# Microsoft 365 Admin [Health: Active] **Category:** 🏒 Workplace & Productivity **Repository:** https://github.com/okapi-ca/ms-365-admin-mcp-server **GitHub Stars:** 18 **npm Downloads (last month):** 248 **Views:** 0 **Installs:** 0 **Upvotes:** 0 **Directory Page:** https://allmcps.com/mcp/microsoft-365-admin ## Description Microsoft 365 administration via Graph API application permissions (read-only by default). ## Tools Capabilities this server exposes over MCP: - **list-exchange-mailboxes** β€” Represents a user's mailboxes. TIP: Lists Exchange mailboxes in the tenant via admin API. Each mailbox has displayName, primarySmtpAddress, recipientType (UserMailbox, SharedMailbox, RoomMailbox, EquipmentMailbox), and identity. Useful for auditing mailbox types and finding shared/resource mailboxes. - **get-exchange-mailbox** β€” Represents a user's mailboxes. TIP: Gets a specific Exchange mailbox. Returns full details including displayName, primarySmtpAddress, recipientType, and mailbox configuration. - **list-exchange-mailbox-folders** β€” Get all the mailboxFolder objects in the specified mailbox, including any search folders. TIP: Lists mailbox folders for an Exchange mailbox (admin). Returns id, displayName, totalItemCount, unreadItemCount, childFolderCount, parentFolderId. - **get-exchange-mailbox-folder** β€” Read the properties and relationships of a mailboxFolder object. TIP: Gets a specific mailbox folder by ID (admin). Returns displayName, totalItemCount, unreadItemCount, childFolderCount. - **list-message-traces** β€” Get a list of exchangeMessageTrace objects. TIP: Lists Exchange message traces for auditing mail flow. Each trace has senderAddress, recipientAddress, subject, messageId, receivedDateTime, status (Delivered, Failed, Quarantined, FilteredAsSpam, Expanded, etc.), and size. Use $filter=receivedDateTime ge 2024-01-01T00:00:00Z to filter by date. Use $filter=senderAddress eq 'user@domain.com' to filter by sender. RISK LEVEL: MEDIUM. This response contains PII or authentication metadata (sign-ins, MFA factors, mail metadata, risk detections). Handle with care and avoid casual disclosure. - **get-message-trace** β€” Represents the trace information of messages that pass through Exchange Online organizations. TIP: Gets a specific message trace by ID. Returns full details including senderAddress, recipientAddress, subject, messageId, receivedDateTime, status, size, and additional routing information. RISK LEVEL: MEDIUM. This response contains PII or authentication metadata (sign-ins, MFA factors, mail metadata, risk detections). Handle with care and avoid casual disclosure. - **list-service-health** β€” Retrieve the serviceHealth resources from the healthOverviews navigation property. This operation provides the health report of all subscribed services for a tenant. TIP: Lists health status for all Microsoft 365 services. Each entry has service name (Exchange Online, Microsoft Teams, etc.) and status (serviceDegradation, serviceOperational, etc.). Use $select=service,status to get a quick overview. - **list-service-issues** β€” Retrieve serviceHealthIssue resources from the issues navigation property. This operation retrieves information about all service health issues that exist for the tenant. TIP: Lists active and recent service health issues. Use $filter=isResolved eq false to see only active issues. Each issue has title, service, status (investigating, serviceRestored, etc.), classification (advisory, incident), startDateTime, and posts with updates. - **list-service-messages** β€” Retrieve the serviceUpdateMessage resources from the messages navigation property. This operation retrieves all service update messages that exist for the tenant. TIP: Lists Message Center posts about planned changes, new features, and actions required. Use $filter=services/any(s:s eq 'Exchange Online') to filter by service. Use $filter=category eq 'planForChange' to filter by category (planForChange, stayInformed, preventOrFixIssue). Each message has title, body, services, tags, startDateTime, endDateTime, and actionRequiredByDateTime. - **get-sharepoint-settings** β€” Get the tenant-level settings for SharePoint and OneDrive. TIP: Gets SharePoint tenant-level settings. Returns allowedDomainGuidsForSyncApp, availableManagedPathsForSiteCreation, deletedUserPersonalSiteRetentionPeriodInDays, excludedFileExtensionsForSyncApp, idleSessionSignOut, imageTaggingOption, isCommentingOnSitePagesEnabled, isFileActivityNotificationEnabled, isLoopEnabled, isMacSyncAppEnabled, isResharingByExternalUsersEnabled, isSharePointMobileNotificationEnabled, isSharePointNewsfeedEnabled, isSiteCreationEnabled, isSiteCreationUIEnabled, isSitePagesCreationEnabled, isSitesStorageLimitAutomatic, knowledgeIntelligenceEnabled, personalSiteDefaultStorageLimitInMB, sharingAllowedDomainList, sharingBlockedDomainList, sharingCapability, sharingDomainRestrictionMode, siteCreationDefaultManagedPath, siteCreationDefaultStorageLimitInMB, tenantDefaultTimezone. - **get-teams-admin-settings** β€” A container for Teams administration functionalities, such as Teams telephone number management functionalities, user Teams configurations, and policy assignments. TIP: Gets Teams admin settings for the tenant. - **get-teams-admin-policy** β€” Represents a navigation property to the Teams policy assignment object. TIP: Gets Teams admin policy settings. - **list-teams-policy-assignments** β€” The collection of user policy assignments. TIP: Lists Teams policy user assignments. - **list-teams-phone-assignments** β€” Read the properties and relationships of microsoft.graph.teamsAdministration.numberAssignment object. TIP: Lists telephone number assignments for Teams. Shows which phone numbers are assigned to which users or resources. Look up one number with $filter=telephoneNumber eq '+15145551234'; every field except id and city is filterable (e.g. assignmentStatus eq 'unassigned', numberType eq 'directRouting'). Default page is 500, max $top is 1000. - **get-teams-phone-number-operation** β€” Read the properties and relationships of microsoft.graph.teamsAdministration.telephoneNumberLongRunningOperation object. This method is used to query the status of an assign or unassign number action using Graph API. This link is returned in the Location response header found in assign or unassign operation result. TIP: Gets the status of an asynchronous assign-teams-phone-number or unassign-teams-phone-number order. The id is the value inside operations('') in the location URL those tools return. Returns status (notStarted, running, succeeded, failed) and numbers[] with the per-number outcome and any error. Poll sparingly: orders usually complete within a few minutes. - **list-teams-user-configurations** β€” Get user configurations for all Teams users who belong to a tenant. TIP: Lists Teams user configurations in the tenant. - **list-teams-catalog-apps** β€” List apps from the Microsoft Teams app catalog, including apps from the Microsoft Teams store and apps from your organization's app catalog (the tenant app catalog). To get apps from your organization's app catalog only, specify organization as the distributionMethod in the request. TIP: Lists apps in the Teams app catalog (tenant and store). Use $filter=distributionMethod eq 'organization' for tenant-only apps. Returns id, displayName, externalId, distributionMethod. - **get-teams-catalog-app** β€” Get teamsApps from appCatalogs TIP: Gets a specific app from the Teams app catalog. Use $expand=appDefinitions to get version details. - **list-teams-app-definitions** β€” The details for each version of the app. TIP: Lists all versions (definitions) of a Teams app. Each definition has displayName, description, version, publishingState, shortDescription, teamsAppId. - **list-applications** β€” Get the list of applications in this organization. This API also returns agentIdentityBlueprint objects, which are identified by the @odata.type property of #microsoft.graph.agentIdentityBlueprint. TIP: Lists all app registrations in the tenant. Use $select=displayName,appId,signInAudience,requiredResourceAccess,passwordCredentials,keyCredentials to audit app permissions and credentials. Use $filter=passwordCredentials/any(p:p/endDateTime le 2024-06-01T00:00:00Z) to find apps with expiring secrets (beta). - **get-application** β€” Get the properties and relationships of an application object. This API can be used to get agentIdentityBlueprint objects as well by their ID. TIP: Gets a specific app registration by object ID. Use $select=displayName,appId,passwordCredentials,keyCredentials,signInAudience,requiredResourceAccess to audit credentials and permissions. passwordCredentials shows client secrets with displayName, endDateTime, and keyId. keyCredentials shows certificates. CRITICAL: check endDateTime on credentials to find expiring or expired secrets/certs. - **list-app-federated-credentials** β€” Get a list of the federatedIdentityCredential objects and their properties assigned to an application. TIP: Lists federated identity credentials for an app (workload identity federation). Each has name, issuer, subject, audiences, and description. These allow external workloads (GitHub Actions, Kubernetes, etc.) to authenticate as the app without a secret. Audit to ensure only authorized external identities are trusted. RISK LEVEL: MEDIUM. This response contains PII or authentication metadata (sign-ins, MFA factors, mail metadata, risk detections). Handle with care and avoid casual disclosure. - **get-app-federated-credential** β€” Read the properties and relationships of a federatedIdentityCredential object assigned to an application. TIP: Gets a specific federated identity credential. Returns name, issuer (e.g. https://token.actions.githubusercontent.com), subject (e.g. repo:org/repo:ref:refs/heads/main), audiences, and description. RISK LEVEL: MEDIUM. This response contains PII or authentication metadata (sign-ins, MFA factors, mail metadata, risk detections). Handle with care and avoid casual disclosure. - **list-application-owners** β€” Retrieve a list of owners for an application that are directoryObject types. TIP: Lists owners of an app registration. Owners can manage the app including adding credentials. Returns user objects. Audit this to ensure apps have appropriate owners and no orphaned apps exist. - **list-directory-audits** β€” Get a list of directoryAudit objects representing the audit logs generated by Microsoft Entra ID. This includes audit logs generated by various services within Microsoft Entra ID, including user, app, device and group Management, privileged identity management (PIM), access reviews, terms of use, identity protection, password management (self-service and admin password resets), and self- service group management, and so on. TIP: Lists Azure AD directory audit logs. Use $filter=activityDateTime ge 2024-01-01T00:00:00Z to filter by date. Use $filter=category eq 'UserManagement' to filter by category. Use $filter=activityDisplayName eq 'Add user' to find specific activities. Each entry has activityDisplayName, category, result, initiatedBy, targetResources, and activityDateTime. - **list-provisioning-logs** β€” Get all provisioningObjectSummary events that occurred in your tenant, such as the deletion of a group in a target application or the creation of a user when provisioning user accounts from your HR system. TIP: Lists provisioning logs for Azure AD and third-party integrations. Use $filter=statusInfo/status eq 'failure' to find failed provisioning events. Use $filter=provisioningAction eq 'create' to filter by action type (create, update, delete, disable). Each entry has sourceSystem, targetSystem, provisioningAction, initiatedBy, sourceIdentity, targetIdentity, and statusInfo. - **list-sign-ins** β€” Retrieve the Microsoft Entra user sign-ins for your tenant. Sign-ins that are interactive in nature (where a username/password is passed as part of auth token) and successful federated sign-ins are currently included in the sign-in logs. The maximum and default page size is 1,000 objects and by default, the most recent sign-ins are returned first. Only sign-in events that occurred within the Microsoft Entra ID default retention period are available. TIP: Lists Azure AD sign-in logs. Use $filter=createdDateTime ge 2024-01-01T00:00:00Z to filter by date. Use $filter=userPrincipalName eq 'user@domain.com' to filter by user. Use $filter=status/errorCode ne 0 to find failed sign-ins. Each entry has userDisplayName, userPrincipalName, appDisplayName, ipAddress, location, status, conditionalAccessStatus, and riskState. RISK LEVEL: MEDIUM. This response contains PII or authentication metadata (sign-ins, MFA factors, mail metadata, risk detections). Handle with care and avoid casual disclosure. - **list-call-records** β€” Get the list of callRecord objects and their properties. The results can be optionally filtered using the $filter query parameter on the startDateTime and participant id properties. Note that the listed call records don't include expandable relationships such as sessions and participants_v2. You can expand these relationships using Get callRecord for a specific record. TIP: Lists Teams call records. Each record has id, version, type (groupCall, peerToPeer), modalities (audio, video, videoBasedScreenSharing, data), startDateTime, endDateTime, organizer, and participants. Use $filter=startDateTime ge 2024-01-01T00:00:00Z to filter by date. Use $orderby=startDateTime desc. Use $top to limit. - **get-call-record** β€” Retrieve the properties and relationships of a callRecord object. You can get the id of a callRecord in two ways: * Subscribe to change notifications to the /communications/callRecords endpoint. * Use the callChainId property of a call. The call record is available only after the associated call is completed. TIP: Gets a specific call record by ID. Returns type (groupCall/peerToPeer), modalities (audio/video/screenSharing), startDateTime, endDateTime, organizer, participants, version. - **get-call-record-organizer** β€” Identity of the organizer of the call. This relationship is expanded by default in callRecord methods. TIP: Gets the organizer of a call record (v2 API). Returns the organizer's identity (user or application). - **list-call-record-participants** β€” Get the list of participant objects associated with a callRecord. TIP: Lists participants in a call record (v2 API). Returns each participant's identity (user, phone, application), and participant details. - **get-call-record-participant** β€” List of distinct participants in the call. TIP: Gets a specific participant in a call record (v2 API). Returns participant identity and details. - **list-call-record-sessions** β€” Retrieve the list of sessions associated with a callRecord object. If the sessions list is truncated, a sessions@odata.nextLink value will be provided to retrieve the next page of sessions. The maximum page size for sessions is 60 entries. TIP: Lists sessions within a call record. Each session represents a participant's connection. Returns caller, callee, startDateTime, endDateTime, modalities, failureInfo. - **get-call-record-session** β€” List of sessions involved in the call. Peer-to-peer calls typically only have one session, whereas group calls typically have at least one session per participant. Read-only. Nullable. TIP: Gets a specific session within a call record. Returns detailed caller/callee info, modalities, startDateTime, endDateTime, failureInfo, isTest. - **list-call-session-segments** β€” The list of segments involved in the session. Read-only. Nullable. TIP: Lists segments within a call session. Each segment has media streams with detailed quality metrics: jitter, packetLoss, roundTripTime, averageAudioDegradation, etc. - **get-call-session-segment** β€” The list of segments involved in the session. Read-only. Nullable. TIP: Gets a specific segment of a call session. Returns detailed media stream quality metrics including jitter, packetLoss, roundTripTime for audio/video/screenSharing. - **get-direct-routing-calls** β€” Get a log of direct routing calls as a collection of directRoutingLogRow entries. TIP: Gets Direct Routing call records for a date range. Parameters are ISO 8601 dates. Returns callId, correlationId, userId, callerNumber, calleeNumber, duration, startDateTime, failureDateTime, finalSipCode, mediaPathLocation. - **get-pstn-calls** β€” Get a log of PSTN calls as a collection of pstnCallLogRow entries. TIP: Gets PSTN (Public Switched Telephone Network) call records for a date range. Parameters are ISO 8601 dates. Returns callId, userId, userPrincipalName, callerNumber, calleeNumber, duration, charge, callType, currency. - **list-copilot-policy-settings** β€” Get policySettings from copilot TIP: Lists Microsoft 365 Copilot policy settings configured for the tenant. Each setting has id, displayName, value, defaultValue, dataType (boolean | string | number | enum), description, updatedDateTime. Examples of settings: 'Copilot for Outlook enabled', 'Copilot Chat web grounding allowed', 'Microsoft 365 Chat web search', 'Copilot retention period in interaction history'. Use to audit which Copilot features are enabled tenant-wide. Beta-only endpoint. - **get-copilot-policy-setting** β€” Get policySettings from copilot TIP: Gets a specific Copilot policy setting by ID. Returns the setting's current value plus its default, dataType, allowed values (for enum-type), description, last update timestamp. Use to drill into a specific policy after list-copilot-policy-settings identified it. Beta-only endpoint. - **get-copilot-admin-settings** β€” Get settings from copilot TIP: Gets Microsoft 365 Copilot admin settings for the tenant. Returns configuration controlling Copilot behavior and availability. - **get-copilot-limited-mode** β€” Get limitedMode from copilot TIP: Gets Copilot limited mode configuration. Returns isEnabledForGroup, groupId, and whether Copilot features are restricted for specific user groups. - **get-copilot-agent-registration** β€” Navigation property to access agent registrations at /copilot/agentRegistrations. TIP: Gets a specific Copilot agent registration by ID. Returns full agent card manifest (endpoint URL, capabilities, scopes), createdBy, dates. Use to audit a specific agent's configuration when investigating data access patterns or compliance with internal AI usage policies. Beta-only endpoint. - **get-all-copilot-interactions** β€” Invoke function getAllEnterpriseInteractions TIP: Gets ALL Microsoft 365 Copilot interactions tenant-wide β€” every user prompt to Copilot and Copilot's response, across Teams, Word, Outlook, M365 Chat, etc. Returns aiInteraction objects with userId, sessionId, appClass (e.g. IPM.SkypeTeams.Message.Copilot.Teams, IPM.SkypeTeams.Message.Copilot.BizChat), interactionDateTime, body (the actual prompt/response content), conversationType. Supports $filter (e.g. appClass eq '...'), $top (recommended 100 for performance), date ranges. SENSITIVE: this returns the actual prompt content tenant-wide β€” gates a high surveillance capability. Use ONLY with documented investigative purpose (security incident, legal hold, compliance audit) and log each query in the internal investigation journal per PIPEDA / Loi 25 / RGPD legitimacy requirements. Licensed users only (Microsoft 365 Copilot with Graph-grounded chat service plan). - **get-copilot-usage-user-detail** β€” Invoke function getMicrosoft365CopilotUsageUserDetail TIP: Gets per-user Microsoft 365 Copilot usage detail over a period β€” for adoption tracking and license utilization analysis. period: 'D7' | 'D28' | 'D90' | 'D180' | 'ALL'. D30 belongs to report version v1, not the v2 default. Microsoft now serves report version v2 by default; leave the optional version parameter unset. Returns one row per user (UPN, display name, last activity date, last activity dates per Copilot-enabled app: Outlook, Teams, Word, Excel, PowerPoint, OneNote, Loop, M365 Chat). Useful for: identifying inactive license assignments (Copilot license costs ~$30 USD/user/month β†’ ROI analysis), spotting power users vs dormant, planning training rollouts. Anonymized at the org level if 'Display concealed names in reports' is enabled in admin center. - **get-copilot-user-count-summary** β€” Invoke function getMicrosoft365CopilotUserCountSummary TIP: Gets the Microsoft 365 Copilot user count summary over a period (D7/D28/D90/D180/ALL; D30 belongs to report version v1). Microsoft now serves report version v2 by default; leave the optional version parameter unset. Returns active vs. total enabled counts per Copilot-integrated app. Higher-level than get-copilot-usage-user-detail β€” gives the top-line adoption number without per-user names. Use for executive reporting / KPI dashboards (% adoption among licensed users). - **get-copilot-user-count-trend** β€” Invoke function getMicrosoft365CopilotUserCountTrend TIP: Gets the Microsoft 365 Copilot user count trend (time series) over a period (D7/D28/D90/D180/ALL; D30 belongs to report version v1). Microsoft now serves report version v2 by default; leave the optional version parameter unset. Returns one data point per day with active counts per app. Use for trend reporting (week-over-week adoption growth, post-training adoption bump, Friday usage drop, etc.). Pair with get-copilot-user-count-summary (snapshot) for full adoption picture. - **list-ai-users** β€” Get users from copilot TIP: Lists AI users (Copilot-licensed users) in the tenant. Each has id (= directory user id), displayName. Use as an inventory of who has Copilot enabled before diving into their interactionHistory or meeting aiInsights. Cross-reference with list-subscribed-skus to confirm SKU vs actual enablement. Supports $filter, $top, $skip, $select. - **get-ai-user** β€” Get users from copilot TIP: Gets a specific AI user (Copilot-licensed user) by ID. Returns id and displayName; use $expand=interactionHistory or onlineMeetings to traverse to dependent resources. - **get-user-copilot-interactions** β€” Invoke function getAllEnterpriseInteractions TIP: Gets ALL Microsoft 365 Copilot interactions for a SPECIFIC user β€” user prompts + Copilot responses across all integrated apps. Same shape as get-all-copilot-interactions but scoped to {aiUser-id} (which is the user's directory id / object id). Supports $filter, $top (recommended 100), date ranges. PRIVACY CAVEAT: scoping reduces but does not eliminate the surveillance impact β€” admin reads of a user's AI prompts must be documented per PIPEDA / Loi 25 / RGPD. PREFERRED over the tenant-wide variant when investigating a specific user (more efficient + less data over the wire). - **list-ai-user-online-meetings** β€” Get onlineMeetings from copilot TIP: Lists meetings where this AI user has Copilot insights available (meeting summary, action items, key topics generated by Copilot). One entry per meeting Copilot processed. Use to identify which meetings have AI-generated recaps to retrieve via list-ai-meeting-insights. Supports $filter (e.g. on date), $top, $skip, $orderby. - **list-ai-meeting-insights** β€” Get aiInsights from copilot TIP: Lists AI-generated insights for a specific meeting (Copilot's meeting recap). Each insight has type (summary | actionItems | keyTopics | mentions), content (the actual AI-generated text), createdDateTime. Returns multiple insights per meeting β€” one per insight type. Use as a lightweight alternative to extracting the full meeting recording / transcript when you need the AI summary not the raw content. PRIVACY CAVEAT: AI insights derive from the meeting transcript β€” same sensitivity as the raw transcript. Document the investigative purpose. - **get-ai-meeting-insight** β€” Get aiInsights from copilot TIP: Gets a single Copilot meeting insight by id. Returns the full content (summary text, action items list, key topics, etc.) for the insight specified. Use after list-ai-meeting-insights identified a specific insight type of interest. - **list-android-app-protections** β€” Android managed app policies. TIP: Lists Android managed app protection policies (MAM). Each has displayName, description, periodOfflineBeforeWipeIsEnforced, pinRequired, minimumPinLength, managedBrowser, allowedDataStorageLocations, and organizationalCredentialsRequired. - **list-default-app-protections** β€” Default managed app policies. TIP: Lists default managed app protection policies. These are cross-platform MAM policies that apply when no platform-specific policy exists. - **list-ios-app-protections** β€” iOS managed app policies. TIP: Lists iOS managed app protection policies (MAM). Each has displayName, description, periodOfflineBeforeWipeIsEnforced, pinRequired, minimumPinLength, faceIdBlocked, and allowedDataStorageLocations. - **list-managed-app-policies** β€” Managed app policies. TIP: Lists Intune managed app protection policies (MAM). Each has displayName, description, createdDateTime, version. Shows all app protection policies across platforms. - **list-managed-app-registrations** β€” The managed app registrations. TIP: Lists managed app registrations. Each registration represents a user+device+app combination where MAM policy applies. Has appIdentifier, createdDateTime, deviceName, managementSdkVersion, and userId. - **list-managed-app-statuses** β€” The managed app statuses. TIP: Lists managed app status reports. Returns status summaries for Intune app protection policies including deployment and user status. - **list-mdm-wip-policies** β€” Windows information protection for apps running on devices which are MDM enrolled. TIP: Lists MDM Windows Information Protection (WIP) policies. Each has displayName, enforcementLevel, protectedApps, exemptApps, enterpriseNetworkDomainNames, and enterpriseProtectedDomainNames. - **list-intune-app-categories** β€” The mobile app categories. TIP: Lists Intune mobile app categories. Each has displayName and id. Categories help organize apps in the Company Portal. - **list-intune-app-configurations** β€” The Managed Device Mobile Application Configurations. TIP: Lists Intune app configuration policies. Each has displayName, description, targetedMobileApps, settings, and createdDateTime. Used to push configuration to managed apps. - **list-intune-mobile-apps** β€” The mobile apps. TIP: Lists mobile apps managed by Intune. Each has displayName, publisher, createdDateTime, lastModifiedDateTime, isAssigned, isFeatured, publishingState. Includes Win32, iOS, Android, macOS, and web apps. Use $filter=isAssigned eq true to see assigned apps. - **list-targeted-app-configurations** β€” Targeted managed app configurations. TIP: Lists targeted managed app configuration policies. Each has displayName, description, targetedMobileApps, customSettings, and isAssigned. These push configuration to specific groups of users. - **list-vpp-tokens** β€” List of Vpp tokens for this organization. TIP: Lists Apple Volume Purchase Program (VPP) tokens. Each has organizationName, appleId, state (valid, expired, invalid), expirationDateTime, lastSyncDateTime, lastSyncStatus, and automaticallyUpdateApps. - **list-mam-wip-policies** β€” Windows information protection for apps running on devices which are not MDM enrolled. TIP: Lists MAM Windows Information Protection (WIP) policies (without MDM enrollment). Each has displayName, enforcementLevel, protectedApps, exemptApps, and isAssigned. - **get-apple-push-certificate** β€” Apple push notification certificate. TIP: Gets the Apple Push Notification certificate info. Returns appleIdentifier, topicIdentifier, lastModifiedDateTime, expirationDateTime, and certificateSerialNumber. CRITICAL: monitor expirationDateTime β€” if it expires, all iOS/macOS device management stops. - **list-assignment-filters** β€” The list of assignment filters TIP: Lists Intune assignment filters (dynamic membership filters applied to policy/app assignments). Each filter has displayName, description, platform (android/iOS/macOS/windows10AndLater/etc.), rule (KQL-like expression on device properties: e.g. "device.osVersion -startsWith \"14\""), assignmentFilterManagementType (devices | apps), and creationSource. Filters scope assignments to a sub-set of a group (e.g. "only Macs on Sonoma", "only iPhones supervised"). Supports $filter, $top, $skip, $select, $expand, $orderby, $count. - **get-assignment-filter** β€” The list of assignment filters TIP: Gets a specific Intune assignment filter by ID. Returns full rule expression and metadata. Supports $select and $expand. - **list-intune-audit-events** β€” The Audit Events TIP: Lists Intune audit events. Each has displayName, componentName, activity, activityDateTime, activityType, actor (userPrincipalName, applicationDisplayName), and resources (displayName, type). Use $filter=activityDateTime ge 2024-01-01T00:00:00Z to filter by date. Use to track who changed Intune policies. - **list-compliance-management-partners** β€” The list of Compliance Management Partners configured by the tenant. TIP: Lists compliance management partners integrated with Intune. Each has displayName, partnerState, and supported platforms. - **get-intune-conditional-access-settings** β€” The Exchange on premises conditional access settings. On premises conditional access will require devices to be both enrolled and compliant for mail access TIP: Gets Intune on-premises conditional access settings. Returns enabled status and which devices are included/excluded from conditional access to on-premises Exchange. - **list-configuration-policies** β€” List of all Configuration policies TIP: Lists Intune Settings catalog policies, which is also where every modern Endpoint security policy lives (Disk encryption/BitLocker, Antivirus, Firewall, Attack surface reduction, EDR, Account protection). Each has name, description, platforms (windows10, macOS, ...), technologies (mdm, microsoftSense, ...), templateReference {templateId, templateFamily, templateDisplayName}, settingCount, isAssigned, roleScopeTagIds, createdDateTime, lastModifiedDateTime. Endpoint security policies carry a templateFamily: endpointSecurityDiskEncryption (BitLocker / FileVault), endpointSecurityAntivirus, endpointSecurityFirewall, endpointSecurityAttackSurfaceReduction, endpointSecurityEndpointDetectionAndResponse, endpointSecurityAccountProtection; plain Settings catalog policies have templateFamily none. Filter with $filter=templateReference/templateFamily eq 'endpointSecurityDiskEncryption'. Use $expand=assignments to see target groups (assignment target @odata.type: groupAssignmentTarget, exclusionGroupAssignmentTarget, allDevicesAssignmentTarget, allLicensedUsersAssignmentTarget). Settings are NOT returned in the list β€” use get-configuration-policy or list-configuration-policy-settings. Legacy template-based Endpoint security policies are intents, not configurationPolicies β€” see list-intents. Supports $filter, $top, $skip, $select, $expand, $orderby, $count. - **get-configuration-policy** β€” List of all Configuration policies TIP: Gets a Settings catalog / Endpoint security policy by ID. Pass $expand=settings,assignments to get the configured values (settings[].settingInstance: settingDefinitionId plus choiceSettingValue / simpleSettingValue / groupSettingCollectionValue, nested children) and the target groups in one call. Setting definition IDs are self-describing, e.g. device_vendor_msft_bitlocker_requiredeviceencryption, device_vendor_msft_bitlocker_systemdrivesrequirestartupauthentication. For policies with hundreds of settings, page them with list-configuration-policy-settings instead. Supports $select and $expand. - **list-configuration-policy-settings** β€” Policy settings TIP: Lists the configured settings of a Settings catalog / Endpoint security policy, paged. Each item has settingInstance {settingDefinitionId, choiceSettingValue | simpleSettingValue | groupSettingCollectionValue, children}. Pass $expand=settingDefinitions to get each setting's displayName, description and allowed options alongside the value. Supports $filter, $top, $skip, $select, $expand, $count. - **list-configuration-policy-templates** β€” List of all templates TIP: Lists the templates Endpoint security policies are created from. Each has id (templateId), baseId, version, displayName, description, displayVersion, lifecycleState (active, superseded, deprecated, retired), platforms, technologies and templateFamily. Use it to find the templateReference.templateId to pass to create-configuration-policy, and to spot policies built on a superseded template. Filter with $filter=templateFamily eq 'endpointSecurityDiskEncryption' and lifecycleState eq 'active'. Supports $filter, $top, $skip, $select, $expand, $count. - **list-detected-apps** β€” The list of detected apps associated with a device. TIP: Lists all applications detected on Intune-managed devices. Each has displayName, version, sizeInByte, deviceCount, and platform. Use to audit software inventory and find unauthorized applications. Use $orderby=deviceCount desc to see most-installed apps. - **get-detected-app** β€” The list of detected apps associated with a device. TIP: Gets a specific detected application. Returns displayName, version, sizeInByte, deviceCount, and platform. - **list-detected-app-devices** β€” The devices that have the discovered application installed TIP: Lists managed devices that have a specific application installed. Useful for finding all devices with a particular app version (e.g., outdated or unauthorized software). - **list-device-categories** β€” The list of device categories with the tenant. TIP: Lists Intune device categories. Categories allow organizing devices for dynamic group targeting. Each has displayName and description. - **list-compliance-policies** β€” The device compliance policies. TIP: Lists all Intune device compliance policies. Each has displayName, description, @odata.type (platform-specific: windows10, iOS, androidWorkProfile, macOS), createdDateTime, lastModifiedDateTime, and version. Use to audit what compliance rules are in place. - **get-compliance-policy** β€” The device compliance policies. TIP: Gets a specific compliance policy. Returns full details including platform-specific settings (password requirements, encryption, OS version, etc.). - **list-compliance-policy-device-statuses** β€” List of DeviceComplianceDeviceStatus. TIP: Lists device statuses for a specific compliance policy. Each has deviceDisplayName, userName, status (compliant, nonCompliant, error, conflict, notApplicable), lastReportedDateTime, and complianceGracePeriodExpirationDateTime. - **get-compliance-policy-status-overview** β€” Device compliance devices status overview TIP: Gets the device status overview for a compliance policy. Returns aggregate counts: pendingCount, notApplicableCount, successCount, errorCount, failedCount, conflictCount, lastUpdateDateTime. - **get-compliance-state-summary** β€” The device compliance state summary for this account. TIP: Gets the tenant-wide device compliance state summary. Returns aggregate counts: inGracePeriodCount, compliantDeviceCount, nonCompliantDeviceCount, remediatedDeviceCount, errorDeviceCount, conflictDeviceCount, unknownDeviceCount, notApplicableDeviceCount. - **list-device-compliance-scripts** β€” The list of device compliance scripts associated with the tenant. TIP: Lists Intune custom compliance PowerShell scripts (deviceComplianceScripts) for Windows 10/11. Each script emits a JSON object on STDOUT (e.g. {"BitLockerEnabled":true,"TpmReady":true}) which is then evaluated against rules declared on an associated compliance policy with @odata.type=#microsoft.graph.windows10CustomComplianceConfiguration. Each has displayName, description, publisher, version, runAsAccount (system | user), enforceSignatureCheck, runAs32Bit, roleScopeTagIds. detectionScriptContent is NOT returned in list responses. Supports $filter, $top, $skip, $select, $expand, $orderby, $count. - **get-device-compliance-script** β€” The list of device compliance scripts associated with the tenant. TIP: Gets a specific Intune custom compliance script by ID. By default detectionScriptContent is NOT returned β€” pass $select=id,displayName,detectionScriptContent,runAsAccount,enforceSignatureCheck,runAs32Bit,... to fetch the base64-encoded PowerShell body. Supports $select and $expand. - **list-device-configurations** β€” The device configurations. TIP: Lists all Intune device configuration profiles. Each has displayName, description, @odata.type (platform-specific), createdDateTime, lastModifiedDateTime, and version. Covers Wi-Fi, VPN, email, certificates, device restrictions, endpoint protection, etc. List only Windows Update for Business rings with $filter=isof('microsoft.graph.windowsUpdateForBusinessConfiguration'), then read each ring with get-device-configuration (no $select). Settings catalog and Endpoint security policies are not device configurations β€” see list-configuration-policies. - **get-device-configuration** β€” The device configurations. TIP: Gets a specific device configuration profile. Returns full details including platform-specific settings (Wi-Fi SSID, VPN config, device restrictions, etc.). Do NOT $select platform-specific properties (e.g. qualityUpdatesDeferralPeriodInDays): $select only resolves properties of the base deviceConfiguration type and Graph answers 400. Call without $select β€” the response already contains every property of the concrete type. For a Windows Update for Business ring (@odata.type windowsUpdateForBusinessConfiguration) that includes qualityUpdatesDeferralPeriodInDays, featureUpdatesDeferralPeriodInDays, qualityUpdatesPaused, featureUpdatesPaused, deadlineForQualityUpdatesInDays, deadlineForFeatureUpdatesInDays, deadlineGracePeriodInDays, automaticUpdateMode, installationSchedule and allowWindows11Upgrade. - **list-device-configuration-device-statuses** β€” Device configuration installation status by device. TIP: Per-device status of one device configuration profile (classic profiles and Windows Update for Business rings; Settings catalog policies use get-configuration-policy-device-status instead). Each has deviceDisplayName, userPrincipalName, userName, deviceModel, platform, status (unknown, notApplicable, compliant, remediated, nonCompliant, error, conflict, notAssigned), complianceGracePeriodExpirationDateTime and lastReportedDateTime. Filter with $filter=status eq 'error'. Supports $filter, $top, $skip, $select, $orderby, $count. - **get-device-configuration-status-overview** β€” Device Configuration devices status overview TIP: Gets device status overview for a configuration profile. Returns aggregate counts: pendingCount, notApplicableCount, successCount, errorCount, failedCount, conflictCount, lastUpdateDateTime. - **list-device-custom-attribute-shell-scripts** β€” The list of device custom attribute shell scripts associated with the tenant. TIP: Lists Intune macOS custom attribute shell scripts. Each script's STDOUT is stored as a named custom attribute on the device record β€” useful for surfacing inventory data (FileVault state, Gatekeeper, encryption flags, custom markers) and driving dynamic group filters. Each has displayName, description, customAttributeName (the attribute key), customAttributeType (integer | string | dateTime), runAsAccount (system | user), fileName, roleScopeTagIds. scriptContent is NOT returned in list responses β€” fetch a specific script with $select=scriptContent. Supports $filter, $top, $skip, $select, $expand, $orderby, $count. - **get-device-custom-attribute-shell-script** β€” The list of device custom attribute shell scripts associated with the tenant. TIP: Gets a specific Intune macOS custom attribute shell script by ID. By default scriptContent is NOT returned β€” pass $select=id,displayName,scriptContent,customAttributeName,customAttributeType,runAsAccount,... to fetch the base64-encoded script body. Supports $select and $expand. - **list-enrollment-configurations** β€” The list of device enrollment configurations TIP: Lists device enrollment configurations. Includes Windows Autopilot deployment profiles, enrollment restrictions (platform, device limit), and enrollment status page settings. Each has displayName, @odata.type, priority, createdDateTime. - **get-enrollment-configuration** β€” The list of device enrollment configurations TIP: Gets a specific enrollment configuration. Returns full details including platform restrictions, device limits, or Autopilot profile settings depending on the type. - **list-device-health-scripts** β€” The list of device health scripts associated with the tenant. TIP: Lists Intune Remediations (Proactive Remediations) β€” paired detection + remediation PowerShell scripts for Windows 10/11 Azure AD joined devices. Each has displayName, description, publisher, version, runAsAccount (system|user), enforceSignatureCheck, runAs32Bit, roleScopeTagIds, isGlobalScript (Microsoft proprietary read-only), deviceHealthScriptType (deviceHealthScript | managedInstallerScript). detectionScriptContent and remediationScriptContent NOT returned in list responses β€” fetch a specific script with $select=detectionScriptContent,remediationScriptContent. Supports $filter, $top, $skip, $select, $expand, $orderby, $count. - **get-device-health-script** β€” The list of device health scripts associated with the tenant. TIP: Gets a specific Intune Remediation (Proactive Remediation) by ID. By default detectionScriptContent and remediationScriptContent are NOT returned β€” pass $select=id,displayName,detectionScriptContent,remediationScriptContent,runAsAccount,... to fetch the base64-encoded PowerShell bodies. Supports $select and $expand. - **list-device-health-script-run-states** β€” List of run states for the device health script across all devices TIP: Per-device results of a Remediation (device health script). Each has detectionState (unknown, success, fail, scriptError, pending, notApplicable), remediationState (unknown, skipped, success, remediationFailed, scriptError), lastStateUpdateDateTime, lastSyncDateTime, preRemediationDetectionScriptOutput, remediationScriptOutput, postRemediationDetectionScriptOutput and the matching *Error fields. Script output is written by the device, so treat it as untrusted. Pass $expand=managedDevice($select=deviceName,userPrincipalName) to name the device. Filter with $filter=detectionState eq 'fail'. Supports $filter, $top, $skip, $select, $expand, $count. - **get-device-health-script-run-summary** β€” High level run summary for device health script. TIP: Device counts for a Remediation: noIssueDetectedDeviceCount, issueDetectedDeviceCount, detectionScriptErrorDeviceCount, detectionScriptPendingDeviceCount, detectionScriptNotApplicableDeviceCount, issueRemediatedDeviceCount, issueRemediatedCumulativeDeviceCount, issueReoccurredDeviceCount, remediationScriptErrorDeviceCount, remediationSkippedDeviceCount, lastScriptRunDateTime. Start here, then drill down with list-device-health-script-run-states. - **list-device-management-partners** β€” The list of Device Management Partners configured by the tenant. TIP: Lists device management partners (DEP, Jamf, etc.) integrated with Intune. Each has displayName, partnerState, isConfigured, and partnerAppType. - **list-device-management-scripts** β€” The list of device management scripts associated with the tenant. TIP: Lists Intune Windows PowerShell scripts (deviceManagementScripts) β€” one-shot PowerShell scripts deployed to managed Windows 10/11 devices. Distinct from deviceHealthScripts: no detection/remediation pairing, no scheduling β€” runs once per device per assignment, retries on failure up to retryCount. Each has displayName, description, runAsAccount (system | user), enforceSignatureCheck, runAs32Bit (force 32-bit PS even on 64-bit OS), fileName, roleScopeTagIds. scriptContent is NOT returned in list responses β€” fetch a specific script