category: Analytics & SIEM provider: Microsoft sectionorder: - Connect - Collect commonfields: id: Microsoft Graph User version: -1 configuration: - defaultvalue: Worldwide display: Azure Cloud name: azure_cloud required: false type: 15 options: - Worldwide - US GCC - US GCC-High - DoD - Germany - China additionalinfo: When selecting the Custom option, the Server URL parameter must be filled. More information about National clouds can be found here - https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#using-national-cloud section: Connect advanced: true - defaultvalue: https://graph.microsoft.com display: Server URL (e.g., https://graph.microsoft.com) name: host required: true type: 0 section: Connect additionalinfo: Use this option when required to customize the URL to the Microsoft Graph User endpoint. More information can be found here - https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#using-national-cloud - name: creds_auth_id type: 9 displaypassword: ID / client ID hiddenusername: true section: Connect required: false - name: creds_tenant_id type: 9 displaypassword: Token / Tenant ID hiddenusername: true section: Connect required: false - name: creds_enc_key type: 9 displaypassword: Key / Client Secret hiddenusername: true section: Connect required: false - display: ID (received from the admin consent - see Detailed Instructions (?) name: auth_id type: 4 hidden: true section: Connect required: false - display: Token (received from the admin consent - see Detailed Instructions (?) section) name: tenant_id type: 4 section: Connect hidden: true required: false - display: Key (received from the admin consent - see Detailed Instructions (?) name: enc_key type: 4 section: Connect hidden: true required: false - display: Certificate Thumbprint name: creds_certificate type: 9 displaypassword: Private Key section: Connect required: false - display: Certificate Thumbprint name: certificate_thumbprint type: 4 section: Connect advanced: true additionalinfo: Used for certificate authentication. As appears in the "Certificates & secrets" page of the app. hidden: true required: false - display: Private Key name: private_key type: 14 additionalinfo: Used for certificate authentication. The private key of the registered certificate. hidden: true section: Connect required: false - additionalinfo: Select this checkbox if you are using a self-deployed Azure application. display: Use a self-deployed Azure application name: self_deployed type: 8 section: Connect advanced: false required: false - display: Application redirect URI (for Self Deployed - Authorization Code Flow) name: redirect_uri type: 0 section: Connect required: false - name: creds_auth_code type: 9 section: Connect displaypassword: Authorization code (for Self Deployed - Authorization Code Flow) hiddenusername: true required: false - display: Authorization code (for Authorization Code flow mode - received from the authorization step. see Detailed Instructions (?) section) name: auth_code type: 4 hidden: true section: Connect required: false - additionalinfo: Relevant only if the integration is running on Azure VM. If selected, authenticates based on the value provided for the Azure Managed Identities Client ID field. If no value is provided for the Azure Managed Identities Client ID field, authenticates based on the System Assigned Managed Identity. For additional information, see the Help tab. display: Use Azure Managed Identities name: use_managed_identities type: 8 section: Connect required: false - additionalinfo: The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM. displaypassword: Azure Managed Identities Client ID name: managed_identities_client_id hiddenusername: true type: 9 section: Connect required: false - defaultvalue: 'false' display: Trust any certificate (not secure) name: insecure type: 8 section: Connect advanced: true required: false - defaultvalue: 'false' display: Use system proxy settings name: proxy type: 8 section: Connect advanced: true required: false - display: Allow secret generators commands execution name: allow_secret_generators defaultvalue: 'false' type: 8 section: Connect advanced: true required: false additionalinfo: Checking this box will allow running commands that generate and print secrets. Make sure to add restrictions to the related commands. For more information please refer to the following guide - - display: Suppress Errors for Non Found Users name: handle_error defaultvalue: 'true' type: 8 section: Collect advanced: true required: false description: The Entra ID Users integration (formerly Azure Active Directory Users) is a Unified gateway to security insights - all from a unified Microsoft Graph User API. display: Entra ID Users name: Microsoft Graph User script: commands: - arguments: - description: User ID or userPrincipalName. name: user required: true deprecated: true description: |- Deprecated. Use the msgraph-user-account-disable command instead. name: msgraph-user-terminate-session - arguments: - description: User ID or userPrincipalName. name: user prettyname: User prettypredefined: UPN: ${issue.original_alert_json.raw_abioc.event.auth_normalized_user.upn} required: true description: |- Disables a user from all Office 365 applications, and prevents sign in. Note: This command disables the user but does not terminate an existing session. Supported only in a self deployed app flow with the Permission: Directory.AccessAsUser.All(Delegated). name: msgraph-user-account-disable prettyname: Disable User Account [EntraID] quickaction: false quickaction:platform: true compliantpolicies: - User Hard Remediation - arguments: - description: User ID or userPrincipalName. name: user required: true description: Unblock a user. name: msgraph-user-unblock prettyname: Enable User Account [EntraID] quickaction: false quickaction:platform: true compliantpolicies: - User Soft Remediation - arguments: - description: User ID or userPrincipalName to update properties for. name: user required: true - description: "User fields to update (in a key=value format. Example: displayName=John." name: updated_fields required: true - description: "Delimiter to use for passing