Microsoft Graph User

The Entra ID Users integration (formerly Azure Active Directory Users) is a Unified gateway to security insights - all from a unified Microsoft Graph User API.

Authentication

For more details about the authentication used in this integration, see Microsoft Integrations - Authentication.

Required Permissions:

• Directory.Read.All - Delegated
• User.ReadWrite.All - Application
• User.Read - Delegated

Authorize Cortex XSOAR for Entra ID Users (Self deployed Azure App)

There are two different authentication methods for a self-deployed configuration:

• Client Credentials flow
• Authorization Code flow

We recommend using the Client Credentials flow.
In order to use the msgraph-user-change-password command, you must configure with the Authorization Code flow.

Note: When using the Authorization Code flow, make sure the user you authenticate with has the correct roles in Azure AD in order to use the command.

Configure Entra ID Users in Cortex

Azure cloud options

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

msgraph-user-account-disable

Disables a user from all Office 365 applications, and prevents sign in. Note: This command disables the user
but does not terminate an existing session. Supported only in a self deployed app flow with the
Permission: Directory.AccessAsUser.All(Delegated).

Base Command

msgraph-user-account-disable

Input

Context Output

There is no context output for this command.

msgraph-user-unblock

Unblock a user.

Base Command

msgraph-user-unblock

Input

Command example

!msgraph-user-unblock user=123456-abcd-7890-erty-987qwe987

Human Readable Output

“123456-abcd-7890-erty-987qwe987” unblocked. It might take several minutes for the changes to take affect across all applications.

msgraph-user-update

Updates the properties of a user object.
Permissions: - User.ReadWrite (Delegated & Application)
Permission For unblocking an admin/privileged user: User.EnableDisableAccount.All (Application).

Base Command

msgraph-user-update

Input

Context Output

Command example

!msgraph-user-update user=123456-abcd-7890-erty-987qwe987 updated_fields="MobilePhone=050123456"

Context Example

{
    "Account": {
        "DisplayName": "Test 1",
        "Email": {
            "Address": null
        },
        "ID": "123456-abcd-7890-erty-987qwe987",
        "JobTitle": null,
        "Office": null,
        "TelephoneNumber": "050123456",
        "Type": "Azure AD",
        "Username": "test1@demistodev.onmicrosoft.com"
    },
    "MSGraphUser": {
        "BusinessPhones": [],
        "DisplayName": "Test 1",
        "GivenName": "Test",
        "ID": "123456-abcd-7890-erty-987qwe987",
        "JobTitle": null,
        "Mail": null,
        "MobilePhone": "050123456",
        "OfficeLocation": null,
        "PreferredLanguage": null,
        "Surname": "Test",
        "UserPrincipalName": "test1@demistodev.onmicrosoft.com"
    }
}

Human Readable Output

123456-abcd-7890-erty-987qwe987 data

Display Name	Given Name	ID	Mobile Phone	Surname	User Principal Name
Test 1	Test	123456-abcd-7890-erty-987qwe987	050123456	Test	test1@demistodev.onmicrosoft.com

msgraph-user-delete

Deletes an existing user.
Permissions: Directory.AccessAsUser.All (Delegated), User.ReadWrite.All (Application)

Base Command

msgraph-user-delete

Input

msgraph-user-create

Creates a new user.
Permissions: User.ReadWrite.All (Delegated & Application)

Base Command

msgraph-user-create

Input

Context Output

msgraph-user-get

Retrieves the properties and relationships of a user object. For more information, visit: https://learn.microsoft.com/en-us/graph/api/user-get?view=graph-rest-1.0&tabs=http.
Permissions: User.Read (Delegated), User.Read.All (Application).