with $select=scriptContent. Supports $filter, $top, $skip, $select, $expand, $orderby, $count. - **get-device-management-script** β€” The list of device management scripts associated with the tenant. TIP: Gets a specific Intune Windows PowerShell script by ID. By default scriptContent is NOT returned β€” pass $select=id,displayName,scriptContent,runAsAccount,enforceSignatureCheck,runAs32Bit,... to fetch the base64-encoded PowerShell body. Supports $select and $expand. - **list-device-shell-scripts** β€” The list of device shell scripts associated with the tenant. TIP: Lists Intune macOS Platform Scripts (shell scripts deployed to managed Macs). Each has displayName, description, runAsAccount (system|user), executionFrequency (ISO 8601 duration; PT0S=run once, P1D=daily), retryCount, blockExecutionNotifications, fileName, roleScopeTagIds. scriptContent is NOT returned in list responses β€” fetch a specific script with $select=scriptContent. Supports $filter, $top, $skip, $select, $expand, $orderby, $count. - **get-device-shell-script** β€” The list of device shell scripts associated with the tenant. TIP: Gets a specific Intune macOS Platform Script by ID. By default scriptContent is NOT returned β€” pass $select=id,displayName,scriptContent,runAsAccount,executionFrequency,... to fetch the base64-encoded script body. Supports $select and $expand. - **list-exchange-connectors** β€” The list of Exchange Connectors configured by the tenant. TIP: Lists Exchange connectors for Intune on-premises Exchange integration. Each has connectorName, status, serverName, exchangeConnectorType, and version. - **list-imported-autopilot-devices** β€” Collection of imported Windows autopilot devices. TIP: Lists imported Windows Autopilot device identities. Each has serialNumber, productKey, hardwareIdentifier, state (importState), and importedDateTime. Use to track Autopilot device import status. - **list-intents** β€” The device management intents TIP: Lists legacy template-based Endpoint security policies (intents): the Disk encryption, Antivirus, Firewall and Security baseline profiles created before Microsoft moved Endpoint security onto the Settings catalog. Each has displayName, description, templateId, isAssigned, isMigratingToConfigurationPolicy, roleScopeTagIds, lastModifiedDateTime. Use $expand=assignments to see target groups. An audit of Endpoint security must check both list-intents and list-configuration-policies. Supports $filter, $top, $skip, $select, $expand, $orderby, $count. - **get-intent** β€” The device management intents TIP: Gets a legacy Endpoint security intent by ID. Pass $expand=settings,assignments,deviceStateSummary to get its configured values (settings[]: definitionId, valueJson), target groups and device counts (successCount, errorCount, conflictCount, notApplicableCount, inGracePeriodCount) in one call. Supports $select and $expand. - **list-intent-device-states** β€” Collection of states of all devices that the intent is applied to TIP: Per-device state of a legacy Endpoint security intent. Each has deviceDisplayName, deviceId, userPrincipalName, userName, state (unknown, notApplicable, compliant, remediated, nonCompliant, error, conflict, notAssigned) and lastReportedDateTime. Filter with $filter=state eq 'error'. Supports $filter, $top, $skip, $select, $orderby, $count. - **list-ios-update-statuses** β€” The IOS software update installation statuses for this account. TIP: Lists iOS update installation statuses across managed devices. Each has deviceDisplayName, userName, osVersion, installStatus (downloading, installing, idle, available, etc.), lastReportedDateTime, deviceModel, deviceId. - **list-managed-device-encryption-states** β€” Encryption report for devices in this account TIP: Per-device encryption report (Intune > Devices > Monitor > Encryption report) β€” the first stop to diagnose BitLocker or FileVault. Each row has id (the Intune managed device ID), deviceName, userPrincipalName, deviceType, osVersion, tpmSpecificationVersion, encryptionReadinessState (notReady, ready), encryptionState (notEncrypted, encrypted), fileVaultStates, advancedBitLockerStates (bitmask of reasons BitLocker is not enforced: osVolumeEncryptionMethodMismatch, osVolumeTpmRequired, osVolumeTpmOnlyRequired, recoveryKeyBackupFailed, ...) and policyDetails [{policyId, policyName}] β€” the encryption policies that reached the device. Filter with $filter=encryptionState eq 'notEncrypted', or $filter=deviceName eq 'PC-001' for one device. Supports $filter, $top, $skip, $select, $orderby, $count. - **get-managed-device-overview** β€” Device overview TIP: Gets a high-level overview of all managed devices. Returns aggregate counts by enrolledDeviceCount, mdmEnrolledCount, dualEnrolledDeviceCount, deviceOperatingSystemSummary (android, iOS, macOS, windows, windowsMobile), and deviceExchangeAccessStateSummary. - **list-managed-devices** β€” The list of managed devices. TIP: Lists all Intune-managed devices. Use $filter=operatingSystem eq 'Windows' to filter by OS. Use $filter=complianceState eq 'noncompliant' to find non-compliant devices. Use $select=deviceName,operatingSystem,osVersion,complianceState,isEncrypted,managementAgent,enrolledDateTime,lastSyncDateTime,userPrincipalName. Use $filter=lastSyncDateTime le 2024-01-01T00:00:00Z to find stale devices. - **get-managed-device** β€” The list of managed devices. TIP: Gets a specific Intune-managed device by ID (Graph beta). Returns full details: deviceName, operatingSystem, osVersion, complianceState, isEncrypted, jailBroken, managementAgent, enrolledDateTime, lastSyncDateTime, userPrincipalName, azureADDeviceId, model, manufacturer, serialNumber, wiFiMacAddress. hardwareInformation (TPM version and manufacturer, BIOS/system management version, encryption and Device Guard / virtualization-based security state, free storage, battery) is only returned on request: pass $select=deviceName,hardwareInformation. Secure Boot and other health-attestation results are in deviceHealthAttestationState (also $select only; null until the device reports health attestation). - **list-device-compliance-states** β€” Device compliance policy states for this device. TIP: Lists compliance policy states for a specific managed device. Shows which compliance policies apply and their state (compliant, nonCompliant, notApplicable, error). Each has displayName, state, settingCount, settingStates. - **list-device-configuration-states** β€” Device configuration states for this device. TIP: Lists configuration profile states for a specific managed device. Shows which configuration profiles apply and their state (notApplicable, success, error, conflict). Each has displayName, state, settingCount. - **get-windows-protection-state** β€” The device protection status. This property is read-only. TIP: Microsoft Defender Antivirus health of one Windows device, as Intune last received it. Returns malwareProtectionEnabled, realTimeProtectionEnabled, networkInspectionSystemEnabled, tamperProtectionEnabled, isVirtualMachine, quickScanOverdue, fullScanOverdue, fullScanRequired, rebootRequired, signatureUpdateOverdue, signatureVersion, antiMalwareVersion, engineVersion, lastQuickScanDateTime, lastFullScanDateTime, lastQuickScanSignatureVersion, lastReportedDateTime, deviceState (clean, fullScanPending, rebootPending, manualStepsPending, offlineScanPending, critical) and productStatus. Pass $expand=detectedMalwareState for the threats currently detected on the device. Supports $select and $expand. - **list-mtd-connectors** β€” The list of Mobile threat Defense connectors configured by the tenant. TIP: Lists Mobile Threat Defense (MTD) connectors. Shows which MTD partners are integrated (Microsoft Defender, Lookout, Zimperium, etc.), their state (enabled/disabled), and platform support. Each has partnerState, androidEnabled, iosEnabled, lastHeartbeatDateTime. - **list-notification-message-templates** β€” The Notification Message Templates. TIP: Lists Intune notification message templates. These are compliance notification templates sent to users when their devices are non-compliant. Each has displayName, defaultLocale, brandingOptions, and roleScopeTagIds. - **list-remote-assistance-partners** β€” List properties and relationships of the remoteAssistancePartner objects. TIP: Lists remote assistance partners (TeamViewer, etc.) integrated with Intune. Each has displayName, onboardingStatus, and lastConnectionDateTime. - **list-intune-report-export-jobs** β€” Entity representing a job to export a report. TIP: Lists Intune report export jobs. Each has id, reportName, status (notStarted, inProgress, completed), requestDateTime, and url (download link when completed). - **list-intune-resource-operations** β€” The Resource Operations. TIP: Lists Intune RBAC resource operations. Each has resourceName, actionName, and description. Shows all available operations that can be assigned to Intune roles. - **list-intune-role-assignments** β€” The Role Assignments. TIP: Lists Intune RBAC role assignments. Each has displayName, description, resourceScopes, and members. Shows who has been granted which Intune admin roles and over which scope. - **list-intune-role-definitions** β€” The Role Definitions. TIP: Lists Intune RBAC role definitions. Each has displayName, description, isBuiltIn, permissions (actions), and roleAssignments. Built-in roles include Intune Administrator, Help Desk Operator, Read Only Operator, etc. - **get-software-update-summary** β€” The software update status summary. TIP: Gets a summary of Windows update statuses across managed devices. Returns counts by status: compliantDeviceCount, nonCompliantDeviceCount, remediatedDeviceCount, errorDeviceCount, conflictDeviceCount, unknownDeviceCount, notApplicableDeviceCount. - **list-intent-templates** β€” The available templates TIP: Lists the legacy templates intents are built from (security baselines and template-based Endpoint security profiles). Each has displayName, description, templateType (securityBaseline, diskEncryptionConfiguration, firewall, ...), templateSubtype, platformType, versionInfo, isDeprecated, intentCount. Resolve an intent's templateId here. Supports $filter, $top, $skip, $select, $count. - **list-intune-terms-and-conditions** β€” The terms and conditions associated with device management of the company. TIP: Lists Intune terms and conditions. Each has displayName, description, title, bodyText, acceptanceStatement, version, createdDateTime, and modifiedDateTime. - **list-intune-terms-acceptances** β€” The list of acceptance statuses for this T&C policy. TIP: Lists acceptance statuses for Intune terms and conditions. Each has userDisplayName, userPrincipalName, acceptedVersion, acceptedDateTime. Useful for compliance reporting. - **list-cloud-pc-audit-events** β€” List all the cloudPcAuditEvent objects for the tenant. TIP: Lists Cloud PC audit events. Each has displayName, componentName, activity, activityDateTime, activityType (create, delete, patch), activityOperationType, activityResult (success, failure), actor, and resources. Use $filter=activityDateTime ge 2024-01-01T00:00:00Z. Use $orderby=activityDateTime desc. - **list-cloud-pcs** β€” List the cloudPC devices in a tenant. TIP: Lists Cloud PCs (Windows 365) provisioned in the tenant. Each has displayName, managedDeviceName, userPrincipalName, status (provisioned, provisioning, failed, notProvisioned), provisioningPolicyId, imageDisplayName, lastModifiedDateTime, gracePeriodEndDateTime, and aadDeviceId. Use $filter=status eq 'provisioned' or status eq 'failed'. Use $top to limit. - **list-cloud-pc-device-images** β€” List the properties and relationships of cloudPcDeviceImage objects (operating system images) uploaded to Cloud PC. TIP: Lists custom OS images uploaded for Cloud PC provisioning. Each has displayName, version, operatingSystem, osBuildNumber, sourceImageResourceId, status (readyForUpload, pending, failed), statusDetails, and lastModifiedDateTime. - **list-cloud-pc-gallery-images** β€” List the properties and relationships of cloudPcGalleryImage objects. TIP: Lists gallery images available from Microsoft for Cloud PC provisioning. Each has displayName, offerDisplayName, publisherName, skuDisplayName, skuName, status, startDate, endDate, and expirationDate. - **list-cloud-pc-on-premises-connections** β€” List properties and relationships of the cloudPcOnPremisesConnection objects. TIP: Lists Azure network connections used by Cloud PCs. Each has displayName, type (azureADJoin, hybridAzureADJoin), subscriptionId, resourceGroupId, virtualNetworkId, subnetId, healthCheckStatus (passed, failed, running, warning), and healthCheckStatusDetail. - **list-cloud-pc-provisioning-policies** β€” List properties and relationships of the cloudPcProvisioningPolicy objects. TIP: Lists Cloud PC provisioning policies. Each has displayName, description, imageId, imageDisplayName, imageType, onPremisesConnectionId, domainJoinConfigurations, windowsSetting, and provisioningType. These define how Cloud PCs are provisioned for users. - **list-cloud-pc-user-settings** β€” Get a list of cloudPcUserSetting objects and their properties. TIP: Lists Cloud PC user settings. Each has displayName, selfServiceEnabled, localAdminEnabled, restorePointSetting (frequencyType, userRestoreEnabled), and lastModifiedDateTime. User settings control end-user permissions on their Cloud PCs. - **list-autopilot-devices** β€” The Windows autopilot device identities contained collection. TIP: Lists Windows Autopilot device identities. Each has serialNumber, model, manufacturer, groupTag, purchaseOrderIdentifier, enrollmentState, deploymentProfileAssignmentStatus, lastContactedDateTime. Use to audit Autopilot-registered devices and their deployment status. - **get-autopilot-device** β€” The Windows autopilot device identities contained collection. TIP: Gets a specific Autopilot device identity. Returns serialNumber, model, manufacturer, groupTag, enrollmentState, deploymentProfileAssignmentStatus, and assignedDeploymentProfile. - **list-windows-feature-update-profiles** β€” A collection of windows feature update profiles TIP: Lists Windows feature update profiles (Intune > Devices > Windows updates > Feature updates): the Windows version a group is held on or moved to. Each has displayName, featureUpdateVersion (e.g. 'Windows 11, version 24H2'), rolloutSettings {offerStartDateTimeInUTC, offerEndDateTimeInUTC, offerIntervalInDays}, installLatestWindows10OnWindows11IneligibleDevice, installFeatureUpdatesOptional, endOfSupportDate, deployableContentDisplayName. A feature update profile overrides the feature deferral of the device's Windows Update for Business ring, so read both when rings seem to disagree. Use $expand=assignments for target groups. Supports $filter, $top, $skip, $select, $expand, $count. - **list-windows-malware-info** β€” The list of affected malware in the tenant. TIP: Lists Windows malware information detected across Intune-managed devices. Each has displayName, category, severity, additionalInformationUrl, and deviceMalwareStates. Use for threat landscape visibility. - **list-windows-quality-update-policies** β€” A collection of Windows quality update policies TIP: Lists Windows quality update policies (Windows Autopatch hotpatch policies): displayName, description, hotpatchEnabled, roleScopeTagIds, createdDateTime, lastModifiedDateTime. Use $expand=assignments for target groups. Supports $filter, $top, $skip, $select, $expand, $count. - **list-windows-quality-update-profiles** β€” A collection of windows quality update profiles TIP: Lists Windows quality update profiles β€” expedited security updates that bypass the quality deferral of the device's Windows Update for Business ring. Each has displayName, expeditedUpdateSettings {qualityUpdateRelease, daysUntilForcedReboot}, deployableContentDisplayName, releaseDateDisplayName. Use $expand=assignments for target groups. Supports $filter, $top, $skip, $select, $expand, $count. - **list-devices** β€” Retrieve a list of device objects registered in the organization. TIP: Lists all devices registered in the tenant. Use $filter=isCompliant eq false to find non-compliant devices. Use $filter=isManaged eq true for Intune-managed devices. Use $filter=operatingSystem eq 'Windows' to filter by OS. Use $select=displayName,operatingSystem,operatingSystemVersion,isCompliant,isManaged,accountEnabled,approximateLastSignInDateTime. Use $filter=approximateLastSignInDateTime le 2024-01-01T00:00:00Z to find stale devices. - **get-device** β€” Get the properties and relationships of a device object. TIP: Gets a specific device by ID. Returns displayName, operatingSystem, operatingSystemVersion, isCompliant, isManaged, accountEnabled, trustType, approximateLastSignInDateTime, and deviceId. - **list-administrative-units** β€” Retrieve a list of administrativeUnit objects. TIP: Lists all administrative units in the tenant. Administrative units scope admin roles to a subset of users/groups/devices. Use $select=displayName,description,membershipType,membershipRule. membershipType can be 'Assigned' or 'Dynamic'. - **get-administrative-unit** β€” Retrieve the properties and relationships of an administrativeUnit object. The administrativeUnit resource supports extensions, which also allows you to use the GET operation to get custom properties and extension data in an administrativeUnit instance. TIP: Gets a specific administrative unit by ID. Returns displayName, description, membershipType, membershipRule, and visibility. - **list-administrative-unit-members** β€” Use this API to get the members list (users, groups, or devices) in an administrative unit. TIP: Lists members (users, groups, devices) of an administrative unit. Returns directory objects. Use $select=displayName,userPrincipalName for users. - **list-attribute-sets** β€” Get a list of the attributeSet objects and their properties. TIP: Lists custom security attribute sets. Each set is a container of custom security attributes. Has displayName, description, id, maxAttributesPerSet, and isLocked. - **list-custom-security-attributes** β€” Get a list of the customSecurityAttributeDefinition objects and their properties. TIP: Lists custom security attribute definitions. Each has attributeSet, name, type (String, Integer, Boolean), isSearchable, isCollection, usePreDefinedValuesOnly, status (Available, Deprecated), and description. Custom security attributes provide flexible tagging for Entra objects. - **list-deleted-groups** β€” Retrieve a list of recently deleted directory objects from deleted items. The following types are supported: - administrativeUnit - application - agentIdentityBlueprint - agentIdentity - agentIdentityBlueprintPrincipal - agentUser - certificateBasedAuthPki - certificateAuthorityDetail - group - servicePrincipal - user TIP: Lists recently deleted groups (recoverable within 30 days). Only Microsoft 365 groups (unified groups) are soft-deleted and recoverable. Use $select=displayName,deletedDateTime,groupTypes. - **list-deleted-users** β€” Get the items of type microsoft.graph.user in the microsoft.graph.directoryObject collection TIP: Lists recently deleted users (recoverable within 30 days). Use $select=displayName,userPrincipalName,deletedDateTime to see when each user was deleted. Useful for auditing account deletions and potential recovery. - **list-device-local-credentials** β€” Get a list of the deviceLocalCredentialInfo objects and their properties, excluding the credentials property. TIP: Lists device local admin credentials managed by Entra ID (LAPS - Local Admin Password Solution). Each has deviceName, lastBackupDateTime, and refreshDateTime. The actual password requires DeviceLocalCredential.Read.All and a separate GET by ID. RISK LEVEL: HIGH. This response contains secrets or highly sensitive data (e.g. recovery keys, LAPS passwords, legal-hold material). Do not echo verbatim; confirm with the operator before sharing. - **list-federation-configurations** β€” Configure domain federation with organizations whose identity provider (IdP) supports either the SAML or WS-Fed protocol. TIP: Lists federation configurations for the directory. Each has displayName, audiences, issuerUri, metadataExchangeUri, passiveSignInUri, signingCertificateUpdateStatus, and preferredAuthenticationProtocol. - **list-on-premises-sync** β€” Read the properties and relationships of an onPremisesDirectorySynchronization object. TIP: Lists on-premises directory synchronization (Entra Connect) configurations. Returns features enabled (passwordHashSync, passwordWriteback, seamlessSSO, cloudSync), configuration details, and sync status. - **list-directory-roles** β€” List the directory roles that are activated in the tenant. This operation only returns roles that have been activated. A role becomes activated when an admin activates the role using the Activate directoryRole API. Not all built-in roles are initially activated. When assigning a role using the Microsoft Entra admin center, the role activation step is implicitly done on the admin's behalf. To get the full list of roles that are available in Microsoft Entra ID, use List directoryRoleTemplates. TIP: Lists activated directory roles in the tenant. Only roles that have been activated (have at least one member) appear here. Use $expand=members to see who holds each role. Key roles to audit: Global Administrator, Privileged Role Administrator, Security Administrator. - **list-role-members** β€” Retrieve the list of principals that are assigned to the directory role. You can use both the object ID and template ID of the directoryRole with this API. The template ID of a built-in role is immutable and can be seen in the role description on the Microsoft Entra admin center. For details, see Role template IDs. TIP: Lists members of a specific directory role. Use this to audit who has Global Admin, Exchange Admin, etc. Returns user and servicePrincipal