Microsoft Graph API Connector

Microsoft Graph API provides a unified programmatic interface to access data and intelligence across Microsoft 365 services, enabling automation, management, and security operations at scale.

Microsoft Graph API is a unified gateway to Microsoft 365 services, including security, identity, email, collaboration, and directory management. This connector enables Swimlane Turbine users to automate a wide range of Microsoft 365 tasks—such as managing users, groups, emails, incidents, alerts, authentication methods, and Teams communications—without writing code. By integrating Microsoft Graph API with Turbine, security and IT teams can orchestrate identity lifecycle management, automate incident response, streamline email and collaboration workflows, and enhance threat detection and remediation. This integration empowers organizations to break down silos between security, IT, and collaboration teams, accelerating response times and improving operational efficiency across the Microsoft ecosystem.

Configuration

Prerequisites

Before using the Microsoft Graph API connector, ensure you have the following prerequisites in place:

OAuth 2.0 Client Credentials authentication:

URL: The base endpoint for your Microsoft Graph API instance.

Client ID: The application/client identifier registered in Azure AD.

Client Secret: The secret key associated with your Azure AD application.

Token URL: The OAuth 2.0 token endpoint for acquiring access tokens.

Scope: The permissions required for the intended Graph API operations.

OAuth 2.0 Refresh Token authentication:

URL: The base endpoint for your Microsoft Graph API instance.

Client ID: The application/client identifier registered in Azure AD.

Client Secret: The secret key associated with your Azure AD application.

Delegated Flow Authentication (on behalf of a user):

URL: The base endpoint for your Microsoft Graph API instance.

Tenant ID: The unique identifier of your Azure AD tenant.

Username: The username of the account to authenticate as.

Password: The password for the specified user account. ... and so on

Authentication Methods

OAuth 2.0 client credentials authentication with these parameters:

url: Endpoint for Microsoft Graph API.

client_id: Application (client) ID registered in Azure AD.

client_secret: Client secret (key) generated for the application in Azure AD.

token_url: URL to retrieve the OAuth token.

scope: Permissions the app requires.

Password Grant (Delegated Authentication) for acting on behalf of a user:

url: Endpoint for Microsoft Graph API.

tenant_id: Directory ID of the Azure AD tenant.

oauth_un: User's username to authenticate.

oauth_pwd: User's password to authenticate.

oauth_cl_id: Application (client) ID registered in Azure AD.

oauth_cl_secret: Client secret (key) generated for the application in Azure AD.

login_url: Login URL. Default value is https://login.microsoftonline.com. (Optional).

scope: Permissions the app requires. Optional field. (Optional).

url: Endpoint for Microsoft Graph API.

client_ID: Application (client) ID registered in Azure AD.

client_Secret: Client secret (key) generated for the application in Azure AD.

tenant_id: Directory ID of the Azure AD tenant.

scope: Permissions the app requires.

url: Endpoint for Microsoft Graph API.

client_ID: Application (client) ID registered in Azure AD.

client_Secret: Client secret (key) generated for the application in Azure AD.

refresh_token: Refresh Token.

scope: Permissions the app requires.

Capabilities

The Microsoft Graph API connector gives the ability to get and update security alerts, and modify user licenses and sessions.

Add Group Member

Add Group Owner

Add Identity Directory Device Registered User

Add Identity Directory Role Member

Add Incident Comment

Add member to Directory Administrative Unit

Add Members

Assign and Remove License

Audit Logs Get SignIn

Audit Logs List SignIns

Cancel Security Action

Create Contact

Create Event

Create rejectedSender

Create Group ... and so on

Asset Setup

Client Credential Flow Authentication

Authentication uses Azure application OAuth2. You will need an admin account in Azure to create the application.