Base Command

msgraph-user-get

Input

Context Output

Command example

!msgraph-user-get user=123456-abcd-7890-erty-987qwe987

Context Example

{
    "Account": {
        "DisplayName": "Test 1",
        "Email": {
            "Address": null
        },
        "ID": "123456-abcd-7890-erty-987qwe987",
        "JobTitle": null,
        "Office": null,
        "TelephoneNumber": "050123456",
        "Type": "Azure AD",
        "Username": "test1@demistodev.onmicrosoft.com"
    },
    "MSGraphUser": {
        "BusinessPhones": [],
        "DisplayName": "Test 1",
        "GivenName": "Test",
        "ID": "123456-abcd-7890-erty-987qwe987",
        "JobTitle": null,
        "Mail": null,
        "MobilePhone": "050123456",
        "OfficeLocation": null,
        "PreferredLanguage": null,
        "Surname": "Test",
        "UserPrincipalName": "test1@demistodev.onmicrosoft.com"
    }
}

Human Readable Output

123456-abcd-7890-erty-987qwe987 data

Display Name	Given Name	ID	Mobile Phone	Surname	User Principal Name
Test 1	Test	123456-abcd-7890-erty-987qwe987	050123456	Test	test1@demistodev.onmicrosoft.com

msgraph-user-list

Retrieves a list of user objects.
Permissions: User.ReadBasic.All (Delegated), User.Read.All (Application)