objects. - **list-domains** β€” Retrieve a list of domain objects. TIP: Lists all domains registered in the tenant. Shows isVerified, isDefault, authenticationType (Managed vs Federated). Useful for auditing federated domains and finding unverified domains. - **get-drive-item** β€” All items contained in the drive. Read-only. Nullable. TIP: Gets metadata for a specific driveItem (file or folder) by id. Returns name, size, file/folder facet, createdBy, lastModifiedBy, timestamps, webUrl, and @microsoft.graph.downloadUrl (a short-lived, pre-authenticated link to download file content without an auth header). RISK LEVEL: MEDIUM. This response contains PII or authentication metadata (sign-ins, MFA factors, mail metadata, risk detections). Handle with care and avoid casual disclosure. - **list-drive-children** β€” Return a collection of DriveItems in the children relationship of a DriveItem. DriveItems with a non-null folder or package facet can have one or more child DriveItems. TIP: Lists the children (files and subfolders) of a driveItem in a drive. For the top level, pass the root item id from get-drive-root. Each child returns id, name, size, file/folder facet, createdDateTime, lastModifiedDateTime, webUrl, and @microsoft.graph.downloadUrl for files. Recurse by calling again with a child folder's id. Supports $top, $select, $orderby. RISK LEVEL: MEDIUM. This response contains PII or authentication metadata (sign-ins, MFA factors, mail metadata, risk detections). Handle with care and avoid casual disclosure. - **get-drive-root** β€” The root folder of the drive. Read-only. TIP: Gets the root folder driveItem of a drive (from get-user-drive). Returns the root item id, name, folder.childCount, and webUrl. Pass the root item id to list-drive-children to enumerate top-level files and folders. RISK LEVEL: MEDIUM. This response contains PII or authentication metadata (sign-ins, MFA factors, mail metadata, risk detections). Handle with care and avoid casual disclosure. - **list-groups** β€” List all the groups available in an organization, excluding dynamic distribution groups. To retrieve dynamic distribution groups, use the Exchange admin center. This operation returns by default only a subset of the properties for each group. These default properties are noted in the Properties section. To get properties that are not returned by default, do a GET operation for the group and specify the properties in a $select OData query option. The hasMembersWithLicenseErrors and isArchived properties are an exception and are not returned in the $select query. TIP: Lists all groups. Use $filter=groupTypes/any(c:c eq 'Unified') for Microsoft 365 groups. Use $filter=securityEnabled eq true for security groups. Use $filter=onPremisesSyncEnabled eq true for hybrid-synced groups. Use $select=displayName,mail,groupTypes,securityEnabled,membershipRule to get key fields. - **get-group** β€” Get the properties and relationships of a group object. This operation returns by default only a subset of all the available properties, as noted in the Properties section. To get properties that aren't_ returned by default, specify them in a $select OData query option. The hasMembersWithLicenseErrors and isArchived properties are an exception and aren't returned in the $select query. TIP: Gets a single group by ID. Use $select=displayName,description,groupTypes,securityEnabled,membershipRule,membershipRuleProcessingState for policy details. - **list-group-members** β€” Get a list of the group's direct members. A group can have users, organizational contacts, devices, service principals and other groups as members. This operation is not transitive. TIP: Lists members of a group. Returns user and servicePrincipal objects. Use $select=displayName,userPrincipalName,id. Use $top to paginate. For large groups, use $count=true with ConsistencyLevel=eventual header. - **list-group-owners** β€” Retrieve a list of the group's owners. The owners are a set of users or service principals who are allowed to modify the group object. Owners are currently not available in Microsoft Graph for groups that were created in Exchange, distribution groups, or groups that are synchronized from an on-premises environment. TIP: Lists owners of a group. Useful for auditing ownerless groups. Returns user objects. - **list-api-connectors** β€” Read the properties of an identityApiConnector object. TIP: Lists API connectors used in self-service sign-up user flows. Each has displayName, targetUrl, and authenticationConfiguration. API connectors call external APIs during sign-up (e.g. for validation, enrichment, or approval). Audit these to ensure no unauthorized external endpoints are called. - **get-api-connector** β€” Read the properties of an identityApiConnector object. TIP: Gets a specific API connector. Returns displayName, targetUrl, and authenticationConfiguration (basic auth or client certificate). - **list-b2x-user-flows** β€” Retrieve a list of b2xIdentityUserFlow objects. TIP: Lists B2X (self-service sign-up) user flows. Each has id, userFlowType (signUpOrSignIn), userFlowTypeVersion, and apiConnectorConfiguration. B2X user flows control how external users can sign up as guests through self-service. - **get-b2x-user-flow** β€” Retrieve the properties and relationships of a b2xIdentityUserFlow object. TIP: Gets a specific B2X user flow. Returns full configuration including apiConnectorConfiguration, identityProviders, userAttributeAssignments, and languages. - **get-auth-strength-policy** β€” A collection of authentication strength policies that exist for this tenant, including both built-in and custom policies. TIP: Gets a specific authentication strength policy by ID. RISK LEVEL: LOW. - **list-named-locations** β€” Get a list of namedLocation objects. TIP: Lists named locations used in Conditional Access policies. Shows trusted IP ranges and country-based locations. Useful for auditing geographic access controls. - **list-conditional-access-policies** β€” Retrieve a list of conditionalAccessPolicy objects. TIP: Lists all Conditional Access policies. Each policy has displayName, state (enabled/disabled/enabledForReportingButNotEnforced), conditions (users, applications, locations, platforms, signInRiskLevels), and grantControls (MFA, compliant device, etc.). Use this to audit MFA enforcement and access controls. - **get-conditional-access-policy** β€” Retrieve the properties and relationships of a conditionalAccessPolicy object. TIP: Gets a single Conditional Access policy by ID. Returns full policy details including conditions, grantControls, and sessionControls. - **list-conditional-access-templates** β€” Get a list of the conditionalAccessTemplate objects and their properties. TIP: Lists Conditional Access policy templates provided by Microsoft. Templates can be used as starting points for new policies. Returns id, name, description, scenarios, details. - **list-custom-auth-extensions** β€” Get a list of the customAuthenticationExtension objects and their properties. The following derived types are supported. TIP: Lists custom authentication extensions. These are webhook-based extensions that can be called during authentication flows (token issuance, attribute collection). Each has displayName, @odata.type, authenticationConfiguration, endpointConfiguration (targetUrl). Audit these to ensure no unauthorized custom logic in auth flows. - **get-custom-auth-extension** β€” Read the properties and relationships of a customAuthenticationExtension object. The following derived types are currently supported. TIP: Gets a specific custom authentication extension. Returns displayName, authenticationConfiguration, endpointConfiguration, and claimsForTokenConfiguration. - **list-identity-providers** β€” Get a collection of identity provider resources that are configured for a tenant, and that are derived from identityProviderBase. For a Microsoft Entra tenant, the providers can be socialIdentityProviders or builtinIdentityProviders objects. For an Azure AD B2C, the providers can be socialIdentityProvider, or appleManagedIdentityProvider objects. TIP: Lists identity providers configured for the tenant. Includes social providers (Google, Facebook, Apple), SAML/WS-Fed, and built-in providers (Azure AD, Microsoft Account). Each has displayName, @odata.type, clientId. Useful for auditing which external identity providers are trusted for B2B/B2C. - **get-identity-provider** β€” Get the properties and relationships of the specified identity provider configured in the tenant. Among the types of providers derived from identityProviderBase, you can currently get a socialIdentityProvider or a builtinIdentityProvider resource in Microsoft Entra ID. In Azure AD B2C, this operation can currently get a socialIdentityProvider, or an appleManagedIdentityProvider resource. TIP: Gets a specific identity provider. Returns displayName, @odata.type, clientId, and provider-specific configuration. - **list-access-review-definitions** β€” Get a list of the accessReviewScheduleDefinition objects and their properties. TIP: Lists all access review schedule definitions. Each definition has displayName, status (NotStarted, InProgress, Completed, Applied), scope (what is being reviewed: group members, app role assignments, etc.), reviewers, and settings (autoApplyDecisions, mailNotificationsEnabled, recurrence). Use $filter=status eq 'InProgress' to find active reviews. - **get-access-review-definition** β€” Read the properties and relationships of an accessReviewScheduleDefinition object. To retrieve the instances of the access review series, use the list accessReviewInstance API. TIP: Gets a specific access review schedule definition by ID. Returns full configuration including scope, reviewers, fallbackReviewers, settings, stageSettings, and instances. - **list-access-review-instances** β€” Get a list of the accessReviewInstance objects and their properties. TIP: Lists instances of an access review definition. Each recurring review creates instances. Each instance has status, startDateTime, endDateTime, and scope. Use to track review progress over time. - **get-access-review-instance** β€” Read the properties and relationships of an accessReviewInstance object. TIP: Gets a specific access review instance. Returns status, startDateTime, endDateTime, scope, and reviewers for this particular execution of the review. - **list-access-review-decisions** β€” Retrieve the accessReviewInstanceDecisionItem objects for a specific accessReviewInstance. A list of zero or more accessReviewInstanceDecisionItem objects are returned, including all of their nested properties. TIP: Lists decisions made during an access review instance. Each decision has target (user/group), decision (Approve, Deny, NotReviewed, DontKnow), reviewedBy, justification, and appliedDateTime. Use to audit review outcomes and ensure decisions were applied. - **list-access-review-history** β€” Retrieve the accessReviewHistoryDefinition objects created in the last 30 days, including all nested properties. TIP: Lists access review history definitions. These are scheduled exports of access review decisions. Each has displayName, reviewHistoryPeriodStartDateTime, reviewHistoryPeriodEndDateTime, status, and decisions (approve, deny, dontKnow, notReviewed). - **list-app-consent-requests** β€” Retrieve appConsentRequest objects and their properties. TIP: Lists app consent requests. When users request access to apps that require admin consent, those requests appear here. Each has appId, appDisplayName, and pendingScopes. Use to review and manage pending consent requests. - **get-app-consent-request** β€” Read the properties and relationships of an appConsentRequest object. TIP: Gets a specific app consent request. Returns appId, appDisplayName, pendingScopes, and linked userConsentRequests showing which users requested access. - **list-user-consent-requests** β€” Retrieve a collection of userConsentRequest objects and their properties. TIP: Lists user consent requests for a specific app consent request. Each has createdBy, status (Submitted, InProgress, Completed), and reason. Shows which individual users requested consent for the app. - **list-access-packages** β€” Retrieve a list of accessPackage objects. The resulting list includes all the access packages that the caller has access to read, across all catalogs. TIP: Lists all access packages in entitlement management. Each package bundles resources (group memberships, app roles, SharePoint sites) that can be requested. Use $select=displayName,description,isHidden,createdDateTime,modifiedDateTime. Use $expand=catalog to see which catalog each package belongs to. - **get-access-package** β€” Retrieve the properties and relationships of an accessPackage object. TIP: Gets a specific access package by ID. Use $expand=resourceRoleScopes($expand=role,scope) to see what resources the package grants access to. - **list-entitlement-assignment-policies** β€” Retrieve a list of accessPackageAssignmentPolicy objects in Microsoft Entra entitlement management. If the delegated user is in a directory role, the resulting list includes all the assignment policies that the caller has access to read, across all catalogs and access packages. If the delegated user is an access package manager or catalog owner, they should instead retrieve the policies for the access packages they can read with list accessPackages by including $expand=assignmentPolicies as a query parameter. TIP: Lists entitlement management assignment policies. Each defines who can request an access package, approval requirements, and access review settings. Has displayName, accessPackageId, requestApprovalSettings, requestorSettings, and reviewSettings. - **list-access-package-requests** β€” In Microsoft Entra entitlement management, retrieve a list of accessPackageAssignmentRequest objects. The resulting list includes all the assignment requests, current and well as expired, that the caller has access to read, across all catalogs and access packages. TIP: Lists access package assignment requests. Use $filter=state eq 'submitted' to find pending requests. Each request has requestType (UserAdd, AdminAdd, AdminRemove), state (submitted, approved, denied, delivering, delivered, deliveryFailed), createdDateTime, and schedule. - **list-access-package-assignments** β€” In Microsoft Entra entitlement management, retrieve a list of accessPackageAssignment objects. For directory-wide administrators, the resulting list includes all the assignments, current and well as expired, that the caller has access to read, across all catalogs and access packages. If the caller is on behalf of a delegated user who is assigned only to catalog-specific delegated administrative roles, the request must supply a filter to indicate a specific access package, such as: $filter=accessPackage/id eq 'a914b616-e04e-476b-aa37-91038f0b165b'. TIP: Lists access package assignments β€” who has been granted which access packages. Use $filter=state eq 'Delivered' to find active assignments. Use $filter=targetId eq '{user-id}' to find all packages assigned to a user. Use $expand=target,accessPackage to get user and package details. Each assignment has state (Delivering, Delivered, Expired, DeliveryFailed), schedule, and targetId. - **list-access-package-catalogs** β€” Retrieve a list of accessPackageCatalog objects. TIP: Lists access package catalogs. Catalogs are containers for access packages and their resources. Each has displayName, description, catalogType (UserManaged, ServiceDefault), state (published, unpublished), isExternallyVisible, and createdDateTime. - **list-connected-organizations** β€” Retrieve a list of connectedOrganization objects. TIP: Lists connected organizations in entitlement management. Connected organizations represent external organizations whose users can request access packages. Each has displayName, description, state (configured, proposed), identitySources (tenant IDs, domains), and createdDateTime. - **list-entitlement-resource-environments** β€” Retrieve a list of accessPackageResourceEnvironment objects and their properties. TIP: Lists resource environments in entitlement management. Environments represent connected systems (like other tenants) that provide resources for access packages. - **list-entitlement-resources** β€” The resources associated with the catalogs. TIP: Lists resources available in entitlement management catalogs. Resources are groups, apps, or SharePoint sites that can be included in access packages. - **get-entitlement-management-settings** β€” Retrieve the properties of an entitlementManagementSettings object. TIP: Gets entitlement management settings for the tenant. Returns externalUserLifecycleAction (None, BlockSignIn, BlockSignInAndDelete), daysUntilExternalUserDeletedAfterBlocked, and isB2BExternalCollab settings. - **list-lifecycle-custom-task-extensions** β€” Get a list of the customTaskExtension objects and their properties. TIP: Lists custom task extensions for lifecycle workflows. These are Logic App-based custom actions that can be added to workflow steps. Each has displayName, endpointConfiguration, callbackConfiguration, and createdDateTime. - **list-deleted-lifecycle-workflows** β€” Get a list of deleted workflow objects and their properties from the deletedItemContainer. TIP: Lists recently deleted lifecycle workflows. Deleted workflows can be restored within 30 days. Each has displayName, category, deletedDateTime. - **get-lifecycle-workflow-settings** β€” Read the properties and relationships of a lifecycleManagementSettings object. TIP: Gets lifecycle workflows global settings. Returns workflowScheduleIntervalInHours (how often workflows are evaluated) and emailSettings. - **list-lifecycle-task-definitions** β€” Get a list of built-in tasks in Lifecycle Workflows. A task is represented by the taskDefinition object. TIP: Lists available task definitions for lifecycle workflows. Each has displayName, description, category (joiner, leaver), and parameters. Examples: Send welcome email, Add user to group, Remove user from group, Disable user account, Delete user. - **list-lifecycle-workflows** β€” Get a list of workflow resources that are associated with Lifecycle Workflows. TIP: Lists lifecycle workflows (joiner, mover, leaver). Each workflow has displayName, description, category (joiner, mover, leaver), isEnabled, isSchedulingEnabled, executionConditions (scope, trigger), and tasks. Useful for auditing automated onboarding/offboarding processes. - **get-lifecycle-workflow** β€” Read the properties and relationships of a workflow object. TIP: Gets a specific lifecycle workflow by ID. Returns full details including tasks, executionConditions, lastModifiedDateTime, and version. Use $expand=tasks to see all tasks in the workflow. - **list-lifecycle-workflow-templates** β€” Get a list of the workflowTemplate objects and their properties. TIP: Lists available lifecycle workflow templates. Templates provide pre-built workflows for common scenarios (onboarding, offboarding, job change). Each has displayName, description, category (joiner, leaver, mover), and executionConditions. - **list-pim-group-assignment-instances** β€” Get a list of the privilegedAccessGroupAssignmentScheduleInstance objects and their properties. TIP: Lists active PIM for Groups assignment instances. Shows who currently has active (not just eligible) group membership/ownership via PIM. Has principalId, groupId, accessId, assignmentType (assigned, activated), startDateTime, endDateTime. REQUIRED: this route rejects an unfiltered call with HTTP 400 MissingParameters β€” you must pass $filter on principalId or groupId (a filter on accessId alone is not enough). Verified against the live service 2026-07-31. - **list-pim-group-assignment-requests** β€” Get a list of the privilegedAccessGroupAssignmentScheduleRequest objects and their properties. TIP: Lists PIM for Groups assignment schedule requests. Each request represents an activation or assignment operation. Has action (adminAssign, adminRemove, selfActivate, selfDeactivate), principalId, groupId, accessId (member, owner), scheduleInfo, and status. - **list-pim-group-assignment-schedules** β€” Get a list of the privilegedAccessGroupAssignmentSchedule objects and their properties. TIP: Lists PIM for Groups assignment schedules. Shows active role assignments on privileged groups (member or owner). Each has principalId, groupId, accessId (member, owner), status, scheduleInfo (startDateTime, expiration). Use to audit who has permanent access to privileged groups. REQUIRED: this route rejects an unfiltered call with HTTP 400 MissingParameters β€” you must pass $filter on principalId or groupId (a filter on accessId alone is not enough). Verified against the live service 2026-07-31. - **list-pim-group-eligibility-instances** β€” Get a list of the privilegedAccessGroupEligibilityScheduleInstance objects and their properties. TIP: Lists active PIM for Groups eligibility instances. Shows who is currently eligible to activate group membership/ownership. Has principalId, groupId, accessId, startDateTime, endDateTime, and memberType. REQUIRED: this route rejects an unfiltered call with HTTP 400 MissingParameters β€” you must pass $filter on principalId or groupId (a filter on accessId alone is not enough). Verified against the live service 2026-07-31. - **list-pim-group-eligibility-requests** β€” Get a list of the privilegedAccessGroupEligibilityScheduleRequest objects and their properties. TIP: Lists PIM for Groups eligibility schedule requests. Shows requests to make users eligible for group membership/ownership. Has action, principalId, groupId, accessId, scheduleInfo, and status. - **list-pim-group-eligibility-schedules** β€” Get a list of the privilegedAccessGroupEligibilitySchedule objects and their properties. TIP: Lists PIM for Groups eligibility schedules. Shows who is eligible (but not yet activated) for membership