Recommended Application Permissions (feel free use custom permissions if you only use certain actions):

User.ReadWrite.All

Calendars.ReadWrite

Directory.ReadWrite.All

Directory.AccessAsUser.All

SecurityEvents.Read.All

SecurityEvents.ReadWrite.All

Mail.ReadWrite

Mail.Send

Sites.ReadWrite.All

Files.ReadWrite.All

AuditLog.Read.All

Mail.ReadBasic.All

SecurityAnalyzedMessage.ReadWrite.All

SecurityAlert.ReadWrite.All

User.ManageIdentities.All, ... and so on

Sites.ReadWrite.All is needed by Sharepoint actions only.

In order to set up the asset, you need the following:

Azure Application Client ID

Azure Application Client Secret

Azure Tenant ID

Steps to create the Azure app:

Go to the App Registration page in the Azure portal.

Click New Registration.

Enter a name for your new application and choose Accounts in this organizational directory only, then click Register at the bottom.

Navigate to the API permissions tab on the left navigation menu.

Select Add a permission.

Select Microsoft Graph.

Select Application permissions, then mark all the permissions you need for the actions you are using (See suggested permissions at the top of the asset setup section).

Click the Add permissions button at the bottom of the page.

Select Grant admin consent for your organization, then your permissions should look as below.

Navigate to the Certificates & secrets tab and select New client secret.

Fill out the description and expiration, then click the Add button at the bottom.

The Value of the secret you just created is the Client Secret needed for the Swimlane asset.

Navigate to the Overview tab on the left menu.

The Client ID and Tenant ID needed in the asset are shown on this page.

The Client ID, Tenant ID, and Client Secret described in the steps above are the credentials you need for the asset.

Password Flow (Delegated Auth)

Use Delegated Permissions, instead of Application Permissions, and generate Client ID, Tenant ID, and Client Secret as described in the above Client Credential Flow Authentication.

We also need an Username and a Password for this authentication.

Authentication flow for OAuth2 Refresh Token

Oauth 2.0 refresh token grant, which requires a Refresh Token,Tenant ID, Client ID and Client Secret. Use this auth with accounts which have MFA enabled. To generate a refresh token please follow the instructions below.

In step 3 of the above-mentioned setup instructions, please provide a Redirect URI and select the platform as 'Web', before clicking on Register at the the bottom.

Proceed with the remaining steps to generate 'Client ID', Tenant ID and Client Secret.

Add the permissions in Delegated Permissions.

The Swimlane team will provide a Python script and instructions on how to use the script to generate the Refresh Token.

Limit Access to specific mailboxes

Administrators who want to limit app access to specific mailboxes can create an application access policy by using the New-ApplicationAccessPolicy PowerShell cmdlet. For more information please see the article Limiting application permissions to specific Exchange Online mailboxes.

Action Setup

OData filters

Information on the filter input formatting can be found here.

Keep in mind that not specifying a folder as an input will result in the query affecting all possible folders. Example: If we want to ingest only unread emails, and we don't set the input "folder", we will ingest all unread emails from all folders, including "Deleted Items", "Junk", etc.

Well Known Folders

Well known folders can be used instead of Folder IDs for email actions. All well known folder names can be found here.

Sites Get Site

All the Sites actions require the site ID to be executed. The site ID can be obtained using the action Sites Get Site, in order to run the action the site_hostname and site_name are needed. This two values can be found in a site URL:

https://{site_hostname}.sharepoint.com/sites/{site_name}

For example if our site URL is https://swimlaneintegrations.sharepoint.com/sites/IntegrationsSite we should use:

site_hostname: swimlaneintegrations

site_name: IntegrationsSite

After the action execution you can find the Site ID on the ID output field.

Sites Create List

In order to create a list with its columns, use the input Columns. You can find all the possible values with its configuration on the following table.