Base Command

msgraph-user-list

Input

Context Output

Command example

#### Context Example

```json
{
    "Account": [
        {
            "DisplayName": "Test1",
            "Email": {
                "Address": "test1@demistodev.onmicrosoft.com"
            },
            "ID": "123456-abcd-7890-erty-987qwe988",
            "JobTitle": null,
            "Office": null,
            "TelephoneNumber": "050505050",
            "Type": "Azure AD",
            "Username": null
        },
        {
            "DisplayName": "Test2",
            "Email": {
                "Address": "test2@demistodev.onmicrosoft.com"
            },
            "ID": "123456-abcd-7890-erty-987qwe989",
            "JobTitle": null,
            "Office": null,
            "TelephoneNumber": null,
            "Type": "Azure AD",
            "Username": null
        },
        {
            "DisplayName": "Test3",
            "Email": {
                "Address": null
            },
            "ID": "123456-abcd-7890-erty-987qwe990",
            "JobTitle": null,
            "Office": null,
            "TelephoneNumber": null,
            "Type": "Azure AD",
            "Username": null
        }
    ],
    "MSGraphUser": [
        {
            "NextPage": "https://graph.microsoft.com/v1.0/users?$select=id%2cdisplayName%2cjobTitle%2cmobilePhone%2cmail&$count=true&$skiptoken=m~AQAnO2Q2MjljMzcwNjFjOTQ4NTE4ZjNkODBlYTZjMDc2NTVmOzswOzA7"
        },
        {
            "DisplayName": "Test 1",
            "ID": "123456-abcd-7890-erty-987qwe991",
            "JobTitle": null,
            "Mail": "test1@demistodev.onmicrosoft.com",
            "MobilePhone": "050505050"
        },
        {
            "DisplayName": "Test 2",
            "ID": "123456-abcd-7890-erty-987qwe992",
            "JobTitle": null,
            "Mail": "test2@demistodev.onmicrosoft.com",
            "MobilePhone": null
        },
        {
            "DisplayName": "Test 3",
            "ID": "123456-abcd-7890-erty-987qwe993",
            "JobTitle": null,
            "Mail": null,
            "MobilePhone": null
        }
    ]
}

Human Readable Output

All Graph Users

To get further results, enter this to the next_page parameter:
https://graph.microsoft.com/v1.0/users?$select=id%2cdisplayName%2cjobTitle%2cmobilePhone%2cmail&$count=true&$skiptoken=m~AQAnO2Q2MjljMzcwNjFjOTQ4NTE4ZjNkODBlYTZjMDc2NTVmOzswOzA7

Display Name	ID	Job Title	Mail	Mobile Phone
Test 1	023096d0-595e-47b5-80dd-ea5886ab9294		test1@demistodev.onmicrosoft.com	050505050
Test 2	0628c545-94f6-4d07-8bc6-e6718ba1bc95		test2@demistodev.onmicrosoft.com
Test 3	082b3bc9-bb2d-4d12-8b1a-d84a53229696

msgraph-direct-reports

Retrieves the direct reports for a user. Direct reports are the people who have that user configured as their manager.

Base Command

msgraph-direct-reports

Input

Context Output

Command example

!msgraph-direct-reports user=123456-abcd-7890-erty-987qwe987

Context Example

{
    "MSGraphUserDirectReports": {
        "Manager": "123456-abcd-7890-erty-987qwe987",
        "Reports": [
            {
                "@Odata.Type": "#microsoft.graph.user",
                "BusinessPhones": [],
                "DisplayName": "Test 1",
                "GivenName": "Test",
                "ID": "123456-abcd-7890-erty-987qwe987",
                "JobTitle": null,
                "Mail": null,
                "MobilePhone": "050123456",
                "OfficeLocation": null,
                "PreferredLanguage": null,
                "Surname": "Test",
                "UserPrincipalName": "test1@demistodev.onmicrosoft.com"
            }
        ]
    }
}

Human Readable Output

259d2a3c-167b-411c-b2ee-88646ce6e054 - direct reports

@Odata.Type	Display Name	Given Name	ID	Mobile Phone	Surname	User Principal Name
#microsoft.graph.user	Test 1	Test	123456-abcd-7890-erty-987qwe987	050123456	Test	test1@demistodev.onmicrosoft.com

msgraph-user-get-manager

Retrieves the properties from the manager of a user.

Base Command

msgraph-user-get-manager

Input

Context Output

Command example

!msgraph-user-get-manager user=123456-abcd-7890-erty-987qwe987

Context Example

{
    "MSGraphUserManager": {
        "Manager": {
            "BusinessPhones": [],
            "DisplayName": "Test 2",
            "GivenName": "Test",
            "ID": "259d2a3c-167b-411c-b2ee-88646ce6e054",
            "JobTitle": null,
            "Mail": null,
            "MobilePhone": "050505050",
            "OfficeLocation": null,
            "PreferredLanguage": null,
            "Surname": "Test",
            "UserPrincipalName": "test2@demistodev.onmicrosoft.com"
        },
        "User": "123456-abcd-7890-erty-987qwe987"
    }
}

Human Readable Output

123456-abcd-7890-erty-987qwe987 - manager

Display Name	Given Name	ID	Mobile Phone	Surname	User Principal Name
Test 2	Test	259d2a3c-167b-411c-b2ee-88646ce6e054	050505050	Test	test2@demistodev.onmicrosoft.com

msgraph-user-assign-manager

Assigns a manager to the specified user.
Permission: - User.ReadWrite (Delegated) or - User.ReadWrite (Application)

Base Command

msgraph-user-assign-manager

Input

Context Output

There is no context output for this command.

Command example

!msgraph-user-assign-manager user=123456-abcd-7890-erty-987qwe987 manager=9627hp-sq12-b65m-4256h6h

Human Readable Output