or ownership on privileged groups. Each has principalId, groupId, accessId (member, owner), status, scheduleInfo. Compare with assignment schedules to see eligible vs active. REQUIRED: this route rejects an unfiltered call with HTTP 400 MissingParameters β€” you must pass $filter on principalId or groupId (a filter on accessId alone is not enough). Verified against the live service 2026-07-31. - **list-terms-of-use-agreements** β€” Retrieve a list of agreement objects. TIP: Lists terms of use agreements. Each agreement has displayName, isPerDeviceAcceptanceRequired, isViewingBeforeAcceptanceRequired, userReexpireFrequency, and termsExpiration. Useful for auditing compliance with organizational policies. - **get-terms-of-use-agreement** β€” Retrieve the properties and relationships of an agreement object. TIP: Gets a specific terms of use agreement. Returns full details including acceptance status configuration and file content. - **list-terms-of-use-acceptances** β€” Get the details about the acceptance records for a specific agreement. TIP: Lists acceptances for a terms of use agreement. Each acceptance has userId, userDisplayName, userPrincipalName, state (accepted, declined), recordedDateTime, and expirationDateTime. Useful for compliance reporting on who has accepted terms. - **list-risk-detections** β€” Get a list of the riskDetection objects and their properties. TIP: Lists individual risk detections from Identity Protection. Use $filter=riskLevel eq 'high' to find high-risk events. Use $filter=detectedDateTime ge 2024-01-01T00:00:00Z to filter by date. Each detection has riskEventType (e.g. anonymizedIPAddress, leakedCredentials, malwareInfectedIPAddress), riskLevel, riskState, userPrincipalName, ipAddress, location, and activityType (signin, user). RISK LEVEL: MEDIUM. This response contains PII or authentication metadata (sign-ins, MFA factors, mail metadata, risk detections). Handle with care and avoid casual disclosure. - **get-risk-detection** β€” Read the properties and relationships of a riskDetection object. TIP: Gets a specific risk detection by ID. Returns full details including riskEventType, riskLevel, detectionTimingType (realtime, offline), source, ipAddress, location, userPrincipalName, and additionalInfo. RISK LEVEL: MEDIUM. This response contains PII or authentication metadata (sign-ins, MFA factors, mail metadata, risk detections). Handle with care and avoid casual disclosure. - **list-risky-service-principals** β€” Retrieve the properties and relationships of riskyServicePrincipal objects. TIP: Lists service principals flagged as risky. Useful for detecting compromised applications and service accounts. RISK LEVEL: MEDIUM. This response contains PII or authentication metadata (sign-ins, MFA factors, mail metadata, risk detections). Handle with care and avoid casual disclosure. - **get-risky-service-principal** β€” Read the properties and relationships of a riskyServicePrincipal object. TIP: Gets details for a specific risky service principal. Returns riskLevel, riskState, and riskDetail. RISK LEVEL: MEDIUM. This response contains PII or authentication metadata (sign-ins, MFA factors, mail metadata, risk detections). Handle with care and avoid casual disclosure. - **list-risky-users** β€” Get a list of the riskyUser objects and their properties. TIP: Lists users flagged as risky by Identity Protection. Use $filter=riskLevel eq 'high' to find high-risk users. Each entry has riskLevel (low, medium, high), riskState (atRisk, confirmedCompromised, remediated, dismissed), riskDetail, and riskLastUpdatedDateTime. RISK LEVEL: MEDIUM. This response contains PII or authentication metadata (sign-ins, MFA factors, mail metadata, risk detections). Handle with care and avoid casual disclosure. - **get-risky-user** β€” Read the properties and relationships of a riskyUser object. TIP: Gets details for a specific risky user. Returns full risk information including riskLevel, riskState, riskDetail, and history. RISK LEVEL: MEDIUM. This response contains PII or authentication metadata (sign-ins, MFA factors, mail metadata, risk detections). Handle with care and avoid casual disclosure. - **list-risky-user-history** β€” Get the riskyUserHistoryItems from the history navigation property. TIP: Lists the risk history for a specific user. Shows how risk level changed over time and what triggered each risk event. RISK LEVEL: MEDIUM. This response contains PII or authentication metadata (sign-ins, MFA factors, mail metadata, risk detections). Handle with care and avoid casual disclosure. - **list-service-principal-risk-detections** β€” Retrieve the properties of a collection of servicePrincipalRiskDetection objects. TIP: Lists risk detections for service principals. Each has riskEventType, riskLevel, riskState, riskDetail, detectedDateTime, activity, source, servicePrincipalId, and appId. Use $filter=riskState eq 'atRisk' to see active risks. RISK LEVEL: MEDIUM. This response contains PII or authentication metadata (sign-ins, MFA factors, mail metadata, risk detections). Handle with care and avoid casual disclosure. - **list-bitlocker-recovery-keys** β€” Get a list of the bitlockerRecoveryKey objects and their properties. This operation doesn't return the key property. For information about how to read the key property, see Get bitlockerRecoveryKey. You can use this API to programmatically iterate through the list of recovery keys in the tenant and identify devices with BitLocker enabled. For more information, see the sample PowerShell code in BitLocker recovery process. TIP: Lists BitLocker recovery keys stored in Entra ID. Each has id, createdDateTime, deviceId, volumeType (operatingSystemVolume, fixedDataVolume, removableDataVolume). The actual key value is NOT returned by default for security; use $select=key to include it (requires BitlockerKey.ReadBasic.All or BitlockerKey.Read.All). Use $filter=deviceId eq 'xxx' to find keys for a specific device. RISK LEVEL: HIGH. This response contains secrets or highly sensitive data (e.g. recovery keys, LAPS passwords, legal-hold material). Do not echo verbatim; confirm with the operator before sharing. - **list-threat-assessment-requests** β€” Retrieve a list of threatAssessmentRequest objects. A threat assessment request can be one of the following types: TIP: Lists threat assessment requests. Each has id, createdDateTime, contentType (mail, url, file), expectedAssessment (block, unblock), category (spam, phishing, malware), status (pending, completed), requestSource, createdBy, and results (with resultType and message). Use $top to limit. - **list-invitations** β€” Get entities from invitations TIP: Lists guest user invitations. Each has invitedUserEmailAddress, invitedUserDisplayName, inviteRedeemUrl, status (PendingAcceptance, Completed, InProgress, Error), sendInvitationMessage, and invitedUserType (Guest, Member). Use to audit pending and completed B2B invitations. - **list-oauth2-grants** β€” Retrieve a list of oAuth2PermissionGrant objects, representing delegated permissions which have been granted for client applications to access APIs on behalf of signed-in users. TIP: Lists all delegated permission grants (OAuth2 consent). Shows which apps have been granted what permissions by whom (admin consent vs user consent). Use $filter=consentType eq 'AllPrincipals' to find admin-consented grants. Critical for auditing overpermissioned apps. - **get-organization** β€” Retrieve a list of organization objects. There's only one organization object in the collection. TIP: Gets tenant organization info. Returns displayName, verifiedDomains, securityComplianceNotificationPhones, technicalNotificationMails, tenantType. Useful for basic tenant identity verification. - **list-activity-timeout-policies** β€” Get a list of activityBasedTimeoutPolicy objects. TIP: Lists activity-based timeout policies. These enforce idle session timeout for web applications. Each has displayName, isOrganizationDefault, and definition (JSON with ActivityBasedTimeoutPolicy settings). - **get-admin-consent-policy** β€” Read the properties and relationships of an adminConsentRequestPolicy object. TIP: Gets the admin consent request policy. Shows isEnabled, notifyReviewers, remindersEnabled, and reviewers list. Controls whether users can request admin consent for apps they want to use. - **list-app-management-policies** β€” Retrieve a list of appManagementPolicy objects. TIP: Lists app management policies. These policies restrict credential types and lifetimes for app registrations and service principals. Each has displayName, isEnabled, restrictions (passwordCredentials, keyCredentials with restrictForAppsCreatedAfterDateTime and maxLifetime). Useful for enforcing credential hygiene. - **get-app-management-policy** β€” Read the properties of an appManagementPolicy object. TIP: Gets a specific app management policy. Returns displayName, isEnabled, and detailed restrictions on password and key credentials including maxLifetime and restrictForAppsCreatedAfterDateTime. - **get-auth-flows-policy** β€” Read the properties and relationships of an authenticationFlowsPolicy object. TIP: Gets the authentication flows policy. Returns selfServiceSignUp configuration (isEnabled) which controls whether external users can sign up via user flows. - **get-auth-methods-policy** β€” Read the properties and relationships of an authenticationMethodsPolicy object. TIP: Gets the tenant authentication methods policy. Shows which authentication methods are enabled (FIDO2, Microsoft Authenticator, SMS, etc.) and their configuration. Critical for auditing MFA enforcement. - **list-auth-method-configs** β€” Read the properties and relationships of an externalAuthenticationMethodConfiguration object. TIP: Lists all authentication method configurations. Each has id (method type), state (enabled/disabled), and method-specific settings. Useful to verify FIDO2, Authenticator, and passwordless policies. - **get-auth-method-config** β€” Read the properties and relationships of an externalAuthenticationMethodConfiguration object. TIP: Gets a specific authentication method configuration. IDs include: microsoftAuthenticator, fido2, email, sms, temporaryAccessPass, x509Certificate, etc. - **list-auth-strength-policies** β€” Get a list of the authenticationStrengthPolicy objects and their properties. This API returns both built-in and custom policies. TIP: Lists authentication strength policies. These define which MFA method combinations are acceptable (e.g. phishing-resistant MFA, passwordless). Built-in policies include 'MFA', 'Passwordless MFA', and 'Phishing-resistant MFA'. Custom policies can restrict to specific methods. Used by Conditional Access grant controls. - **get-authorization-policy** β€” Retrieve the properties of an authorizationPolicy object. TIP: Gets the tenant authorization policy. Returns allowedToSignUpEmailBasedSubscriptions, allowedToUseSSPR, allowEmailVerifiedUsersToJoinOrganization, allowInvitesFrom, blockMsolPowerShell, defaultUserRolePermissions (allowedToCreateApps, allowedToCreateSecurityGroups, allowedToReadBitlockerKeysForOwnedDevice, allowedToReadOtherUsers), and guestUserRoleId. - **list-claims-mapping-policies** β€” Get a list of claimsMappingPolicy objects. TIP: Lists claims mapping policies. These customize token claims for specific applications. Each has displayName, isOrganizationDefault, and definition (JSON with ClaimsMappingPolicy including IncludeBasicClaimSet and ClaimsSchema). - **list-conditional-access-policies-v2** β€” The custom rules that define an access scenario. TIP: Lists all conditional access policies using the policies endpoint. Each has displayName, state (enabled, disabled, enabledForReportingButNotEnforced), conditions, grantControls, and sessionControls. Alternative to list-conditional-access-policies. - **get-cross-tenant-access-policy** β€” Read the properties and relationships of a crossTenantAccessPolicy object. TIP: Gets the cross-tenant access policy. Controls B2B collaboration and B2B direct connect defaults. Returns allowedCloudEndpoints and default inbound/outbound settings for users, applications, and organizations. - **get-cross-tenant-default-policy** β€” Read the default configuration of a cross-tenant access policy. This default configuration may be the service default assigned by Microsoft Entra ID (isServiceDefault is true) or may be customized in your tenant (isServiceDefault is false). TIP: Gets the default cross-tenant access policy. Returns the default inbound/outbound settings (b2bCollaboration, b2bDirectConnect, organizationDefault) that apply to all tenants not covered by a partner-specific policy. Critical for controlling external collaboration defaults. - **list-cross-tenant-partners** β€” Get a list of all partner configurations within a cross-tenant access policy. You can also use the $expand parameter to list the user synchronization policy for all partner configurations. TIP: Lists partner-specific cross-tenant access configurations. Each entry has tenantId and overrides for inbound/outbound B2B collaboration and direct connect settings. Useful for auditing which external organizations have special access. - **get-default-app-management-policy** β€” Read the properties of a tenantAppManagementPolicy object. TIP: Gets the default app management policy for the tenant. Returns the default restrictions on password and key credentials for app registrations and service principals when no specific policy is assigned. - **get-device-registration-policy** β€” Read the properties and relationships of a deviceRegistrationPolicy object. Represents deviceRegistrationPolicy quota restrictions, additional authentication, and authorization policies to register device identities to your organization. TIP: Gets the device registration policy. Returns multiFactorAuthConfiguration, azureADRegistration (allowedToRegister, isAdminConfigurable), azureADJoin (allowedToJoin, isAdminConfigurable), and localAdminPassword settings. Critical for controlling which users can join/register devices. - **list-feature-rollout-policies** β€” Retrieve a list of featureRolloutPolicy objects. TIP: Lists feature rollout policies. These enable staged rollout of Entra ID features (like passwordHashSync, seamlessSSO, passthroughAuthentication) to specific groups before tenant-wide enablement. Each has displayName, feature, isEnabled, and isAppliedToOrganization. - **list-home-realm-discovery-policies** β€” Get a list of homeRealmDiscoveryPolicy objects. TIP: Lists home realm discovery policies. These control authentication behavior for federated domains (auto-acceleration, preferred domain, etc.). Each has displayName, isOrganizationDefault, and definition (JSON with HomeRealmDiscoveryPolicy). - **get-security-defaults** β€” Retrieve the properties of an identitySecurityDefaultsEnforcementPolicy object. TIP: Gets the security defaults policy. Returns isEnabled (true/false). Security defaults enforce MFA for all users, block legacy auth, and require MFA for admin roles. Should be disabled only if Conditional Access is used instead. - **list-permission-grant-policies** β€” Retrieve the list of permissionGrantPolicy objects. TIP: Lists permission grant policies. These control which permissions users/admins can consent to. Each has displayName, includes (conditions that match), and excludes (conditions that block). Critical for app consent security. - **list-role-management-policies** β€” Get the details of the policies in PIM that can be applied to Microsoft Entra roles or group membership or ownership. To retrieve policies that apply to Azure RBAC, use the Azure REST PIM API for role management policies. TIP: Lists PIM role management policies. Each policy defines activation rules (MFA, justification, approval, max duration), assignment rules (permanent eligible/active, expiration), and notification rules for a specific role. Use $expand=rules to see all settings. - **list-role-management-policy-assignments** β€” Get the details of all role management policy assignments made in PIM for Microsoft Entra roles and PIM for Groups. TIP: Lists PIM role management policy assignments. Links policies to specific roles. Each has policyId, scopeId, scopeType, and roleDefinitionId. Use $expand=policy($expand=rules) to include the full policy details. - **list-token-issuance-policies** β€” Get a list of tokenIssuancePolicy objects. TIP: Lists token issuance policies. These control how SAML tokens are issued (token format, signing algorithm, etc.). Each has displayName, isOrganizationDefault, and definition. - **list-token-lifetime-policies** β€” Get a list of tokenLifetimePolicy objects. TIP: Lists token lifetime policies. These override default token lifetimes for specific applications. Each has displayName, isOrganizationDefault, and definition (JSON with TokenLifetimePolicy including AccessTokenLifetime and MaxAgeSessionSingleFactor). - **list-print-connectors** β€” Retrieve a list of print connectors. TIP: Lists Universal Print connectors. Each has displayName, fullyQualifiedDomainName, operatingSystem, appVersion, deviceHealth (lastConnectionTime), location, and registeredDateTime. Connectors bridge on-premises printers to Universal Print. - **list-print-operations** β€” Retrieve the properties and relationships of a printOperation object. TIP: Lists long-running Universal Print operations. Each has status (state: notStarted, running, succeeded, failed), createdDateTime, and lastActionDateTime. - **list-printers** β€” Retrieve the list of printers that are registered in the tenant. TIP: Lists printers registered in Universal Print. Each has displayName, manufacturer, model, status (state: idle, processing, stopped, unknownFutureValue), isShared, isAcceptingJobs, location, defaults, and capabilities. Use $filter to narrow results. - **list-print-services** β€” Retrieve a list of printService objects that represent the services available to your tenant. TIP: Lists Universal Print service instances. Each has endpoints with displayName and uri. These represent the service endpoints used by Universal Print. - **list-print-shares** β€” Retrieve a list of printerShares. TIP: Lists printer shares in Universal Print. Each has displayName, createdDateTime, isAcceptingJobs, status, printer, and allowedUsers/allowedGroups. Printer shares make printers discoverable to users. - **list-print-task-definitions** β€” Retrieve a list of task definitions that the requesting app defined in the tenant. For details about how to use this API to add pull printing support to Universal Print, see Extending Universal Print to support pull printing. TIP: Lists Universal Print task definitions. Task definitions describe tasks that can be triggered on various print events (e.g., jobStarted). - **list-user-registration-details** β€” Get a list of the authentication methods registered for a user as defined in the userRegistrationDetails object. This method doesn't work for disabled users. TIP: Lists MFA/SSPR registration details for all users. Each has userPrincipalName, userDisplayName, isMfaRegistered, isMfaCapable, isSsprRegistered, isSsprEnabled, isSsprCapable, isPasswordlessCapable, methodsRegistered, and defaultMfaMethod. Powerful for MFA adoption reporting. RISK LEVEL: MEDIUM. This response contains PII or authentication metadata (sign-ins, MFA factors, mail metadata, risk detections). Handle with care and avoid casual disclosure. - **list-daily-print-usage-by-printer** β€” Retrieve a list of daily print usage summaries, grouped by printer. TIP: Lists daily Universal Print usage summarized by printer. Each has printerName, printerId, usageDate, completedBlackAndWhiteJobCount, completedColorJobCount, incompleteJobCount, and pagesPrinted. - **list-daily-print-usage-by-user** β€” Retrieve a list of daily print usage summaries, grouped by user. TIP: Lists daily Universal Print usage summarized by user. Each has userPrincipalName, usageDate, completedBlackAndWhiteJobCount, completedColorJobCount, incompleteJobCount, and pagesPrinted. - **get-email-activity-report** β€” Enables you to understand the trends of email activity (like how many were sent, read, and received) in your organization. TIP: Gets email activity counts for the specified period. The period parameter must be one of: D7, D30, D90, D180. Returns CSV data with daily counts of send, receive, and read email activities. - **get-m365-apps-usage-report** β€” Get a report that provides the details about which apps and platforms users have used. TIP: Gets Microsoft 365 Apps usage details per user. The period parameter must be one of: D7, D30, D90, D180. Returns CSV data showing which apps each user used (Outlook, Word, Excel, PowerPoint, OneNote, Teams) and on which platforms (Windows, Mac, Web, Mobile). - **get-mailbox-usage-report** β€” Get details about mailbox usage. TIP: Gets mailbox usage details per user. The period parameter must be one of: D7, D30, D90, D180. Returns CSV data with userPrincipalName, displayName, storageUsedInBytes, issueWarningQuotaInBytes, prohibitSendQuotaInBytes, itemCount, lastActivityDate. - **get-active-user-counts-report** β€” Get the count of daily active users in the reporting period by product. TIP: Gets daily active user counts across Microsoft 365 services. The period parameter must be one of: D7, D30, D90, D180. Returns CSV data with daily counts per service: office365, exchange, oneDrive, sharePoint, skypeForBusiness, yammer, teams. - **get-active-users-report** β€” Invoke function getOffice365ActiveUserDetail TIP: Gets details about active Microsoft 365 users. The period parameter must be one of: D7, D30, D90, D180. Returns CSV data with per-user details: displayName, isDeleted, lastActivityDate, and product-specific activity dates (Exchange, OneDrive, SharePoint, Teams, etc.). - **get-onedrive-usage-report** β€” Invoke function getOneDriveUsageAccountDetail TIP: Gets OneDrive usage details per account. The period