_page
      required: false
    description: |-
      Lists the phone authentication methods registered to a user, or retrieves a specific phone method by ID.
      Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application
    name: msgraph-user-phone-method-list
    outputs:
    - contextPath: MSGraphUser.PhoneAuthMethod.ID
      description: The unique identifier of the phone authentication method.
      type: String
    - contextPath: MSGraphUser.PhoneAuthMethod.PhoneNumber
      description: The phone number registered to this user.
      type: String
    - contextPath: MSGraphUser.PhoneAuthMethod.PhoneType
      description: The type of phone (mobile, alternateMobile, or office).
      type: String
    - contextPath: MSGraphUser.PhoneAuthMethod.SmsSignInState
      description: Whether the phone is ready to be used for SMS sign-in.
      type: String
    - contextPath: MSGraphUser.PhoneAuthMethod.NextPage
      description: A token to pass to the next list command to retrieve additional results.
      type: String
  - arguments:
    - description: User ID or userPrincipalName.
      name: user
      required: true
    - description: The ID of the phone authentication method to delete.
      name: method_id
      required: true
    description: |-
      Deletes a phone authentication method from a user.
      Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application
    name: msgraph-user-phone-method-delete
  - arguments:
    - description: User ID or userPrincipalName.
      name: user
      required: true
    - description: The ID of a specific software OATH authentication method to retrieve.
      name: method_id
      required: false
    description: |-
      Lists the software OATH authentication methods registered to a user, or retrieves a specific method by ID.
      Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application
    name: msgraph-user-software-oath-method-list
    outputs:
    - contextPath: MSGraphUser.SoftOathAuthMethod.ID
      description: The unique identifier of the software OATH authentication method.
      type: String
  - arguments:
    - description: User ID or userPrincipalName.
      name: user
      required: true
    - description: The ID of the software OATH authentication method to delete.
      name: method_id
      required: true
    description: |-
      Deletes a software OATH authentication method from a user.
      Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application
    name: msgraph-user-software-oath-method-delete
  - arguments:
    - description: User ID or userPrincipalName.
      name: user
      required: true
    - description: The ID of a specific Windows Hello for Business authentication method to retrieve.
      name: method_id
      required: false
    description: |-
      Lists the Windows Hello for Business authentication methods registered to a user, or retrieves a specific method by ID.
      Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application
    name: msgraph-user-windows-hello-method-list
    outputs:
    - contextPath: MSGraphUser.WindowsHelloAuthMethod.ID
      description: The unique identifier of the Windows Hello for Business authentication method.
      type: String
    - contextPath: MSGraphUser.WindowsHelloAuthMethod.DisplayName
      description: The name of the device on which Windows Hello is registered.
      type: String
    - contextPath: MSGraphUser.WindowsHelloAuthMethod.KeyStrength
      description: The key strength of the Windows Hello for Business key (normal or weak).
      type: String
    - contextPath: MSGraphUser.WindowsHelloAuthMethod.CreatedDateTime
      description: The timestamp when this method was registered to the user.
      type: String
  - arguments:
    - description: User ID or userPrincipalName.
      name: user
      required: true
    - description: The ID of the Windows Hello for Business authentication method to delete.
      name: method_id
      required: true
    description: |-
      Deletes a Windows Hello for Business authentication method from a user.
      Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application
    name: msgraph-user-windows-hello-method-delete
  - arguments:
    - description: User ID or userPrincipalName.
      name: user
      required: true
    - description: The ID of a specific Temporary Access Pass authentication method to retrieve.
      name: method_id
      required: false
    description: |-
      Lists the Temporary Access Pass authentication methods registered to a user, or retrieves a specific method by ID.
      Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application
    name: msgraph-user-temp-access-pass-method-list
    outputs:
    - contextPath: MSGraphUser.TempAccessPassAuthMethod.ID
      description: The unique identifier of the Temporary Access Pass authentication method.
      type: String
    - contextPath: MSGraphUser.TempAccessPassAuthMethod.IsUsable
      description: Indicates whether the authentication method is currently usable.
      type: Bool
  - arguments:
    - description: User ID or userPrincipalName.
      name: user
      required: true
    - description: The ID of the Temporary Access Pass authentication method to delete.
      name: method_id
      required: true
    description: |-
      Deletes a Temporary Access Pass authentication method from a user.
      Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application
    name: msgraph-user-temp-access-pass-method-delete
  - arguments:
    - description: The user mail to send the MFA request to.
      name: user_mail
      required: true
    - description: The timeout for the MFA request.
      name: timeout
      required: false
      defaultValue: 60
    - description: The MFA access token obtained from msgraph-user-create-mfa-client-access-token command.
      name: access_token
      required: true
      secret: true
    description: Pops a synchronous MFA request for the given user. This is a blocking call that waits for user response or timeout.
    name: msgraph-user-request-mfa
    hidden: true
  - arguments:
    - description: User ID or userPrincipalName.
      name: user
      required: true
    description: Retrieves the authentication preferences for a user, including the default method.
    name: msgraph-user-get-user-default-auth-method
    hidden: true
    outputs:
    - contextPath: MSGraphUser.AuthMethod.User
      description: The user principal name.
      type: String
    - contextPath: MSGraphUser.AuthMethod.DefaultMethod
      description: The default authentication method for the user.
      type: String
    - contextPath: MSGraphUser.AuthMethod.IsSystemPreferredAuthenticationMethodEnabled
      description: Whether system-preferred authentication is enabled.
      type: Boolean
    - contextPath: MSGraphUser.AuthMethod.UserPreferredMethodForSecondaryAuthentication
      description: The user's preferred method for secondary authentication.
      type: String
    - contextPath: MSGraphUser.AuthMethod.SystemPreferredAuthenticationMethod
      description: The system-preferred authentication method.
      type: String
  - name: msgraph-user-create-mfa-client-secret
    hidden: true
    description: Issue a new client secret for the MFA app.
    outputs:
    - contextPath: MSGraphUser.MFAClientSecret.ValidUntil
      description: The expiration date for the client secret in ISO 8601 format.
      type: String
    - contextPath: MSGraphUser.MFAClientSecret.MFAClientSecret
      description: The new MFA client secret.
      type: String
    - contextPath: MSGraphUser.MFAClientSecret.ValidFrom
      description: The date of issue for the client secret.
      type: String
  - name: msgraph-user-create-mfa-client-access-token
    hidden: true
    description: Issue a new access token for the MFA app.
    arguments:
    - description: The MFA app client secret obtained from msgraph-user-create-mfa-client-secret command.
      name: client_secret
      required: true
      secret: true
    outputs:
    - contextPath: MSGraphUser.MFAAccessToken.ValidUntil
      description: The expiration date for the access token in epoch format.
      type: String
    - contextPath: MSGraphUser.MFAAccessToken.AccessToken
      description: The access token value.
      type: String
  dockerimage: demisto/crypto:1.0.0.11658507
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- Microsoft Graph User - Test
fromversion: 5.0.0
supportsquickactions: true