A manager was assigned to user “123456-abcd-7890-erty-987qwe987”. It might take several minutes for the changes to take effect across all applications.

msgraph-user-change-password

Changes the user password.
Supported only in a self deployed app flow with the Permission: Directory.AccessAsUser.All(Delegated)
Note: In order to change the password, you need additional permissions: Auth Admin, Privileged Auth Admin or Global Admin, depending on the target user’s role.

Base Command

msgraph-user-change-password

Input

msgraph-user-test

Tests connectivity to Microsoft Graph User.

Base Command

msgraph-user-test

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command example

!msgraph-user-test

Human Readable Output

msgraph-user-session-revoke

Revoke a user session by invalidating all refresh tokens issued to applications for a user.
This command requires an administrator role.
Permission required: Directory.AccessAsUser.All (Delegated).

Base Command

msgraph-user-session-revoke

Input

Context Output

There is no context output for this command.
There is no context output for this command.

msgraph-user-generate-login-url

Generate the login url used for Authorization code flow.

Base Command

msgraph-user-generate-login-url

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example

msgraph-user-generate-login-url

Human Readable Output

Authorization instructions

1. Click on the login URL to sign in and grant Cortex XSOAR permissions for your Azure Service Management.
   You will be automatically redirected to a link with the following structure:
   REDIRECT_URI?code=AUTH_CODE&session_state=SESSION_STATE
2. Copy the AUTH_CODE (without the code= prefix, and the session_state parameter)
   and paste it in your instance configuration under the Authorization code parameter.

msgraph-user-auth-reset

Run this command if for some reason you need to rerun the authentication process.

Base Command

msgraph-user-auth-reset

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

msgraph-user-tap-policy-delete

Deletes a specific TAP policy.
Permissions: UserAuthenticationMethod.ReadWrite.All (Delegated), UserAuthenticationMethod.ReadWrite.All (Application).

Base Command

msgraph-user-tap-policy-delete

Input

Context Output

There is no context output for this command.

Command example

!msgraph-user-tap-policy-delete policy_id=r4y67u4-69nh-h671-a4bj8922 user_id=123456-abcd-7890-erty-987qwe987"

msgraph-user-tap-policy-create

Create a new TAP policy for a user.
During the command execution, a password-protected zip file will be generated, including the new TAP password. You can download the file, use your password to unlock it, and get the TAP password.
A user can only have one Temporary Access Pass that’s usable within its specified lifetime.
Permissions: UserAuthenticationMethod.ReadWrite.All (Delegated), UserAuthenticationMethod.ReadWrite.All (Application).

Base Command

msgraph-user-tap-policy-create

Input

Context Output

Command example

!msgraph-user-tap-policy-create user_id=123456-abcd-7890-erty-987qwe987 zip_password=123

msgraph-user-tap-policy-list

Lists all TAP policies for a user.
This command will only return a single object in the collection as a user can have only one Temporary Access Pass (TAP) method.
Permissions: UserAuthenticationMethod.Read.All (Delegated), UserAuthenticationMethod.Read.All (Application).

Base Command

msgraph-user-tap-policy-list

Input

Context Output

Command example

!msgraph-user-tap-policy-list user_id=123456-abcd-7890-erty-987qwe987

msgraph-user-change-password-on-premise

Changes the password of an on-premise user. Requires the following permissions: -UserAuthenticationMethod.Read.All - delegated, Users.Read.All - delegated.
Providing a password is required (password auto-generation is not supported).

Prerequisites and Configuration Requirements:

1. Authentication Flow: Must use Authorization Code flow with a self-deployed Azure app. Client Credentials flow is not supported for this command.

2. Required App Permissions: The Azure app must have the following delegated permissions:
   • UserAuthenticationMethod.ReadWrite.All - Delegated
   • Users.Read.All - Delegated
3. Azure App Role Configuration:
   • The app must have the Authorization Administrator role granted to it through the Microsoft Entra Admin Center:
     • Navigate to Roles and administrators → Search for Authorization Administrator
     • Click Authorization Administrator → Add assignments.
     • Select the app you want to configure the instance with and click Save.
   • Additionally, create a new app role in the Azure Portal for the app you want to configure the instance with:
     • Navigate to App roles → Create Role App
     • Set Value to UserAuthenticationMethod.ReadWrite.All
     • Set Allowed member types to Both.
     • Click on Create.
4. User Role Requirements: The logged-in user (authenticating via Authorization Code flow) must have the Authorization Administrator role in Azure AD.

Base Command

msgraph-user-change-password-on-premise

Input

Context Output

There is no context output for this command.

Command example

!msgraph-user-change-password-on-premise user=123456-abcd-7890-erty-987qwe987 password=123456

msgraph-user-force-reset-password

Forces a user to reset their password the next time they log in.
Note that this action does not terminate the user’s current session.