multiple fields to the 'updated_fields' argument. Example using ',' as a delimiter: displayName=John,givenName=John,surname=Doe." defaultValue: ',' name: updated_fields_delimiter description: |- Updates the properties of a user object. Permissions: - User.ReadWrite (Delegated & Application). name: msgraph-user-update outputs: - contextPath: MSGraphUser.ID description: User's ID. type: String - contextPath: MSGraphUser.DisplayName description: User's display name. type: String - contextPath: MSGraphUser.GivenName description: User's given name. type: String - contextPath: MSGraphUser.BusinessPhones description: User's business phone numbers. type: String - contextPath: MSGraphUser.JobTitle description: User's job title. type: String - contextPath: MSGraphUser.Mail description: User's mail address. type: String - contextPath: MSGraphUser.MobilePhone description: User's mobile phone number. type: String - contextPath: MSGraphUser.OfficeLocation description: User's office location. type: String - contextPath: MSGraphUser.PreferredLanguage description: User's preferred language. type: String - contextPath: MSGraphUser.Surname description: User's surname. type: String - contextPath: MSGraphUser.UserPrincipalName description: User's principal name. type: String - arguments: - description: User ID or userPrincipalName to delete. name: user required: true description: |- Deletes an existing user. Permissions: - Directory.AccessAsUser.All (Delegated) - User.ReadWrite.All (Application). execution: true name: msgraph-user-delete compliantpolicies: - User Hard Remediation - arguments: - auto: PREDEFINED defaultValue: 'true' description: true if the account is enabled; otherwise, false. name: account_enabled predefined: - 'true' - 'false' - description: The name to display in the address book. name: display_name required: true - description: Only needs to be specified when creating a new user account if you are using a federated domain for the user's userPrincipalName (UPN) property. name: on_premises_immutable_id - description: The mail alias for the user. name: mail_nickname required: true - description: The password profile for the user. name: password required: true - description: ' The user principal name, for example: foo@test.com. ' name: user_principal_name required: true - description: 'Optional properties for the user, for example: "displayName=name,mobilePhone=phone-num".' name: other_properties description: |- Creates a new user. Permissions: - User.ReadWrite.All (Delegated & Application). name: msgraph-user-create outputs: - contextPath: MSGraphUser.ID description: User's ID. type: String - contextPath: MSGraphUser.DisplayName description: User's display name. type: String - contextPath: MSGraphUser.GivenName description: User's given name. type: String - contextPath: MSGraphUser.BusinessPhones description: User's business phone numbers. type: String - contextPath: MSGraphUser.JobTitle description: User's job title. type: String - contextPath: MSGraphUser.Mail description: User's mail address. type: String - contextPath: MSGraphUser.MobilePhone description: User's mobile phone number. type: String - contextPath: MSGraphUser.OfficeLocation description: User's office location. type: String - contextPath: MSGraphUser.PreferredLanguage description: User's preferred language. type: String - contextPath: MSGraphUser.Surname description: User's surname. type: String - contextPath: MSGraphUser.UserPrincipalName description: User's principal name. type: String - contextPath: Account.ID description: User’s ID. type: String - contextPath: Account.DisplayName description: User’s display name. type: String - contextPath: Account.Username description: User’s principal name. type: String - contextPath: Account.JobTitle description: User’s job title. type: String - contextPath: Account.Email.Address description: User’s mail address. type: String - contextPath: Account.TelephoneNumber description: User’s mobile phone number. type: String - contextPath: Account.Office description: User’s office location. type: String - contextPath: Account.Type description: The account entity type. type: String - arguments: - description: 'A CSV list of properties by which to filter the results, for example: "displayName,jobTitle,mobilePhone".' name: properties deprecated: true description: |- Deprecated. This command only returns a single page. Use the msgraph-user-list command instead, which gets newly created, updated, or deleted users without performing a full read of the entire user collection. Permissions: - User.Read (Delegated) - User.Read.All (Application). name: msgraph-user-get-delta outputs: - contextPath: MSGraphUser.ID description: User's ID. type: String - contextPath: MSGraphUser.DisplayName description: User's display name. type: String - contextPath: MSGraphUser.GivenName description: User's given name. type: String - contextPath: MSGraphUser.BusinessPhones description: User's business phone numbers. type: String - contextPath: MSGraphUser.JobTitle description: User's job title. type: String - contextPath: MSGraphUser.Mail description: User's mail address. type: String - contextPath: MSGraphUser.MobilePhone description: User's mobile phone. type: String - contextPath: MSGraphUser.OfficeLocation description: User's office location. type: String - contextPath: MSGraphUser.PreferredLanguage description: User's preferred language. type: String - contextPath: MSGraphUser.Surname description: User's surname. type: String - contextPath: MSGraphUser.UserPrincipalName description: User's principal name. type: String - arguments: - description: User ID or userPrincipalName. name: user required: true - description: 'A CSV list of properties by which to filter the results, for example: "displayName,jobTitle,mobilePhone". For the list of possible properties and the relevant permissions, if needed, visit: https://learn.