parameter must be one of: D7, D30, D90, D180. Returns CSV data with ownerDisplayName, ownerPrincipalName, siteUrl, storageUsedInBytes, fileCount, activeFileCount, lastActivityDate. - **get-sharepoint-usage-report** β€” Invoke function getSharePointSiteUsageDetail TIP: Gets SharePoint site usage details. The period parameter must be one of: D7, D30, D90, D180. Returns CSV data with per-site details: siteUrl, ownerDisplayName, storageUsedInBytes, fileCount, activeFileCount, pageViewCount, lastActivityDate. - **get-teams-activity-report** β€” Get the number of Microsoft Teams activities by activity type. The activities are performed by Microsoft Teams licensed users. TIP: Gets Teams user activity counts for the specified period. The period parameter must be one of: D7, D30, D90, D180 (last 7/30/90/180 days). Returns CSV data with daily counts of teamChatMessages, privateChatMessages, calls, and meetings. - **list-monthly-print-usage-by-printer** β€” Retrieve a list of monthly print usage summaries, grouped by printer. TIP: Lists monthly Universal Print usage summarized by printer. Each has printerName, usageDate, completedBlackAndWhiteJobCount, completedColorJobCount, incompleteJobCount, and pagesPrinted. - **list-monthly-print-usage-by-user** β€” Retrieve a list of monthly print usage summaries, grouped by user. TIP: Lists monthly Universal Print usage summarized by user. Each has userPrincipalName, usageDate, completedBlackAndWhiteJobCount, completedColorJobCount, incompleteJobCount, and pagesPrinted. - **list-role-resource-namespaces** β€” Get resourceNamespaces from roleManagement TIP: Lists RBAC resource namespaces for directory roles. Each namespace represents a resource provider (microsoft.directory, microsoft.aad.b2c, etc.) with resourceActions defining available permissions. - **list-role-assignments** β€” Get a list of unifiedRoleAssignment objects for the RBAC provider. The following RBAC providers are currently supported: - directory (Microsoft Entra ID) - entitlement management (Microsoft Entra entitlement management) TIP: Lists all role assignments in the directory. Use $filter=principalId eq '{user-id}' to find all roles for a specific user. Use $expand=principal to get user details. Includes both permanent and PIM-eligible assignments. - **list-pim-active-assignments** β€” Get the instances of active role assignments in your tenant. The active assignments include those made through assignments and activation requests, and directly through the role assignments API. TIP: Lists PIM active role assignment schedule instances, including time-bound and activated assignments. Use $filter=principalId eq '{user-id}' to find active assignments for a user. Shows assignmentType (Assigned or Activated), startDateTime, endDateTime. Useful for auditing who currently has active privileged roles. - **list-pim-role-assignment-requests** β€” Retrieve the requests for active role assignments to principals. The active assignments include those made through assignments and activation requests, and directly through the role assignments API. The role assignments can be permanently active with or without an expiry date, or temporarily active after user activation of eligible assignments. TIP: Lists PIM role assignment schedule requests. Each request represents an activation or assignment of a directory role. Has action (adminAssign, adminRemove, selfActivate, selfDeactivate), principalId, roleDefinitionId, directoryScopeId, scheduleInfo, and status. - **list-pim-role-assignment-schedules** β€” Get the schedules for active role assignment operations. TIP: Lists PIM role assignment schedules. Shows the schedule (start/end dates) for active role assignments. Has principalId, roleDefinitionId, directoryScopeId, assignmentType (assigned, activated), scheduleInfo, and memberType. - **list-role-definitions** β€” Get a list of unifiedRoleDefinition objects for the provider. The following RBAC providers are currently supported: - directory (Microsoft Entra ID) - entitlement management (Microsoft Entra Entitlement Management) TIP: Lists all role definitions (built-in and custom). Each has displayName, description, isBuiltIn, rolePermissions. Useful for understanding what each role can do. - **list-pim-eligible-assignments** β€” Get the instances of role eligibilities. TIP: Lists PIM (Privileged Identity Management) eligible role assignments. These are just-in-time assignments that users must activate. Use $filter=principalId eq '{user-id}' to find eligible roles for a specific user. Use $expand=roleDefinition to get role names. Compare with list-role-assignments to distinguish permanent vs eligible assignments. - **list-pim-role-eligibility-requests** β€” In PIM, retrieve the requests for role eligibilities for principals made through the unifiedRoleEligibilityScheduleRequest object. TIP: Lists PIM role eligibility schedule requests. Shows requests to make users eligible for directory roles. Has action, principalId, roleDefinitionId, directoryScopeId, scheduleInfo, and status. - **list-pim-role-eligibility-schedules** β€” Get the unifiedRoleEligibilitySchedule resources from the roleEligibilitySchedules navigation property. TIP: Lists PIM role eligibility schedules. Shows all users currently eligible to activate directory roles with their schedule details. Has principalId, roleDefinitionId, directoryScopeId, scheduleInfo, and memberType. - **list-security-alerts** β€” Get a list of alert resources created to track suspicious activities in an organization. This operation lets you filter and sort through alerts to create an informed cyber security response. It exposes a collection of alerts that were flagged in your network, within the time range you specified in your environment retention policy. The most recent alerts are displayed at the top of the list. TIP: Lists security alerts from Microsoft 365 Defender. Use $filter=status eq 'new' or status eq 'inProgress' to filter by status. Use $filter=severity eq 'high' to filter by severity (informational, low, medium, high). Use $orderby=createdDateTime desc to sort by newest. Use $top to limit results. Each alert has title, description, severity, status, category, serviceSource, detectionSource, and evidence. - **get-security-alert** β€” Get the properties and relationships of an alert object. TIP: Gets a specific security alert by ID. Returns full alert details including title, description, severity, status, category, serviceSource, evidence, mitreTechniques, actorDisplayName, and recommendedActions. - **list-simulation-end-user-notifications** β€” Get a list of endUserNotification objects and their properties. TIP: Lists end-user notification templates for attack simulations. These are the emails sent to users during/after simulations. - **list-simulation-landing-pages** β€” Get a list of the landingPage objects and their properties. TIP: Lists landing page templates for attack simulations. These are the phishing pages shown when a user clicks a simulation link. - **list-simulation-login-pages** β€” Get a list of the loginPage objects and their properties. TIP: Lists login page templates for attack simulations. These are credential harvest pages used in phishing simulations. - **list-simulation-payloads** β€” Get a list of payloads for attack simulation campaigns. This operation expects the mandatory parameter source to filter and query the respective data source. TIP: Lists attack simulation payloads. Each has displayName, description, source (microsoft, global, tenant), status, platform, simulationAttackType (social, credential), technique (phishing, malware), language, and complexity. - **list-simulation-automations** β€” Get a list of attack simulation automations for a tenant. TIP: Lists attack simulation automations. Each has displayName, description, status (enabled, disabled, notRunning), createdDateTime, lastRunDateTime, nextRunDateTime, and attackType. These automate recurring phishing simulations. - **list-attack-simulations** β€” Get a list of attack simulation campaigns for a tenant. TIP: Lists attack simulation campaigns (phishing simulations). Each simulation has displayName, status, attackType (social, credential harvest, etc.), launchDateTime, completionDateTime, report with overview (resolvedTargetsCount, compromisedRate). Useful for tracking security awareness training effectiveness. - **get-attack-simulation** β€” Get an attack simulation campaign for a tenant. TIP: Gets a specific attack simulation by ID. Returns full details including report with simulationEventsContent (users who clicked, reported, etc.) and trainingsContent. - **list-simulation-trainings** β€” Get a list of the training objects and their properties. TIP: Lists available training content for attack simulations. Each has displayName, description, source (microsoft, global, tenant), type (assigned, notAssigned, unknown), availabilityStatus, durationInMinutes, and supportedLocales. - **list-ediscovery-cases** β€” Get a list of the ediscoveryCase objects and their properties. TIP: Lists eDiscovery cases in Microsoft Purview. Each case has displayName, description, status (active, closed, closedWithError), createdBy, createdDateTime, lastModifiedBy, lastModifiedDateTime, and externalId. Use $filter=status eq 'active' to see active cases. Use $top to limit results. RISK LEVEL: HIGH. This response contains secrets or highly sensitive data (e.g. recovery keys, LAPS passwords, legal-hold material). Do not echo verbatim; confirm with the operator before sharing. - **get-ediscovery-case** β€” Read the properties and relationships of an ediscoveryCase object. TIP: Gets a specific eDiscovery (Premium) case by id. RISK LEVEL: HIGH. This response contains secrets or highly sensitive data (e.g. recovery keys, LAPS passwords, legal-hold material). Do not echo verbatim; confirm with the operator before sharing. - **list-ediscovery-custodians** β€” Get a list of the custodian objects and their properties. TIP: Lists custodians in an eDiscovery case. Each custodian preserves data for a specific user's mailbox, OneDrive, and Teams. RISK LEVEL: HIGH. This response contains secrets or highly sensitive data (e.g. recovery keys, LAPS passwords, legal-hold material). Do not echo verbatim; confirm with the operator before sharing. - **get-ediscovery-custodian** β€” Read the properties and relationships of an ediscoveryCustodian object. TIP: Gets a specific custodian by ID in an eDiscovery case. Returns full details: displayName, email, status (active | released | error), holdStatus (notApplied | applied | pending | applying | removing | partial), lastIndexOperation, createdDateTime, lastModifiedDateTime. Use to verify hold status before / after applyHold / removeHold actions, or to inspect indexing progress for a specific custodian. - **list-ediscovery-noncustodial-data-sources** β€” Returns a list of case ediscoveryNoncustodialDataSource objects for this case. TIP: Lists noncustodial data sources in an eDiscovery case β€” mailbox / SharePoint site / OneDrive locations that are part of the case scope WITHOUT an assigned custodian (no human user owner). Examples: shared mailboxes, departmental SharePoint sites, group OneDrive locations. Each has displayName, dataSource (the underlying location), holdStatus, lastIndexOperation, status. Use to scope a case to organizational data not tied to a specific employee. Supports $filter, $top, $skip, $select, $expand, $orderby. - **get-ediscovery-noncustodial-data-source** β€” Returns a list of case ediscoveryNoncustodialDataSource objects for this case. TIP: Gets a specific noncustodial data source by ID. Returns full details: dataSource (underlying location with @odata.type), holdStatus (notApplied | applied | pending | applying | removing | partial), status, lastIndexOperation, createdDateTime, releasedDateTime. Use to verify hold status before / after applyHold / removeHold actions. - **list-case-operations** β€” Get a list of the caseOperation objects and their properties. TIP: Lists long-running operations on an eDiscovery case β€” search executions, hold applications, indexing jobs, reviewSet additions, exports. Each operation has action (e.g. 'estimateStatistics', 'addToReviewSet', 'export', 'applyHold'), status (notStarted | running | succeeded | failed | partiallySucceeded), percentProgress, createdDateTime, completedDateTime, resultInfo (error details if failed). Use to track async operations triggered by other tools (create-ediscovery-search, add-to-review-set, export-review-set, etc.). - **get-case-operation** β€” Read the properties and relationships of a caseOperation object. TIP: Gets a specific eDiscovery case operation by ID. Returns full status including percentProgress and resultInfo. Use to poll until status=succeeded for operations like export-review-set or update-ediscovery-custodian-index that return 202 + operation ID. For failed operations, resultInfo contains the error message. - **list-review-sets** β€” Get a list of ediscoveryReviewSet objects associated with an eDiscovery case. TIP: Lists review sets in an eDiscovery case. Review sets are curated collections of items collected from searches β€” the workspace where legal teams review, tag, and export content for production. Each review set has displayName, description, createdDateTime, createdBy. A case can have multiple review sets (e.g. one per matter or production batch). Items only enter a review set after add-to-review-set is invoked on a search. - **get-review-set** β€” Read the properties and relationships of an ediscoveryReviewSet object. TIP: Gets a specific review set by ID. Returns displayName, description, createdDateTime, createdBy, and the list of queries (saved filters) attached to it. Item count is NOT directly returned β€” use list-review-set-queries and run a query to count items, or wait for export to see the file count. - **list-review-set-queries** β€” Get the list of queries associated with an eDiscovery review set. TIP: Lists saved queries (filters) on a review set. Each query has displayName, contentQuery (KQL filtering review-set items), createdDateTime. Queries are the persistent way to slice a review set β€” examples: 'all items tagged Responsive', 'docs from a specific custodian', 'communications matching keyword X'. - **get-review-set-query** β€” Read the properties and relationships of an ediscoveryReviewSetQuery object. TIP: Gets a specific review-set query by ID. Returns displayName, contentQuery, createdDateTime, lastModifiedDateTime. - **list-ediscovery-searches** β€” Get the list of ediscoverySearch resources from an eDiscoveryCase object. TIP: Lists searches defined in an eDiscovery case. RISK LEVEL: HIGH. This response contains secrets or highly sensitive data (e.g. recovery keys, LAPS passwords, legal-hold material). Do not echo verbatim; confirm with the operator before sharing. - **get-data-security-governance-root** β€” Get dataSecurityAndGovernance from security TIP: Gets the root entity for Microsoft Purview Data Security Posture Management (DSPM). Returns metadata about the tenant's DSPM configuration: enabled state, last scan timestamps, related links to protectionScopes and sensitivityLabels. This is the entry point for navigating the DSPM surface β€” the Microsoft equivalent of third-party DSPM tools (Varonis, Defender for Cloud DSPM). - **get-protection-scopes** β€” Container for actions related to computing tenant-wide data protection scopes. TIP: Gets the data security and governance protection scopes configured for the tenant. - **list-sensitivity-labels** β€” List the sensitivity labels available for the entire tenant. TIP: Lists sensitivity labels defined in the tenant. Returns id, name, description, tooltip, color, isActive, priority, parent. Labels are used for data classification and protection. - **get-sensitivity-label** β€” Get a sensitivity label available for the entire tenant. TIP: Gets a specific sensitivity label by ID. Returns name, description, tooltip, color, isActive, priority, parent, contentFormats, autoLabeling settings. - **get-sensitivity-label-rights** β€” Get the usage rights granted to the calling user for a specific sensitivity label that has admin-defined permissions. TIP: Gets the rights associated with a sensitivity label, including encryption settings and usage rights. - **list-sensitivity-sublabels** β€” Get sublabels from security TIP: Lists sublabels under a parent sensitivity label. Returns id, name, description, tooltip, color, isActive, priority. - **list-identity-health-issues** β€” Get a list of healthIssue objects and their properties. TIP: Lists Microsoft Defender for Identity health issues. Each has healthIssueType, severity (low, medium, high), displayName, description, recommendedActionCommands, status (open, closed, suppressed), domainName, sensorDNSName, and issueTypeId. Use to monitor Defender for Identity sensor health. - **get-identity-health-issue** β€” Read the properties and relationships of a healthIssue object. TIP: Gets a specific Microsoft Defender for Identity health issue by ID. Returns full details including healthIssueType, severity (low | medium | high), status (open | closed | suppressed), displayName, description, recommendedActions, recommendedActionCommands (PowerShell remediation snippets), createdDateTime, lastModifiedDateTime, domainNames, sensorDNSNames, additionalInformation, issueTypeId. Use after list-identity-health-issues to drill into a specific health alert and get the remediation commands. - **list-identity-accounts** β€” Get a list of the identityAccounts objects and their properties. TIP: Lists identity accounts observed by Microsoft Defender for Identity β€” synced AD / Entra ID / Okta accounts that DfI has correlated with detected activity. Each has accountId, displayName, identityProvider (entraID | activeDirectory | okta), upn / sAMAccountName, domain, isSensitive (privileged), and lastActivityDateTime. Use to identify the canonical DfI account-id needed for invoke-identity-account-action (which requires the DfI identityAccountsId, NOT the AD objectGuid). Supports $filter, $top, $skip, $select, $expand, $orderby, $count. - **get-identity-account** β€” Read the properties and relationships of a single identity security account object. This allows retrieving information about available identity accounts. TIP: Gets a specific identity account by DfI identityAccounts id. Returns full details including identityProvider, sourceId (the AD objectGuid / Entra objectId / Okta id), upn, displayName, lastActivityDateTime, sensitivity flags, group memberships observed by DfI. Use to confirm an account's identityProvider before calling invoke-identity-account-action β€” the action set differs by provider (e.g. forcePasswordReset works for activeDirectory only). - **get-sensor-candidate-activation-config** β€” Read the properties and relationships of microsoft.graph.security.sensorCandidateActivationConfiguration object. TIP: Gets the global sensor candidate activation configuration β€” controls how DfI handles newly-detected sensor candidates. Returns the autoActivation flag (whether candidates are auto-promoted to sensors), automation rules (criteria for auto-activation), and notification settings. - **list-sensor-candidates** β€” Get a list of the sensorCandidate objects and their properties. TIP: Lists Microsoft Defender for Identity sensor candidates β€” servers detected on the network that appear to be domain controllers, AD FS, AD CS, or Entra Connect hosts but do NOT yet have a DfI sensor installed. Each has dnsName, ipAddress, osVersion, lastSeenDateTime, candidateType (e.g. domainController, adfs, adcs, entraConnect), isActivated (boolean), and detectedBy (which existing sensor detected this candidate). Use to discover blind spots in DfI coverage and target new sensor deployments. Supports $filter, $top, $skip, $select, $expand, $orderby, $count. - **get-sensor-candidate** β€” Represents Microsoft Defender for Identity sensors that are ready to be activated. TIP: Gets a specific sensor candidate by ID. Returns full discovery metadata: dnsName, ipAddress, osVersion, candidateType, lastSeenDateTime, isActivated, detectedBy, additionalInformation (server role hints). Use before calling activate-sensor-candidates to confirm the candidate matches the expected server. - **list-sensor-migrations** β€” Get a list of the sensorMigration objects and their properties. TIP: Lists Microsoft Defender for Identity sensor migration jobs β€” tracks upgrades of sensors from legacy AATP (Azure Advanced Threat Protection) workspace to the unified Defender XDR sensor architecture. Each migration has sensorId, sourceVersion, targetVersion, status (pending | inProgress | completed | failed), startedDateTime, completedDateTime. Use to monitor an in-flight migration wave. Beta-only endpoint. - **get-sensor-migration** β€” Represents Microsoft Defender for Identity sensors that can be migrated to the unified security portal. TIP: Gets a specific sensor migration job by ID. Returns the full migration trace: source/target versions, current step, errors (if status=failed), per-step timestamps. Use to investigate why a specific migration is stuck or failed. Beta-only endpoint. - **list-identity-sensors** β€” Get a list of sensor objects and their properties. TIP: Lists Microsoft Defender for Identity sensors. Each has displayName, sensorType (adConnectIntegrated, adcsIntegrated, adfsIntegrated, domainControllerIntegrated), healthStatus (healthy, notHealthy, offline), openHealthIssuesCount, domainName, version, and deploymentStatus. - **get-identity-sensor** β€” Read the properties and relationships of a sensor object. TIP: Gets a specific Microsoft Defender for Identity sensor by ID. Returns full details: displayName, sensorType (adConnectIntegrated | adcsIntegrated | adfsIntegrated | domainControllerIntegrated | entraConnectIntegrated), healthStatus (healthy | notHealthy | offline | failed), openHealthIssuesCount, domainName, version, deploymentStatus, sensorSettings, createdDateTime, settings (capture mode, delayed updates), and the underlying server's DNS / IP / OS info. Use after list-identity-sensors to drill into a specific DC / AD FS / AD CS / Entra Connect server. - **list-sensor-health-issues** β€” Represents potential issues within a customer's Microsoft Defender for Identity configuration that Microsoft Defender for Identity identified related to the sensor. TIP: Lists all health issues for a specific Defender for Identity sensor. Returns the per-sensor view of healthIssues β€” same shape as list-identity-health-issues but scoped to a single sensor. Useful for triaging the health of one specific domain controller or AD FS / AD CS server. Supports $filter, $top, $skip, $select, $expand, $orderby, $count. - **get-sensor-health-issue** β€” Represents potential issues within a customer's Microsoft Defender for Identity configuration that Microsoft Defender for Identity identified related to the sensor. TIP: Gets a specific health issue scoped to a sensor. Equivalent to get-identity-health-issue but verified to belong to the named sensor β€” useful when correlating an alert to a specific DC. - **get-sensor-deployment-access-key** β€” Get the deployment access key for Microsoft Defender for Identity that is required to install sensors associated with the workspace. TIP: Gets the Microsoft Defender for Identity deployment access key for the tenant β€” required to install NEW sensors (the installer prompts for this key on first run). SECURITY: This key is a credential that allows any host on the network to register itself as a DfI sensor β€” treat it as a secret, do NOT log it, do NOT expose in tickets or screenshots. Anyone with this key can install a rogue sensor that may impersonate traffic capture. If suspected compromised, use regenerate-sensor-deployment-access-key to rotate (invalidates the old key immediately). - **get-sensor-deployment-package-uri** β€” Get the sensor deployment package URL and version. You can use this URL to download the installer to install the sensor on a server. TIP: Gets the Microsoft Defender for Identity sensor deployment package URL and version. The URL is a time-limited Azure Blob link to the latest .exe installer. Use to download the installer programmatically when deploying new sensors. The version field tells you the installer build that will be installed. - **get-identity-security-settings** β€” Represents a container for security identities settings APIs. TIP: Gets Microsoft Defender for Identity global settings. Returns configuration for identity-based threat detection. - **get-auto-auditing-config** β€” Get the properties and relationships of microsoft.graph.security.autoAuditingConfiguration object. TIP: Gets the Defender for Identity auto-auditing configuration. Auto-auditing controls whether DfI automatically configures the recommended Windows audit policies (advanced audit policies on DCs: 'Audit Directory Service Changes', 'Audit Computer Account Management', etc.) on sensors and reverts them if changed locally. Returns enabled (boolean) and lastUpdatedDateTime. Recommended state for production tenants: enabled=true (prevents drift in audit configuration that degrades detection coverage). - **list-security-incidents** β€” Get a list of incident objects that Microsoft 365 Defender created to track attacks in an organization. Attacks are typically inflicted on different types of entities, such as devices, users, and mailboxes, resulting in multiple alert objects. Microsoft 365 Defender correlates alerts with the same attack techniques or the same attacker into an incident. This operation allows you to filter and sort through incidents to create an informed cyber security response. It exposes a collection of incidents that were flagged in your network, within the time range you specified in your environment retention policy. The most recent incidents are displayed at the top of the list. TIP: Lists security incidents from Microsoft 365 Defender. An incident correlates multiple alerts from the same attack. Use $filter=status eq 'active' to filter active incidents. Use $filter=severity eq 'high' to filter by severity. Use $orderby=createdDateTime desc. Each incident has displayName, severity, status, assignedTo, classification, and linked alerts. - **get-security-incident** β€” Retrieve the properties and relationships of an incident object. Attacks are typically inflicted on different types of entities, such as devices, users, and mailboxes, resulting in multiple alert objects. Microsoft 365 Defender correlates alerts with the same attack techniques or the same attacker into an incident. TIP: Gets a specific security incident by ID. Returns full details including displayName, severity, status, assignedTo, classification, determination, description, and linked alerts. - **list-file-plan-authorities** β€” Get a list of the authorityTemplate objects and their properties. TIP: Lists file plan authorities used in retention labels. Each has displayName and id. Authorities represent the regulatory body or organizational authority behind a retention policy. - **list-file-plan-categories** β€” Get a list of the categoryTemplate objects and their properties. TIP: Lists file plan categories used in retention labels. Each has displayName and id. Categories classify the content type for records management. - **list-file-plan-citations** β€” Get a list of the citationTemplate objects and their properties. TIP: Lists file plan citations used in retention labels. Each has displayName, citationUrl, citationJurisdiction, and id. Citations reference the regulation or law that requires the retention. - **list-file-plan-departments** β€” Get a list of the departmentTemplate objects and their properties. TIP: Lists file plan departments used in retention labels. Each has displayName and id. Departments identify which organizational unit owns the retention policy. - **list-file-plan-references** β€” Get a list of the filePlanReferenceTemplate objects and their properties. TIP: Lists file plan references used in retention labels. Each has displayName and id. File plan references provide a unique identifier or reference number for the retention policy within the organization's file plan. - **list-secure-score-controls** β€” Retrieve the properties and relationships of a secureScoreControlProfiles object. TIP: Lists all Secure Score control profiles. Each has title, maxScore, implementationStatus, and actionUrl. Useful to prioritize security improvements. - **get-secure-score-control** β€” Retrieve the properties and relationships of an securescorecontrolprofile object. TIP: Gets a specific Secure Score control profile. Returns remediation impact, implementation cost, threats addressed, and compliance information. - **list-secure-scores** β€” Retrieve a list of secureScore objects. TIP: Lists Secure Score snapshots over time. Each entry has currentScore, maxScore, and controlScores array. Use $top=1&$orderby=createdDateTime desc to get the latest score. Useful for tracking security posture improvement. - **get-secure-score** β€” Retrieve the properties and relationships of a secureScore object. TIP: Gets a specific Secure Score snapshot. Returns currentScore, maxScore, averageComparativeScores (comparison with similar tenants), and controlScores with detailed per-control scoring. - **list-subject-rights-requests** β€” Get subjectRightsRequests from security TIP: Lists data subject rights requests (DSAR) for privacy compliance. Each has displayName, type (access, delete, export, tagForAction), status (active, closed), dataSubjectType, createdDateTime, createdBy, stages, and regulation. Used for GDPR/privacy compliance. RISK LEVEL: HIGH. This response contains secrets or highly sensitive data (e.g. recovery keys, LAPS passwords, legal-hold material). Do not echo verbatim; confirm with the operator before sharing. - **list-threat-intel-articles** β€” Get a list of article objects, including their properties and relationships. TIP: Lists Microsoft threat intelligence articles. Each has title, body, createdDateTime, lastUpdatedDateTime, tags, and indicators. These are curated reports about threat actors, campaigns, and vulnerabilities. - **get-threat-intel-article** β€” Read the properties and relationships of an article object. TIP: Gets a specific threat intelligence article by ID. Returns title, body (HTML), summary, tags, indicators, and linked intelligence profiles. - **list-threat-intel-article-indicators** β€” Get a list of articleIndicator objects that represent indicators of threat or compromise related to the contents of an article. TIP: Lists indicators of compromise (IOCs) associated with a threat intelligence article. Each indicator has artifact (hostname, IP, URL, file hash), source, and pattern details. - **list-threat-intel-host-components** β€” Read the properties and relationships of a hostComponent object. TIP: Lists web components detected on hosts (web servers, frameworks, CMS, etc.). Each has host, name, version, category, firstSeenDateTime, lastSeenDateTime. Use to identify vulnerable software versions running on infrastructure. - **list-threat-intel-host-cookies** β€” Read the properties and relationships of a hostCookie object. TIP: Lists cookies observed on hosts from Threat Intelligence. Each has name, domain, firstSeenDateTime, lastSeenDateTime, and host. - **list-threat-intel-host-ports** β€” Read the properties and relationships of a hostPort object. TIP: Lists open ports observed on hosts from Threat Intelligence. Each has port, protocol, status, firstSeenDateTime, lastSeenDateTime, and associated host/service/banner. Use $filter=host/id eq 'x.x.x.x' for a specific host. - **list-threat-intel-hosts** β€” Read the properties and relationships of a host object. The host resource is the abstract base type that returns an implementation. A host can be of one of the following types: TIP: Lists hosts tracked by Microsoft threat intelligence. Use $filter=id eq 'example.com' to look up a specific host. Returns host details including firstSeenDateTime, lastSeenDateTime, and registrar info. - **get-threat-intel-host** β€” Read the properties and relationships of a host object. The host resource is the abstract base type that returns an implementation. A host can be of one of the following types: TIP: Gets threat intelligence for a specific host (domain or IP). The host-id is the hostname or IP address. Returns firstSeenDateTime, lastSeenDateTime, registrar, registrant info, and reputation data. - **list-threat-intel-host-pairs** β€” Get the list of hostPair resources associated with a host, where that host is *either* the *parent* or the *child*. TIP: Lists host pairs for a given host β€” relationships between parent and child hosts (redirects, iframes, scripts, etc.). Each has parentHost, childHost, linkKind (redirect, script, etc.), firstSeenDateTime, lastSeenDateTime. Useful for mapping infrastructure. - **get-threat-intel-host-whois** β€” Get the specified whoisRecord resource. Specify the desired whoisRecord in one of the following two ways: - Identify a host and get its current whoisRecord. - Specify an id value to get the corresponding whoisRecord. TIP: Gets WHOIS information for a host. Returns registrar, registrant (name, organization, email, phone), nameservers, registrationDateTime, expirationDateTime. Useful for investigating suspicious domains. - **list-threat-intel-ssl-certs** β€” Get the properties and relationships of a hostSslCertificate object. TIP: Lists SSL certificates observed on hosts. Each has host, sslCertificate (issuer, subject, serialNumber, sha256, validityPeriod), firstSeenDateTime, lastSeenDateTime. Useful for tracking certificate changes and detecting suspicious certificates. - **list-threat-intel-host-trackers** β€” Read the properties and relationships of a hostTracker object. TIP: Lists web trackers (analytics IDs, etc.) observed on hosts from Threat Intelligence. Each has kind (GoogleAnalyticsID, JarmHash, etc.), value, firstSeenDateTime, lastSeenDateTime, and host. Useful for infrastructure correlation. - **list-threat-intel-profiles** β€” Get a list of the intelligenceProfile objects and their properties. TIP: Lists threat actor intelligence profiles. Each has title, kind (actor, tool, vulnerability), aliases, countriesOrRegionsOfOrigin, targets (industries, countries), firstActiveDateTime, and description. Profiles represent tracked threat actors and their TTPs. - **get-threat-intel-profile** β€” Read the properties and relationships of a intelligenceProfile object. TIP: Gets a specific threat actor intelligence profile. Returns full details including title, kind, description, aliases, countriesOrRegionsOfOrigin, targets, tradecraft summary, and linked indicators. - **list-threat-intel-profile-indicators** β€” Get the intelligenceProfileIndicator resources from the indicators navigation property of an intelligenceProfile. TIP: Lists indicators of compromise associated with a threat actor profile. Each indicator has artifact (hostname, IP, URL, file hash), source, and firstSeenDateTime. - **list-passive-dns-records** β€” Read the properties and relationships of a passiveDnsRecord object. TIP: Lists passive DNS records from Microsoft Defender Threat Intelligence. Each has firstSeenDateTime, lastSeenDateTime, recordType, and associated host/parentHost. Use $filter=host/id eq 'example.com' to find DNS history for a domain. - **list-ssl-certificates** β€” Get a list of sslCertificate objects and their properties. TIP: Lists SSL certificates from Microsoft Defender Threat Intelligence. Each has sha1, issuer, subject, serialNumber, firstSeenDateTime, lastSeenDateTime, and relatedHosts. Useful for infrastructure attribution. - **list-threat-intel-subdomains** β€” Read the properties and relationships of a subdomain object. TIP: Lists subdomains from Threat Intelligence. Each has value (the subdomain), firstSeenDateTime, and host. Use $filter=host/id eq 'example.com' to enumerate subdomains. - **list-threat-intel-vulnerabilities** β€” Read the properties and relationships of a vulnerability object. TIP: Lists known vulnerabilities tracked by Microsoft threat intelligence. Each has id (CVE ID), description, severity, publishedDateTime, lastModifiedDateTime, hasChatter, exploitsAvailable, and cvss scores. Use to check if known CVEs are being actively exploited. - **get-threat-intel-vulnerability** β€” Read the properties and relationships of a vulnerability object. TIP: Gets a specific vulnerability by CVE ID (e.g. CVE-2024-1234). Returns description, severity, cvss scores, publishedDateTime, exploitsAvailable, activeExploitsObserved, hasChatter, priorityScore, and remediation info. - **list-threat-intel-whois-records** β€” Get a list of whoisRecord objects. TIP: Lists WHOIS records from threat intelligence. Use to search WHOIS data across domains. Each record has host, registrar, registrant, nameservers, and dates. - **get-threat-intel-whois-record** β€” Get the specified whoisRecord resource. Specify the desired whoisRecord in one of the following two ways: - Identify a host and get its current whoisRecord. - Specify an id value to get the corresponding whoisRecord. TIP: Gets a specific WHOIS record by ID. Returns full registrant and registrar details, nameservers, registration and expiration dates. - **list-retention-events** β€” Get a list of the retentionEvent objects and their properties. TIP: Lists retention events that trigger event-based retention labels. Each has displayName, description, eventTriggerDateTime, retentionEventType, createdDateTime, and status. These events start the retention period for event-based labels. - **get-retention-event** β€” Read the properties and relationships of a retentionEvent object. TIP: Gets a specific retention event by ID. Returns full details: displayName, description, eventTriggerDateTime (when the retention period started for matching labels), retentionEventType (relationship to the event type definition), createdDateTime, lastModifiedDateTime, status. Used to inspect when an event-based retention label became 'active' and started its retention period (e.g. 'employee_leaving' event triggered when an HR system signals a departure). - **list-retention-event-types** β€” Get a list of the retentionEventType objects and their properties. TIP: Lists retention event types. Each has displayName, description, and createdDateTime. Event types categorize retention events (e.g., 'Employee Departure', 'Contract Expiration'). - **get-retention-event-type** β€” Read the properties and relationships of a retentionEventType object. TIP: Gets a specific retention event type definition by ID. Returns displayName, description, createdBy, createdDateTime, lastModifiedDateTime. Event types are the categories of events that can trigger event-based retention (e.g. 'project_closed', 'contract_terminated', 'employee_left'). Use get-retention-event-types to list available types before creating an event. - **list-service-principals** β€” Retrieve a list of servicePrincipal objects. This API also returns agentIdentityBlueprintPrincipal objects, which are identified by the @odata.type property of #microsoft.graph.agentIdentityBlueprintPrincipal. TIP: Lists all service principals (enterprise apps). Use $filter=appOwnerOrganizationId ne '{tenant-id}' to find third-party apps. Use $select=displayName,appId,appOwnerOrganizationId,servicePrincipalType,accountEnabled to audit external access. - **get-service-principal** β€” Retrieve the properties and relationships of a servicePrincipal object. This API can be used to get agentIdentityBlueprintPrincipal objects as well by their ID. TIP: Gets a specific service principal (enterprise app) by ID. Use $select=displayName,appId,passwordCredentials,keyCredentials,servicePrincipalType,accountEnabled,appOwnerOrganizationId,loginUrl,notificationEmailAddresses. Check passwordCredentials and keyCredentials for credential audit. - **list-sp-app-role-assignments** β€” Read the properties and relationships of an appRoleAssignment object. TIP: Lists all users and groups assigned app roles on a service principal. Use to audit who has access to a specific enterprise application. Each entry has principalDisplayName, principalType, appRoleId. - **list-sp-delegated-permissions** β€” Retrieve a list of oAuth2PermissionGrant entities, representing delegated permissions granted to the service principal (representing the client application) to access an API on behalf of a user. TIP: Lists delegated permission grants for a specific service principal. Shows which delegated permissions have been consented (admin or user). Each has consentType (AllPrincipals for admin consent, Principal for user consent), scope (space-separated permissions), and principalId. - **list-service-principal-owners** β€” Directory objects that are owners of this servicePrincipal. The owners are a set of nonadmin users or servicePrincipals who are allowed to modify this object. Supports $expand, $filter (/$count eq 0, /$count ne 0, /$count eq 1, /$count ne 1), and $select nested in $expand. TIP: Lists owners of a service principal. Returns user objects. Owners can manage the enterprise app configuration. Audit for orphaned service principals with no owners. - **list-sharepoint-sites** β€” List all available sites in an organization. Specific filter criteria and query options are also supported and described below: In addition, you can use a $search query against the /sites collection to find sites matching given keywords. If you want to list all sites across all geographies, refer to getAllSites. For more guidance about building applications that use site discovery for scanning purposes, see Best practices for discovering files and detecting changes at scale. TIP: Lists or searches SharePoint sites. Use $search='keyword' to search by site name/URL. Use $filter to filter. Use $select=id,displayName,webUrl to limit fields. Returns id, displayName, webUrl, createdDateTime, lastModifiedDateTime. - **get-sharepoint-site** β€” Retrieve properties and relationships for a site resource. A site resource represents a team site in SharePoint. TIP: Gets a specific SharePoint site by ID. The site-id format is {hostname}:{server-relative-path} or a GUID. Returns displayName, webUrl, root, siteCollection, createdDateTime. - **get-site-analytics** β€” Analytics about the view activities that took place on this site. TIP: Gets analytics for a SharePoint site. Returns allTime and lastSevenDays access counts. - **list-site-columns** β€” Get the collection of columns represented as columnDefinition resources in a site. TIP: Lists site-level column definitions. Returns each column's name, displayName, type, description. - **list-site-content-types** β€” Get the collection of contentType resources in a site. TIP: Lists content types defined in a SharePoint site. Returns id, name, description, group, isBuiltIn, parentId. - **get-site-default-drive** β€” The default drive (document library) for this site. TIP: Gets the default document library (drive) for a SharePoint site. Returns id, name, driveType, webUrl, quota. - **list-site-drives** β€” The collection of drives (document libraries) under this site. TIP: Lists document libraries (drives) in a SharePoint site. Returns id, name, driveType, webUrl, quota, owner for each drive. - **list-site-lists** β€” Get the collection of lists for a site. Lists with the system facet are hidden by default. To list them, include system in your $select statement. TIP: Lists SharePoint lists in a site. Returns id, displayName, list (template, contentTypesEnabled, hidden), createdDateTime, webUrl for each list. - **get-site-list** β€” Returns the metadata for a list. TIP: Gets a specific SharePoint list by ID. Returns displayName, list settings, columns, contentTypes, webUrl. - **list-site-list-columns** β€” Get