If you also want to force the user to sign in again, use the msgraph-user-session-revoke command.
This operation is supported only when using a self-deployed app flow with the Directory.AccessAsUser.All and User-PasswordProfile.ReadWrite.All delegated permissions. For further info, see https://learn.microsoft.com/en-us/graph/api/user-update?view=graph-rest-1.0&tabs=http#example-3-update-the-passwordprofile-of-a-user-and-reset-their-password
Furthermore, the signed in user must have a higher privileged administrator role than the user who’s password is being reset. The admin hierarchy table can be viewed here: https://learn.microsoft.com/en-us/graph/api/resources/users?view=graph-rest-1.0#who-can-reset-passwords

Base Command

msgraph-user-force-reset-password

Input

Context Output

There is no context output for this command.

msgraph-user-get-groups

Retrieves the groups a user is part of.

Base Command

msgraph-user-get-groups

Input

Context Output

msgraph-user-get-auth-methods

Retrieve a list of authentication methods registered to a user.

Base Command

msgraph-user-get-auth-methods

Input

Context Output

msgraph-user-owned-devices-list

Lists the devices that are owned by the user.
Permission:User.Read.All, Directory.Read.All - Delegated
Note: When using the XSOAR app, this command returns partial data. To retrieve full data, use a self-deployed Azure app with the appropriate permissions.

Base Command

msgraph-user-owned-devices-list

Input

Context Output

msgraph-user-fido2-method-list

Lists the FIDO2 authentication methods registered to a user, or retrieves a specific FIDO2 method by ID.
Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All

Base Command

msgraph-user-fido2-method-list

Input

Context Output

msgraph-user-fido2-method-delete

Deletes a FIDO2 authentication method from a user.
Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Base Command

msgraph-user-fido2-method-delete

Input

Context Output

There is no context output for this command.

msgraph-user-email-method-list

Lists the email authentication methods registered to a user, or retrieves a specific email method by ID.
Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Base Command

msgraph-user-email-method-list

Input

Context Output

msgraph-user-email-method-delete

Deletes an email authentication method from a user.
Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Base Command

msgraph-user-email-method-delete

Input

Context Output

There is no context output for this command.

msgraph-user-authenticator-method-list

Lists the Microsoft Authenticator authentication methods registered to a user, or retrieves a specific method by ID.
Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Base Command

msgraph-user-authenticator-method-list

Input

Context Output

msgraph-user-authenticator-method-delete

Deletes a Microsoft Authenticator authentication method from a user.
Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Base Command

msgraph-user-authenticator-method-delete

Input

Context Output

There is no context output for this command.

msgraph-user-phone-method-list

Lists the phone authentication methods registered to a user, or retrieves a specific phone method by ID.
Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Base Command

msgraph-user-phone-method-list

Input

Context Output

msgraph-user-phone-method-delete

Deletes a phone authentication method from a user.
Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Base Command

msgraph-user-phone-method-delete

Input

Context Output

There is no context output for this command.

msgraph-user-software-oath-method-list

Lists the software OATH authentication methods registered to a user, or retrieves a specific method by ID.
Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Base Command

msgraph-user-software-oath-method-list

Input

Context Output

msgraph-user-software-oath-method-delete

Deletes a software OATH authentication method from a user.
Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Base Command

msgraph-user-software-oath-method-delete

Input

Context Output

There is no context output for this command.

msgraph-user-windows-hello-method-list

Lists the Windows Hello for Business authentication methods registered to a user, or retrieves a specific method by ID.
Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Base Command

msgraph-user-windows-hello-method-list

Input

Context Output

msgraph-user-windows-hello-method-delete

Deletes a Windows Hello for Business authentication method from a user.
Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Base Command

msgraph-user-windows-hello-method-delete

Input

Context Output

There is no context output for this command.

msgraph-user-temp-access-pass-method-list

Lists the Temporary Access Pass authentication methods registered to a user, or retrieves a specific method by ID.
Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Base Command

msgraph-user-temp-access-pass-method-list

Input

Context Output

msgraph-user-temp-access-pass-method-delete

Deletes a Temporary Access Pass authentication method from a user.
Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application

Base Command

msgraph-user-temp-access-pass-method-delete

Input

Context Output

There is no context output for this command.