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0#properties' name: properties description: |- Retrieves the properties and relationships of a user object. For more information, visit: https://learn.microsoft.com/en-us/graph/api/user-get?view=graph-rest-1.0&tabs=http. Permissions: - User.Read (Delegated) - User.Read.All (Application). name: msgraph-user-get outputs: - contextPath: MSGraphUser.ID description: User's ID. type: String - contextPath: MSGraphUser.DisplayName description: User's display name. type: String - contextPath: MSGraphUser.GivenName description: User's given name. type: String - contextPath: MSGraphUser.BusinessPhones description: User's business phone numbers. type: String - contextPath: MSGraphUser.JobTitle description: User's job title. type: String - contextPath: MSGraphUser.Mail description: User's mail address. type: String - contextPath: MSGraphUser.MobilePhone description: User's mobile phone number. type: String - contextPath: MSGraphUser.OfficeLocation description: User's office location. type: String - contextPath: MSGraphUser.PreferredLanguage description: User's preferred language. type: String - contextPath: MSGraphUser.Surname description: User's surname. type: String - contextPath: MSGraphUser.UserPrincipalName description: User's principal name. type: String - contextPath: Account.ID description: User’s ID. type: String - contextPath: Account.DisplayName description: User’s display name. type: String - contextPath: Account.Username description: User’s principal name. type: String - contextPath: Account.JobTitle description: User’s job title. type: String - contextPath: Account.Email.Address description: User’s mail address. type: String - contextPath: Account.TelephoneNumber description: User’s mobile phone number. type: String - contextPath: Account.Office description: User’s office location. type: String - contextPath: Account.Type description: The account entity type. type: String - arguments: - description: User ID or userPrincipalName. name: user required: true description: |- Retrieves the groups a user is part of. name: msgraph-user-get-groups outputs: - contextPath: MSGraphUserGroups.ID description: The user ID. type: String - contextPath: MSGraphUserGroups.Groups.Classification description: Value used to classify data types in your groups. type: String - contextPath: MSGraphUserGroups.Groups.@Odata.Type description: A string value that can be used to classify the user's groups. type: String - contextPath: MSGraphUserGroups.Groups.CreatedDateTime description: Group creation date and time. type: String - contextPath: MSGraphUserGroups.Groups.CreationOptions description: Group creation options. type: String - contextPath: MSGraphUserGroups.Groups.DeletedDateTime description: Group deletion date and time. type: String - contextPath: MSGraphUserGroups.Groups.Description description: Group description string. type: String - contextPath: MSGraphUserGroups.Groups.DisplayName description: Group display name. type: String - contextPath: MSGraphUserGroups.Groups.ExpirationDateTime description: Group expiration date and time. type: String - contextPath: MSGraphUserGroups.Groups.GroupTypes description: The types assigned to the group. type: String - contextPath: MSGraphUserGroups.Groups.ID description: Group id. type: String - contextPath: MSGraphUserGroups.Groups.IsAssignableToRole description: Indicates whether the group can be assigned to roles. type: Bool - contextPath: MSGraphUserGroups.Groups.Mail description: Group associated mail. type: String - contextPath: MSGraphUserGroups.Groups.MailEnabled description: Indicates whether the group has mail enabled. type: Bool - contextPath: MSGraphUserGroups.Groups.MailNickname description: Mail nickname of the group. type: String - contextPath: MSGraphUserGroups.Groups.MembershipRule description: Membership rule applied to the group. type: String - contextPath: MSGraphUserGroups.Groups.MembershipRuleProcessingState description: Processing state of the group’s membership rule. type: String - contextPath: MSGraphUserGroups.Groups.OnPremisesDomainName description: On-premises domain name associated with the group. type: String - contextPath: MSGraphUserGroups.Groups.OnPremisesLastSyncDateTime description: Date and time when the group was last synchronized from on-premises. type: String - contextPath: MSGraphUserGroups.Groups.OnPremisesNetBiosName description: On-premises NetBIOS name of the group. type: String - contextPath: MSGraphUserGroups.Groups.OnPremisesProvisioningErrors description: Errors encountered during on-premises provisioning of the group. type: String - contextPath: MSGraphUserGroups.Groups.OnPremisesSamAccountName description: SAM account name of the group in on-premises Active Directory. type: String - contextPath: MSGraphUserGroups.Groups.OnPremisesSecurityIdentifier description: Security identifier (SID) of the group in on-premises Active Directory. type: String - contextPath: MSGraphUserGroups.Groups.OnPremisesSyncEnabled description: Indicates whether the group is synchronized from on-premises. type: String - contextPath: MSGraphUserGroups.Groups.PreferredDataLocation description: Preferred geographic location for the group’s data. type: String - contextPath: MSGraphUserGroups.Groups.PreferredLanguage description: Preferred language for the group. type: String - contextPath: MSGraphUserGroups.Groups.ProxyAddresses description: Email addresses associated with the group. type: String - contextPath: MSGraphUserGroups.Groups.RenewedDateTime description: Date and time the group was last renewed. type: String - contextPath: MSGraphUserGroups.Groups.ResourceBehaviorOptions description: Options defining the group’s behavior as a resource. type: String - contextPath: MSGraphUserGroups.Groups.ResourceProvisioningOptions description: Options used for provisioning the group as a resource. type: String - contextPath: MSGraphUserGroups.Groups.SecurityEnabled description: Indicates whether the group is security-enabled. type: Bool - contextPath: MSGraphUserGroups.Groups.SecurityIdentifier description: Security identifier of the group. type: String - contextPath: MSGraphUserGroups.Groups.ServiceProvisioningErrors description: Errors encountered during service provisioning of the group. type: String - contextPath: MSGraphUserGroups.Groups.Theme description: Theme associated with the group. type: String - contextPath: MSGraphUserGroups.Groups.UniqueName description: Unique name of the group. type: String - contextPath: MSGraphUserGroups.Groups.Visibility description: Groups visibility. type: String - contextPath: MSGraphUserGroups.Groups.WellKnownObject description: Indicates if the group is a well-known system object. type: String - arguments: - description: User ID or userPrincipalName. name: user required: true description: |- Retrieve a list of authentication methods registered to a user. name: msgraph-user-get-auth-methods outputs: - contextPath: MSGraphUserAuthMethods.ID description: The user ID. type: String - contextPath: MSGraphUserAuthMethods.Methods.CreatedDateTime description: Authentication method's creation date and time. type: String - contextPath: MSGraphUserAuthMethods.Methods.ID description: The unique identifier for the authentication method. type: String - contextPath: MSGraphUserAuthMethods.Methods.