the collection of columns represented as columnDefinition resources in a list. TIP: Lists column definitions for a SharePoint list. Returns each column's name, displayName, type (text, number, choice, etc.), description. - **list-site-list-items** β€” Get the collection of items in a list. TIP: Lists items in a SharePoint list. Use $expand=fields to get column values. Use $filter on fields/ColumnName for filtering. - **list-site-permissions** β€” Get the permission resources from the permissions navigation property on a site. TIP: Lists permissions granted on a SharePoint site. Returns each permission's id, roles, grantedToIdentities (application or user). - **get-site-permission** β€” Retrieve the properties and relationships of a permission object on a site. TIP: Gets a specific permission on a SharePoint site by ID. Returns id, roles, grantedToIdentities. - **list-site-subsites** β€” Get a collection of subsites defined for a site. TIP: Lists subsites of a SharePoint site. Returns displayName, webUrl, createdDateTime for each subsite. - **list-subscribed-skus** β€” Get the list of commercial subscriptions that an organization has acquired. For the mapping of license names as displayed on the Microsoft Entra admin center or the Microsoft 365 admin center against their Microsoft Graph skuId and skuPartNumber properties, see Product names and service plan identifiers for licensing. TIP: Lists all commercial subscriptions (licenses) in the tenant. Each SKU has skuPartNumber (e.g. ENTERPRISEPACK for E3), prepaidUnits, consumedUnits. Use to audit license allocation and find unused licenses. - **get-subscribed-sku** β€” Get a specific commercial subscription that an organization has acquired. TIP: Gets details for a specific license SKU by ID. Returns prepaidUnits (enabled, suspended, warning), consumedUnits, and servicePlans with their provisioning status. - **list-teams** β€” List all teams in an organization. TIP: Lists all teams in the tenant. Use $filter=displayName eq 'name' to find specific teams. Use $select=id,displayName,description to limit fields. Returns id, displayName, description, visibility, isArchived. - **get-team** β€” Retrieve the properties and relationships of the specified team. TIP: Gets a specific team by ID. Returns displayName, description, visibility (public/private), isArchived, memberSettings, guestSettings, messagingSettings, funSettings, discoverySettings. - **list-team-admin-channels** β€” Retrieve the list of channels in this team. TIP: Lists channels in a team. Returns id, displayName, description, membershipType (standard/private/shared), createdDateTime, email, webUrl. - **get-team-admin-channel** β€” Retrieve the properties and relationships of a channel. This method supports federation. Only a user who is a member of the shared channel can retrieve channel information. TIP: Gets a specific channel by ID. Returns displayName, description, membershipType, createdDateTime, email, webUrl, tenantId. - **list-team-installed-apps** β€” Retrieve a list of apps installed in the specified team. TIP: Lists apps installed in a team. Use $expand=teamsAppDefinition to get app details. Returns teamsApp, teamsAppDefinition with displayName, version, description. - **list-team-admin-members** β€” Get the conversationMember collection of a team. The membership IDs returned by the server must be treated as opaque strings. The client shouldn't try to parse or make assumptions about these resource IDs. In the future, membership results can include users from various tenants, as indicated in the response. Clients should avoid assuming that all members exclusively belong to the current tenant. TIP: Lists members of a team. Returns each member's id, displayName, roles (owner/member/guest), userId, email. - **get-team-admin-member** β€” Get a conversationMember from a team. TIP: Gets a specific member of a team. Returns displayName, roles, userId, email, visibleHistoryStartDateTime. - **list-team-operations** β€” The async operations that ran or are running on this team. TIP: Lists async operations on a team (archive, clone, etc.). Returns operationType, status (notStarted/running/succeeded/failed), createdDateTime, lastActionDateTime, error. - **list-team-permission-grants** β€” List all resource-specific permission grants on the team. This list specifies the Microsoft Entra apps that have access to the team, along with each app's corresponding type of resource-specific access. TIP: Lists resource-specific permission grants on a team. Shows which apps have been granted specific permissions (e.g., ChannelMessage.Read.Group). - **list-deleted-chats** β€” Read the properties and relationships of a deletedChat object. TIP: Lists Teams chats that have been soft-deleted tenant-wide β€” chats deleted by users (or by deletion policies) but still recoverable. Each has id (the chat-id, immutable across delete/restore), chatType (oneOnOne | group | meeting), topic (display name for group/meeting chats), createdDateTime, lastMessagePreview (snippet of last message before deletion), deletedDateTime. Retention window: typically 30 days before Microsoft purges deleted chats permanently. Use to audit recent chat deletions or identify chats to restore via undo-delete-chat. Supports $filter (e.g. on deletedDateTime), $top, $skip, $orderby. - **get-deleted-chat** β€” Read the properties and relationships of a deletedChat object. TIP: Gets a specific deleted Teams chat by ID. Returns the same fields as list-deleted-chats plus members (snapshot of participants at deletion time) and viewpoint (per-caller chat state). Use before calling undo-delete-chat to confirm the chat identity and the participants who will regain access on restore. - **list-deleted-teams** β€” Get a list of the deletedTeam objects and their properties. TIP: Lists recently deleted teams. Returns id and displayName. Deleted teams can be restored within 30 days. - **get-teams-app-settings** β€” Get the tenant-wide teamsAppSettings for all Teams apps in the tenant. TIP: Gets tenant-wide Teams app settings. Returns allowUserRequestsForAppAccess (whether users can request admin approval for apps) and isUserPersonalScopeResourceSpecificConsentEnabled. - **list-users** β€” Retrieve a list of user objects. TIP: Lists all users in the tenant. Use $filter=accountEnabled eq true/false to find enabled/disabled accounts. Use $select=displayName,userPrincipalName,accountEnabled,signInActivity,createdDateTime to get key fields. Use $filter=signInActivity/lastSignInDateTime le 2024-01-01T00:00:00Z to find inactive users. Use $top to paginate, follow @odata.nextLink for more. Max $top=999 for users. - **get-user** β€” Retrieve the properties and relationships of user object. This operation returns by default only a subset of the more commonly used properties for each user. These default properties are noted in the Properties section. To get properties that are not returned by default, do a GET operation for the user and specify the properties in a $select OData query option. Because the user resource supports extensions, you can also use the GET operation to get custom properties and extension data in a user instance. Customers through Microsoft Entra ID for customers can also use this API operation to retrieve their details. TIP: Gets a single user by ID or userPrincipalName. Use $select=displayName,userPrincipalName,accountEnabled,signInActivity,assignedLicenses,memberOf to get detailed info. signInActivity requires AuditLog.Read.All in addition to User.Read.All. - **list-user-app-role-assignments** β€” Retrieve the list of appRoleAssignments granted to an agentUser. TIP: Lists app role assignments for a user. Shows which enterprise apps the user has been granted access to and with which roles. Each entry has appRoleId, resourceDisplayName, and principalDisplayName. - **list-user-auth-methods** β€” Represents all authentication methods registered to a user. TIP: Lists authentication methods registered for a user (phone, email, FIDO2, Microsoft Authenticator, etc.). Useful for MFA coverage audits. Each method has @odata.type to identify the method kind. RISK LEVEL: MEDIUM. This response contains PII or authentication metadata (sign-ins, MFA factors, mail metadata, risk detections). Handle with care and avoid casual disclosure. - **list-user-chats** β€” Retrieve the list of chats that the user is part of. This method supports federation. When a user ID is provided, the calling application must belong to the same tenant that the user belongs to. TIP: Lists all Teams chats a specific user is a member of (1:1, group, meeting chats). Each chat has id, topic (for group/meeting chats; null for 1:1), chatType (oneOnOne | group | meeting), createdDateTime, lastUpdatedDateTime, webUrl, viewpoint. Use as the entry point for security investigations on a specific user β€” list their chats, then drill into messages with list-chat-messages. IMPORTANT: this is admin-level surveillance access β€” only call with documented investigative purpose (security incident, legal hold pending eDiscovery case, HR investigation with sign-off). For formal legal discovery (subpoena response, litigation), prefer the eDiscovery v3 workflow (create-ediscovery-case β†’ custodian β†’ search β†’ reviewSet β†’ export) which provides chain-of-custody and is the Microsoft-recommended pattern for court-admissible exports. Supports $filter, $top, $skip, $expand=lastMessagePreview, $orderby. BILLING: as of 2025-08-25 the Teams Export APIs (including Chat.Read.All / ChatMessage.Read.All in application mode) are NO LONGER METERED β€” no Azure subscription billing setup required. (Recordings and transcripts still use per-license model parameter β€” see docs/METERED_APIS.md.) - **get-chat** β€” Retrieve a single chat (without its messages). This method supports federation. To access a chat, at least one chat member must belong to the tenant the request initiated from. TIP: Gets a specific Teams chat by ID, scoped to a user. Returns full details: chatType, topic, members snapshot (via $expand=members), lastMessagePreview, webUrl. Use $expand=members,lastMessagePreview to avoid round-trips. The chat-id is the canonical Teams thread identifier (19:xxx@thread.v2 format). Same caveat as list-user-chats β€” admin-level investigation only (Chat.Read.All in app mode is no longer metered since 2025-08-25). - **list-chat-members** β€” A collection of all the members in the chat. Nullable. TIP: Lists members of a Teams chat (scoped to a user's view of the chat). Each member has @odata.type (aadUserConversationMember | anonymousGuestConversationMember), id, displayName, userId (for AAD members β€” null for guests), email, roles (owner | guest), tenantId (for federated participants from other tenants). Federated / guest participants help identify external communications during investigations. Supports $filter, $top, $skip. - **list-chat-messages** β€” A collection of all the messages in the chat. Nullable. TIP: Lists messages in a Teams chat β€” the actual conversation content. Each message has id, createdDateTime, lastModifiedDateTime, deletedDateTime (if soft-deleted), from (sender identity), body (HTML or text content), attachments, mentions, reactions, importance, subject, replyToId. INVESTIGATION WORKFLOW: use $orderby=createdDateTime+desc&$top=50 to get the most recent messages, or $filter=createdDateTime ge YYYY-MM-DDTHH:mm:ssZ for time-window scoped queries. The body.content may be HTML β€” strip tags for plain text. Soft-deleted messages have deletedDateTime set but content is still retrievable (up to 21 days post-deletion per Microsoft Teams Export APIs). LEGAL CAVEAT: reads of chats without a formal eDiscovery case must be documented in the internal investigation journal to respect PIPEDA/Loi 25/GDPR (motif lΓ©gitime). For court submission, prefer eDiscovery v3 export. BILLING: free since 2025-08-25 (previously metered via Teams Export API). Tip: pass `$top=250` (Microsoft's recommended max), use `$filter=lastModifiedDateTime` for incremental sync to avoid re-reading same messages. Supports $filter, $top, $skip, $expand=replies, $orderby. - **get-chat-message** β€” A collection of all the messages in the chat. Nullable. TIP: Gets a specific message in a chat by ID. Returns full message details including body content, attachments (with embedded image URLs), reactions, replies (via $expand). Use after list-chat-messages identified a message of interest. Same legal + billing caveats as list-chat-messages. - **get-user-drive** β€” The user's OneDrive. Read-only. TIP: Gets a user's OneDrive for Business (personal drive). Returns the drive id, driveType ('business'), owner, quota, and webUrl. Use this for DSAR/Loi 25 access requests: a user's OneDrive is a personal site that GET /sites/{...:/personal/...} cannot reach with app permissions β€” go through /users/{user-id}/drive instead. user-id can be the UPN (e.g. user@contoso.com) or the object id. Take the returned drive id and pass it to get-drive-root, then list-drive-children, to enumerate the content. RISK LEVEL: MEDIUM. This response contains PII or authentication metadata (sign-ins, MFA factors, mail metadata, risk detections). Handle with care and avoid casual disclosure. - **list-user-memberships** β€” Get groups, directory roles, and administrative units that the agentUser is a direct member of. This operation isn't transitive. TIP: Lists all groups and directory roles a user is a member of. Returns directoryRole and group objects. Use $select=displayName,id to reduce payload. Useful for auditing a user's access. - **get-user-online-meeting** β€” Information about a meeting, including the URL used to join a meeting, the attendees list, and the description. TIP: Gets a Teams online meeting on behalf of a specific user (app-only path). Returns subject, organizer, startDateTime / endDateTime, joinWebUrl, audioConferencing (dial-in numbers/conferenceId), chatInfo (thread for the meeting chat), participants (organizer + attendees), allowedPresenters, lobbyBypassSettings, recordAutomatically, isBroadcast. REQUIRES Application Access Policy: the LCI app reg must have a CsApplicationAccessPolicy granted to the target user-id (via PowerShell Grant-CsApplicationAccessPolicy) β€” without it, 403. The meeting-id is the canonical onlineMeeting id (not the joinWebUrl's videoTeleconferenceId). Use to audit meeting metadata for compliance / discovery scenarios where the admin is not a meeting participant. - **list-user-meeting-attendance-reports** β€” The attendance reports of an online meeting. Read-only. TIP: Lists attendance reports for a Teams online meeting on behalf of a user. Each report covers ONE session of the meeting β€” recurring meetings have multiple reports (one per occurrence), and a meeting that drops and resumes generates separate reports. Each has id, totalParticipantCount, meetingStartDateTime, meetingEndDateTime. Reports are only available AFTER the meeting ends (typically within 1-2 hours). REQUIRES Application Access Policy on the target user. The attendanceRecords array is empty in list responses β€” use get-user-meeting-attendance-report or pass $expand=attendanceRecords to retrieve participant-level details. Supports $filter, $top, $skip, $select, $orderby. - **get-user-meeting-attendance-report** β€” The attendance reports of an online meeting. Read-only. TIP: Gets a specific attendance report by ID for a Teams online meeting (app-only). Pass $expand=attendanceRecords to get participant-level details inline (recommended β€” avoids a second call to list-user-meeting-attendance-records). REQUIRES Application Access Policy on the target user. Useful for: HR audits (who attended this mandatory training?), engagement reporting (avg participant duration), GDPR / Loi 25 subject-rights requests, forensic investigations (who joined this meeting at what time?). - **list-user-meeting-attendance-records** β€” List of attendance records of an attendance report. Read-only. TIP: Lists individual attendance records for an attendance report β€” one record per participant per join session. Each record has identity (UPN/displayName), emailAddress, role (organizer | presenter | attendee), totalAttendanceInSeconds (cumulative across all joins for this report), and attendanceIntervals (array of {joinDateTime, leaveDateTime, durationInSeconds} β€” useful for detecting drops/rejoins). Tip: it's more efficient to use get-user-meeting-attendance-report with $expand=attendanceRecords than to call this endpoint separately. REQUIRES Application Access Policy on the target user. - **list-user-devices** β€” Devices that are registered for the user. Read-only. Nullable. Supports $expand and returns up to 100 objects. TIP: Lists devices registered to a user. Returns device objects with displayName, operatingSystem, operatingSystemVersion, isCompliant, isManaged, approximateLastSignInDateTime. - **get-managed-devices-by-names** β€” Look up several Intune managed devices by exact device name. Sends one `$filter=deviceName eq ''` request per name through Graph $batch (20 per call) and merges the results. TIP: Resolves a list of device names to Intune managed devices in one call. Use it instead of list-managed-devices with an OR / in() filter on deviceName, which Graph answers with an empty list or a 500. Up to 500 names; matching is case-insensitive and exact (no prefix). Pass select (e.g. deviceName,isEncrypted,complianceState,osVersion,lastSyncDateTime,userPrincipalName) to keep the response small. The result lists devices, notFound names, names matching several devices (multipleMatches) and per-name errors. ## Claude Desktop Quick Installation Install path detected from listing signals. Uses `npx` (confidence: high): ```json "mcpServers": { "microsoft-365-admin": { "command": "npx", "args": ["-y","@okapi-ca/ms-365-admin-mcp-server"], "env": { "MS365_ADMIN_MCP_CLIENT_ID": "", "MS365_ADMIN_MCP_CLIENT_SECRET": "", "MS365_ADMIN_MCP_TENANT_ID": "" } } } ``` **Requires environment variables:** `MS365_ADMIN_MCP_CLIENT_ID`, `MS365_ADMIN_MCP_CLIENT_SECRET`, `MS365_ADMIN_MCP_TENANT_ID` β€” the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for). ## Documentation ## What Microsoft 365 Admin does The Microsoft 365 Admin MCP server gives an MCP client access to Microsoft 365 administration through Microsoft Graph application permissions. It is designed for tenant-level work rather than end-user productivity tasks, using client credentials so an interactive user sign-in is not required. The listed tools cover several administrative areas: - Security alerts and incidents, including retrieval and supported updates - Attack simulation discovery, retrieval, creation, updates, and deletion - Directory audit events, sign-in records, provisioning logs, and deleted users or groups - Microsoft 365 service health, issues, and service messages - Usage reports for Teams, email, active users, SharePoint, OneDrive, mailboxes, and Microsoft 365 apps - User listing, individual user lookup, and user membership lookup The repository also describes a larger generated tool catalog covering additional Microsoft 365 administration domains. The exact tools exposed to a client can be narrowed with configuration. ## How it works Authentication uses an Azure AD app registration with application permissions and a specific tenant ID. The server obtains access with the client ID, client secret, and tenant ID, then calls Microsoft Graph on behalf of the application. It does not use delegated permissions or the `common` tenant authority. The Microsoft 365 Admin MCP server supports stdio as its default transport and Streamable HTTP for remote deployments. It can target the global Microsoft cloud or the China cloud operated by 21Vianet. Tool exposure can be filtered with presets or an enabled-tools regular expression, and result sizes can be constrained through the maximum `$top` setting. Read operations are the default operating mode. Write-capable actions are explicitly identified by risk level, and write access can be enabled with the server's command-line option. The available listing marks alert and incident updates as medium risk, attack simulation creation as high risk, and other attack simulation mutations as medium risk. ## Setup and configuration Install the package globally with npm, run the published Docker image, or build it from source with Node.js 18 or later. Before starting, create an Azure AD app registration, grant the required application permissions, and record its client ID, client secret, and tenant ID. Required environment variables are: - `MS365_ADMIN_MCP_CLIENT_ID` - `MS365_ADMIN_MCP_CLIENT_SECRET` - `MS365_ADMIN_MCP_TENANT_ID` Optional settings select the cloud, configure Azure Key Vault, cap Graph result sizes, force read-only behavior, or restrict the exposed tools. Key Vault configuration can override the environment-based credentials. Claude Desktop can start the server through a stdio command configuration, and VS Code provides a corresponding MCP configuration with secret prompts. Remote HTTP deployments require an HTTP URL configuration and may use an MCP bridge where native client support is unavailable. ## Limitations and notes The Microsoft 365 Admin MCP server requires application permissions approved for the target tenant. Its access level therefore depends on the permissions granted to the Azure AD app, and exposing write tools increases the operational impact of an agent's actions. The server is administrative in scope. It should not be selected solely for ordinary user productivity workflows that depend on delegated permissions. A specific tenant ID is mandatory, and credentials should be protected through an appropriate secret-management approach such as Azure Key Vault. Review the required Graph permissions and enabled tool set before connecting an agent to a production tenant. _Full upstream README: https://allmcps.com/mcp/microsoft-365-admin/readme_