@Odata.Type description: The type of the authentication method. type: String - contextPath: MSGraphUserAuthMethods.Methods.Password description: The password associated with the authentication method, if applicable. type: String - contextPath: MSGraphUserAuthMethods.Methods.DisplayName description: Authentication methods displayName. type: String - contextPath: MSGraphUserAuthMethods.Methods.DeviceTag description: The device tag associated with the authentication method. type: String - contextPath: MSGraphUserAuthMethods.Methods.IsUsable description: Indicates whether the authentication method is currently usable. type: String - contextPath: MSGraphUserAuthMethods.Methods.IsUsableOnce description: Indicates whether the authentication method can be used only once. type: String - contextPath: MSGraphUserAuthMethods.Methods.MethodUsabilityReason description: The reason why the authentication method is or is not usable. type: String - arguments: - description: 'A CSV list of properties by which to filter the results, for example: "displayName,jobTitle,mobilePhone".' name: properties - description: The URL for the next page in the list. name: next_page - description: 'Filter to be plugged directly into the API. For more information about the Filter syntax, see the Microsoft documentation: https://learn.microsoft.com/en-us/graph/filter-query-parameter?tabs=http.' name: filter description: |- Retrieves a list of user objects. Permissions: - User.ReadBasic.All (Delegated) - User.Read.All (Application). name: msgraph-user-list outputs: - contextPath: MSGraphUser.ID description: User's ID. type: String - contextPath: MSGraphUser.DisplayName description: User's display name. type: String - contextPath: MSGraphUser.GivenName description: User's given name. type: String - contextPath: MSGraphUser.BusinessPhones description: User's business phone numbers. type: String - contextPath: MSGraphUser.JobTitle description: User's job title. type: String - contextPath: MSGraphUser.Mail description: User's mail address. type: String - contextPath: MSGraphUser.MobilePhone description: User's mobile phone number. type: String - contextPath: MSGraphUser.OfficeLocation description: User's office location. type: String - contextPath: MSGraphUser.PreferredLanguage description: User's preferred language. type: String - contextPath: MSGraphUser.Surname description: User's surname. type: String - contextPath: MSGraphUser.UserPrincipalName description: User's principal name. type: String - contextPath: MSGraphUser.NextPage description: A token to pass to the next list command to retrieve additional results. type: String - contextPath: Account.ID description: User’s ID. type: String - contextPath: Account.DisplayName description: User’s display name. type: String - contextPath: Account.Username description: User’s principal name. type: String - contextPath: Account.JobTitle description: User’s job title. type: String - contextPath: Account.Email.Address description: User’s mail address. type: String - contextPath: Account.TelephoneNumber description: User’s mobile phone number. type: String - contextPath: Account.Office description: User’s office location. type: String - contextPath: Account.Type description: The account entity type. type: String - arguments: - description: The User ID or userPrincipalName of the user for which to retrieve direct reports. name: user required: true description: Retrieves the direct reports for a user. Direct reports are the people who have that user configured as their manager. name: msgraph-direct-reports outputs: - contextPath: MSGraphUserDirectReports.Manager description: The manager's user principal name (UPN). type: String - contextPath: MSGraphUserDirectReports.Reports.@Odata.Type description: A string value that can be used to classify user types in your directory, such as "Member" and "Guest". type: String - contextPath: MSGraphUserDirectReports.Reports.DisplayName description: The name displayed in the address book for the user. This is usually the combination of the user's first name, middle initial and last name. type: String - contextPath: MSGraphUserDirectReports.Reports.GivenName description: The given name (first name) of the user. type: String - contextPath: MSGraphUserDirectReports.Reports.ID description: The user ID in Microsoft Graph User. type: String - contextPath: MSGraphUserDirectReports.Reports.JobTitle description: The user's job title. type: String - contextPath: MSGraphUserDirectReports.Reports.Mail description: The email address of the user. type: String - contextPath: MSGraphUserDirectReports.Reports.MobilePhone description: The primary cellular telephone number for the user. type: String - contextPath: MSGraphUserDirectReports.Reports.OfficeLocation description: The office location in the user's place of business. type: String - contextPath: MSGraphUserDirectReports.Reports.PreferredLanguage description: 'The preferred language for the user. Should follow ISO 639-1 Code; for example: en-US.' type: String - contextPath: MSGraphUserDirectReports.Reports.Surname description: The user's surname (family name or last name). type: String - contextPath: MSGraphUserDirectReports.Reports.UserPrincipalName description: The user principal name (UPN) of the user. The UPN is an Internet-style login name for the user based on the Internet standard RFC 822. By convention, this should map to the user's email name. The general format is alias@domain, where domain must be present in the tenant’s collection of verified domains. This property is required when a user is created. The verified domains for the tenant can be accessed from the verifiedDomains property of organization. type: String - arguments: - description: The User ID or userPrincipalName of the user for which to get the manager properties. name: user required: true description: "Retrieves the properties from the manager of a user." name: msgraph-user-get-manager outputs: - contextPath: MSGraphUserManager.ID description: User's user ID. type: String - contextPath: MSGraphUserManager.Manager.ID description: Manager's user ID. type: String - contextPath: MSGraphUserManager.Manager.DisplayName description: User's display name. type: String - contextPath: MSGraphUserManager.Manager.GivenName description: User's given name. type: String - contextPath: MSGraphUserManager.Manager.BusinessPhones description: User's business phone numbers. type: String - contextPath: MSGraphUserManager.Manager.JobTitle description: User's job title. type: String - contextPath: MSGraphUserManager.Manager.Mail description: User's mail address. type: String - contextPath: MSGraphUserManager.Manager.MobilePhone description: User's mobile phone number. type: String - contextPath: MSGraphUserManager.Manager.OfficeLocation description: User's office location. type: String - contextPath: MSGraphUserManager.Manager.PreferredLanguage description: User's preferred language. type: String - contextPath: MSGraphUserManager.Manager.Surname description: User's surname. type: String - contextPath: MSGraphUserManager.Manager.UserPrincipalName description: User's principal name. type: String - arguments: - description: User ID or userPrincipalName of the user to which to assign a manager. name: user required: true - description: User ID or userPrincipalName of the manager. name: manager required: true description: |- Assigns a manager to the specified user. Permission: - User.ReadWrite (Delegated) or - User.ReadWrite (Application). name: msgraph-user-assign-manager - arguments: - description: User ID or userPrincipalName to update password for. name: user required: true - description: The new password. name: password required: true secret: true - auto: PREDEFINED defaultValue: 'true' description: Whether the password will be changed on the next sign in. name: force_change_password_next_sign_in predefined: - 'true' - 'false' - auto: PREDEFINED defaultValue: 'false' description: Whether to change the password with MFA. name: force_change_password_with_mfa predefined: - 'true' - 'false' description: |- Changes the user password. Supported only in a self deployed app flow with the Permission: Directory.AccessAsUser.All(Delegated). execution: true name: msgraph-user-change-password compliantpolicies: - User Soft Remediation - name: msgraph-user-change-password-on-premise description: |- Changes the password of an on-premise user. See documentation for full permissions and roles to execute this command. Providing a password is required (password auto-generation is not supported). polling: true arguments: - description: User ID or userPrincipalName to update password for. name: user required: true secret: false - description: The new password. name: password required: false secret: true - description: "The new password. This argument can be used in playbooks. Note: the value will NOT be hidden in logs." name: nonsensitive_password required: false secret: false - description: User ID or userPrincipalName to update password for. name: password_method_id hidden: true - description: Polling url. name: polling_url hidden: true outputs: - contextPath: MSGraphUser.user description: The user's ID. type: String - contextPath: MSGraphUser.status description: The status of the operation. type: String - contextPath: MSGraphUser.polling_url description: The polling url. type: String - description: Tests connectivity to Microsoft Graph User. name: msgraph-user-test - arguments: - description: User ID or userPrincipalName. name: user prettyname: User prettypredefined: UPN: ${issue.original_alert_json.raw_abioc.event.auth_normalized_user.upn} required: true description: |- Revoke a user session by invalidating all refresh tokens issued to applications for a user. This command requires an administrator role. Permission required: Directory.AccessAsUser.All (Delegated). name: msgraph-user-session-revoke prettyname: Terminate Existing Sessions [EntraID] quickaction: false quickaction:platform: true compliantpolicies: - User Soft Remediation - arguments: - description: User ID or userPrincipalName. name: user prettyname: User prettypredefined: UPN: ${issue.original_alert_json.raw_abioc.event.auth_normalized_user.upn} required: true description: |- Forces a user to reset their password the next time they log in. Note that this action does not terminate the user’s current session. If you also want to force the user to sign in again, use the msgraph-user-session-revoke command. This operation is supported only when using a self-deployed app flow with the Directory.AccessAsUser.All and User-PasswordProfile.ReadWrite.All delegated permissions. For further info, see https://learn.microsoft.com/en-us/graph/api/user-update?view=graph-rest-1.0&tabs=http#example-3-update-the-passwordprofile-of-a-user-and-reset-their-password Furthermore, the signed in user must have a higher privileged administrator role than the user who's password is being reset. The admin hierarchy table can be viewed here: https://learn.microsoft.com/en-us/graph/api/resources/users?view=graph-rest-1.0#who-can-reset-passwords name: msgraph-user-force-reset-password prettyname: Force Reset Password [EntraID] quickaction: false quickaction:platform: true compliantpolicies: - User Soft Remediation - arguments: - description: The Azure AD user ID. name: user_id required: true description: |- Lists all TAP policies for a user. This command will only return a single object in the collection as a user can have only one Temporary Access Pass (TAP) method. Permission:UserAuthenticationMethod.Read.All name: msgraph-user-tap-policy-list outputs: - contextPath: MSGraphUser.TAPPolicy.ID description: TAP policy's ID. type: String - contextPath: MSGraphUser.TAPPolicy.IsUsable description: TAP policy's usability. type: Bool - contextPath: MSGraphUser.TAPPolicy.IsUsableOnce description: TAP policy's once - usability. type: Bool - contextPath: MSGraphUser.TAPPolicy.CreatedDateTime description: TAP policy's creation date and time. type: String - contextPath: MSGraphUser.TAPPolicy.MethodUsabilityReason description: TAP policy's method usability reason. type: String - contextPath: MSGraphUser.TAPPolicy.LifetimeInMinutes description: TAP policy's lifetime in minutes. type: Int - contextPath: MSGraphUser.TAPPolicy.StartDateTime description: TAP policy's start date and time. type: String - arguments: - description: The Azure AD user ID. name: user_id required: true - description: A password for the password-protected zip file that will include the password of the new TAP. name: zip_password required: true secret: true - description: The duration of the TAP. Must be between 10 and 43200 (equivalent to 30 days). name: lifetime_in_minutes required: false defaultValue: 60 - description: |- Determines if the pass is limited to a one-time use. If true, the pass can be used once; if false, the TAP can be used multiple times within its 'lifetime_in_minutes' setting. A multi-use Temporary Access Pass (isUsableOnce = false) can only be created and used for sign-in if it is allowed by the Temporary Access Pass authentication method policy. name: is_usable_once required: false defaultValue: false auto: PREDEFINED predefined: - 'true' - 'false' - description: |- The start time for the TAP (has to be a time in the future). Can be specified in ISO 8601 format - "YYYY-MM-DDThh:mm:ssZ", for example: "2025-03-26T00:00:00.000Z" or in a future relative time format, for example: "now", "in 2 days". name: start_time required: false defaultValue: now description: |- Create a new TAP policy for a user. During the command execution, a password-protected zip file will be generated, including the new TAP password. You can download the file, use your password to unlock it, and get the TAP password. A user can only have one Temporary Access Pass that's usable within its specified lifetime. Permission:UserAuthenticationMethod.ReadWrite.All name: msgraph-user-tap-policy-create outputs: - contextPath: MSGraphUser.TAPPolicy.ID description: TAP policy's ID. type: String - contextPath: MSGraphUser.TAPPolicy.IsUsable description: TAP policy's usability. type: Bool - contextPath: MSGraphUser.TAPPolicy.IsUsableOnce description: TAP policy's once - usability. type: Bool - contextPath: MSGraphUser.TAPPolicy.CreatedDateTime description: TAP policy's creation date and time. type: String - contextPath: MSGraphUser.TAPPolicy.MethodUsabilityReason description: TAP policy's method usability reason. type: String - contextPath: MSGraphUser.TAPPolicy.LifetimeInMinutes description: TAP policy's lifetime in minutes. type: Int - contextPath: MSGraphUser.TAPPolicy.StartDateTime description: TAP policy's start date and time. type: String - arguments: - description: The Azure AD user ID. name: user_id required: true - description: Policy ID. name: policy_id required: true description: Deletes a specific TAP policy. Permission:UserAuthenticationMethod.ReadWrite.All name: msgraph-user-tap-policy-delete - description: Generate the login url used for Authorization code flow. name: msgraph-user-generate-login-url arguments: [] - description: Run this command if for some reason you need to rerun the authentication process. name: msgraph-user-auth-reset arguments: [] - arguments: - description: The Azure AD user ID. name: user required: true - description: Number of devices in the list. Maximum is 50. name: limit required: false defaultValue: 50 - description: The URL for the next page in the list. name: next_page - description: 'Filter to be plugged directly into the API. For more information about the Filter syntax, see the Microsoft documentation: https://learn.microsoft.com/en-us/graph/filter-query-parameter?tabs=http.' name: filter description: |- Lists the devices that are owned by the user. Permission: User.Read.All,Directory.Read.All - Delegated name: msgraph-user-owned-devices-list outputs: - contextPath: MSGraphUser.ID description: User's ID. type: String - contextPath: MSGraphUser.OwnedDevice.ID description: Owned device's ID. type: String - contextPath: MSGraphUser.OwnedDevice.PhysicalIds description: Physical IDs of the device. type: String - contextPath: MSGraphUser.OwnedDevice.DeviceVersion description: The version of the device. type: String - contextPath: MSGraphUser.OwnedDevice.ProfileType description: The profile type of the device. type: String - contextPath: MSGraphUser.OwnedDevice.CreatedDateTime description: The date and time the device was created. type: String - contextPath: MSGraphUser.OwnedDevice.ApproximateLastSignInDateTime description: The approximate date and time of the last sign-in. type: String - contextPath: MSGraphUser.OwnedDevice.OperatingSystemVersion description: The version of the operating system. type: String - contextPath: MSGraphUser.OwnedDevice.AlternativeSecurityIds description: Alternative security IDs of the device. type: String - contextPath: MSGraphUser.OwnedDevice.DisplayName description: The display name of the device. type: String - contextPath: MSGraphUser.OwnedDevice.OperatingSystem description: The operating system of the device. type: String - contextPath: MSGraphUser.OwnedDevice.DeviceId description: The unique identifier for the device. type: String - contextPath: MSGraphUser.OwnedDevice.TrustType description: The trust type of the device. type: String - contextPath: MSGraphUser.OwnedDevice.RegistrationDateTime description: The date and time when the device was registered. type: String - arguments: - description: User ID or userPrincipalName. name: user required: true - description: The ID of a specific FIDO2 authentication method to retrieve. name: method_id required: false description: |- Lists the FIDO2 authentication methods registered to a user or retrieves a specific method by ID. Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All name: msgraph-user-fido2-method-list outputs: - contextPath: MSGraphUser.FIDO2Method.ID description: The unique identifier of the FIDO2 authentication method. type: String - contextPath: MSGraphUser.FIDO2Method.DisplayName description: The display name of the key as given by the user. type: String - contextPath: MSGraphUser.FIDO2Method.CreatedDateTime description: The timestamp when this key was registered. type: String - contextPath: MSGraphUser.FIDO2Method.AaGuid description: Authenticator Attestation GUID, an identifier that indicates the type of authenticator. type: String - contextPath: MSGraphUser.FIDO2Method.Model description: The manufacturer-assigned model of the FIDO2 security key. type: String - contextPath: MSGraphUser.FIDO2Method.AttestationCertificates description: The attestation certificate(s) attached to this security key. type: String - contextPath: MSGraphUser.FIDO2Method.AttestationLevel description: The attestation level of this FIDO2 security key. type: String - arguments: - description: User ID or userPrincipalName. name: user required: true - description: The ID of the FIDO2 authentication method to delete. name: method_id required: true description: |- Deletes a FIDO2 authentication method from a user. Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application name: msgraph-user-fido2-method-delete - arguments: - description: User ID or userPrincipalName. name: user required: true - description: The ID of a specific email authentication method to retrieve. name: method_id required: false description: |- Lists the email authentication methods registered to a user, or retrieves a specific email method by ID. Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application name: msgraph-user-email-method-list outputs: - contextPath: MSGraphUser.EmailAuthMethod.ID description: The unique identifier of the email authentication method. type: String - contextPath: MSGraphUser.EmailAuthMethod.EmailAddress description: The email address registered to this user. type: String - arguments: - description: User ID or userPrincipalName. name: user required: true - description: The ID of the email authentication method to delete. name: method_id required: false defaultValue: 3ddfcfc8-9383-446f-83cc-3ab9be4be18f description: |- Deletes an email authentication method from a user. Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application name: msgraph-user-email-method-delete - arguments: - description: User ID or userPrincipalName. name: user required: true - description: The ID of a specific Microsoft Authenticator authentication method to retrieve. name: method_id required: false - description: Maximum number of results to return when listing all methods. name: limit required: false defaultValue: 50 - description: The URL for the next page in the list. name: next_page required: false description: |- Lists the Microsoft Authenticator authentication methods registered to a user, or retrieves a specific method by ID. Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application name: msgraph-user-authenticator-method-list outputs: - contextPath: MSGraphUser.UserAuthMethod.ID description: The unique identifier of the Microsoft Authenticator authentication method. type: String - contextPath: MSGraphUser.UserAuthMethod.DisplayName description: The name of the device on which Microsoft Authenticator is registered. type: String - contextPath: MSGraphUser.UserAuthMethod.PhoneAppVersion description: The version of Microsoft Authenticator installed on the device. type: String - contextPath: MSGraphUser.UserAuthMethod.DeviceTag description: Tags containing app metadata. type: String - contextPath: MSGraphUser.UserAuthMethod.CreatedDateTime description: The timestamp when this method was registered to the user. type: String - contextPath: MSGraphUser.UserAuthMethod.NextPage description: A token to pass to the next list command to retrieve additional results. type: String - arguments: - description: User ID or userPrincipalName. name: user required: true - description: The ID of the Microsoft Authenticator authentication method to delete. name: method_id required: true description: |- Deletes a Microsoft Authenticator authentication method from a user. Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application name: msgraph-user-authenticator-method-delete - arguments: - description: User ID or userPrincipalName. name: user required: true - description: The ID of a specific phone authentication method to retrieve. name: method_id required: false - description: The URL for the next page in the list. name: next_page required: false description: |- Lists the phone authentication methods registered to a user, or retrieves a specific phone method by ID. Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application name: msgraph-user-phone-method-list outputs: - contextPath: MSGraphUser.PhoneAuthMethod.ID description: The unique identifier of the phone authentication method. type: String - contextPath: MSGraphUser.PhoneAuthMethod.PhoneNumber description: The phone number registered to this user. type: String - contextPath: MSGraphUser.PhoneAuthMethod.PhoneType description: The type of phone (mobile, alternateMobile, or office). type: String - contextPath: MSGraphUser.PhoneAuthMethod.SmsSignInState description: Whether the phone is ready to be used for SMS sign-in. type: String - contextPath: MSGraphUser.PhoneAuthMethod.NextPage description: A token to pass to the next list command to retrieve additional results. type: String - arguments: - description: User ID or userPrincipalName. name: user required: true - description: The ID of the phone authentication method to delete. name: method_id required: true description: |- Deletes a phone authentication method from a user. Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application name: msgraph-user-phone-method-delete - arguments: - description: User ID or userPrincipalName. name: user required: true - description: The ID of a specific software OATH authentication method to retrieve. name: method_id required: false description: |- Lists the software OATH authentication methods registered to a user, or retrieves a specific method by ID. Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application name: msgraph-user-software-oath-method-list outputs: - contextPath: MSGraphUser.SoftOathAuthMethod.ID description: The unique identifier of the software OATH authentication method. type: String - arguments: - description: User ID or userPrincipalName. name: user required: true - description: The ID of the software OATH authentication method to delete. name: method_id required: true description: |- Deletes a software OATH authentication method from a user. Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application name: msgraph-user-software-oath-method-delete - arguments: - description: User ID or userPrincipalName. name: user required: true - description: The ID of a specific Windows Hello for Business authentication method to retrieve. name: method_id required: false description: |- Lists the Windows Hello for Business authentication methods registered to a user, or retrieves a specific method by ID. Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application name: msgraph-user-windows-hello-method-list outputs: - contextPath: MSGraphUser.WindowsHelloAuthMethod.ID description: The unique identifier of the Windows Hello for Business authentication method. type: String - contextPath: MSGraphUser.WindowsHelloAuthMethod.DisplayName description: The name of the device on which Windows Hello is registered. type: String - contextPath: MSGraphUser.WindowsHelloAuthMethod.KeyStrength description: The key strength of the Windows Hello for Business key (normal or weak). type: String - contextPath: MSGraphUser.WindowsHelloAuthMethod.CreatedDateTime description: The timestamp when this method was registered to the user. type: String - arguments: - description: User ID or userPrincipalName. name: user required: true - description: The ID of the Windows Hello for Business authentication method to delete. name: method_id required: true description: |- Deletes a Windows Hello for Business authentication method from a user. Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application name: msgraph-user-windows-hello-method-delete - arguments: - description: User ID or userPrincipalName. name: user required: true - description: The ID of a specific Temporary Access Pass authentication method to retrieve. name: method_id required: false description: |- Lists the Temporary Access Pass authentication methods registered to a user, or retrieves a specific method by ID. Permission: UserAuthenticationMethod.Read.All or UserAuthenticationMethod.ReadWrite.All - Delegated or Application name: msgraph-user-temp-access-pass-method-list outputs: - contextPath: MSGraphUser.TempAccessPassAuthMethod.ID description: The unique identifier of the Temporary Access Pass authentication method. type: String - contextPath: MSGraphUser.TempAccessPassAuthMethod.IsUsable description: Indicates whether the authentication method is currently usable. type: Bool - arguments: - description: User ID or userPrincipalName. name: user required: true - description: The ID of the Temporary Access Pass authentication method to delete. name: method_id required: true description: |- Deletes a Temporary Access Pass authentication method from a user. Permission: UserAuthenticationMethod.ReadWrite.All - Delegated or Application name: msgraph-user-temp-access-pass-method-delete - arguments: - description: The user mail to send the MFA request to. name: user_mail required: true - description: The timeout for the MFA request. name: timeout required: false defaultValue: 60 - description: The MFA access token obtained from msgraph-user-create-mfa-client-access-token command. name: access_token required: true secret: true description: Pops a synchronous MFA request for the given user. This is a blocking call that waits for user response or timeout. name: msgraph-user-request-mfa hidden: true - arguments: - description: User ID or userPrincipalName. name: user required: true description: Retrieves the authentication preferences for a user, including the default method. name: msgraph-user-get-user-default-auth-method hidden: true outputs: - contextPath: MSGraphUser.AuthMethod.User description: The user principal name. type: String - contextPath: MSGraphUser.AuthMethod.DefaultMethod description: The default authentication method for the user. type: String - contextPath: MSGraphUser.AuthMethod.IsSystemPreferredAuthenticationMethodEnabled description: Whether system-preferred authentication is enabled. type: Boolean - contextPath: MSGraphUser.AuthMethod.UserPreferredMethodForSecondaryAuthentication description: The user's preferred method for secondary authentication. type: String - contextPath: MSGraphUser.AuthMethod.SystemPreferredAuthenticationMethod description: The system-preferred authentication method. type: String - name: msgraph-user-create-mfa-client-secret hidden: true description: Issue a new client secret for the MFA app. outputs: - contextPath: MSGraphUser.MFAClientSecret.ValidUntil description: The expiration date for the client secret in ISO 8601 format. type: String - contextPath: MSGraphUser.MFAClientSecret.MFAClientSecret description: The new MFA client secret. type: String - contextPath: MSGraphUser.MFAClientSecret.ValidFrom description: The date of issue for the client secret. type: String - name: msgraph-user-create-mfa-client-access-token hidden: true description: Issue a new access token for the MFA app. arguments: - description: The MFA app client secret obtained from msgraph-user-create-mfa-client-secret command. name: client_secret required: true secret: true outputs: - contextPath: MSGraphUser.MFAAccessToken.ValidUntil description: The expiration date for the access token in epoch format. type: String - contextPath: MSGraphUser.MFAAccessToken.AccessToken description: The access token value. type: String dockerimage: demisto/crypto:1.0.0.11658507 runonce: false script: '-' subtype: python3 type: python tests: - Microsoft Graph User - Test fromversion: 5.0.0 supportsquickactions: true