Property name	Type	Description
boolean	booleanColumn	This column stores boolean values.
calculated	calculatedColumn	This column's data is calculated based on other columns.
choice	choiceColumn	This column stores data from a list of choices.
currency	currencyColumn	This column stores currency values.
dateTime	dateTimeColumn	This column stores DateTime values.
geolocation	geolocationColumn	This column stores a geolocation.
lookup	lookupColumn	This column's data is looked up from another source in the site.
number	numberColumn	This column stores number values.
personOrGroup	personOrGroupColumn	This column stores Person or Group values.
text	textColumn	This column stores text values.
validation	columnValidation	This column stores validation formula and message for the column.
hyperlinkOrPicture	hyperlinkOrPictureColumn	This column stores hyperlink or picture values.
term	termColumn	This column stores taxonomy terms.
thumbnail	thumbnailColumn	This column stores thumbnail values.
contentApprovalStatus	contentApprovalStatusColumn	This column stores content approval status.

For a complete version of this table please see the official column definition table.

Create List Column

Refer to the above table to get the Type properties and Column type input. The Type properties are documented within the links in the Type column.

Get list items

In order to use the filter input please refer to the OData filters section.

The column used to filter the output must be indexed, see the Microsoft documentation to add an index to a list.

Send Email with Attachments Data

This action works similarly to the standard "Send Email" operation but requires you to manually define each attachment's data. When sending attachments, include an array of attachment objects, where each object must specify the following fields:

contentBytes: The file's contents, provided either as a plain text string or a base64-encoded string.

name: The filename of the attachment.

@odata.type: The OData type of the attachment. The default value is #microsoft.graph.fileAttachment.

contentType: The MIME type of the attachment. The default value is text/plain.

Note: All attachment fields must be entered explicitly for each attachment you include.

This approach provides flexibility for specifying the exact content, name, and type for each file you wish to attach to your outgoing email.

Limitations

When using $filter and $orderby in the same query to get messages, make sure to specify properties in the following ways:

Properties that appear in $orderby must also appear in $filter.

Properties that appear in $orderby are in the same order as in $filter.

Properties that are present in $orderby appear in $filter before any properties that aren't.

Failing to do this results in the following error:

Error code: InefficientFilter

Error message: The restriction or sort order is too complex for this operation.

The Assign/Remove User License requires either the disabled plans and accompanying SKU IDs to assign licenses or the SKU ID of the license you want to remove.

The Get Security Alert has additional information it can return. There are a large number of fields that don't relate to many alerts, so they are not mapped; you can add them if desired.

Notes

An Introduction to Microsoft Graph API

Microsoft Graph Security API Homepage

Microsoft Graph REST API v1.0 reference

Query Parameters Documentation - OData V4

Microsoft Graph Security API v1.0 refrence

Azure AD OAuth2 flow

oauthlib Legacy Application client, this is sort of a hack to bypass manual login (typically required)

Limiting application permissions to specific Exchange Online mailboxes

Microsoft Graph Reports Audit Logs API reference

Configurations

Microsoft Graph API Asset - Tenant ID

Authenticates using Client Credentials and Tenant ID

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
tenant_id	The Tenant ID.	string	Required
client_ID	The client ID	string	Required
client_Secret	The client secret.	string	Required
scope	List of permission scopes for this action.	array	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional
ca_cert	A Base64 encoded CA certificate to use for SSL verification	string	Optional

Password Grant (Delegated Authentication)

Authenticates on behalf of a user using oauth 2.0 credentials

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
login_url		string	Optional
tenant_id		string	Required
oauth_un	The username for authentication	string	Required
oauth_pwd	The password for authentication	string	Required
oauth_cl_id	The client ID	string	Required
oauth_cl_secret	The client secret.	string	Required
scope	Permission scopes for this action.	array	Optional
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional
ca_cert	A Base64 encoded CA certificate to use for SSL verification	string	Optional

Oauth 2.0 Client Credentials

Authenticates using oauth 2.0 client credentials

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
token_url	Must start with https://login.microsoftonline.com/ and then continue with the tenant_id, and then be prepended with /oauth2/v2.0/token	string	Required
client_id	The client ID	string	Required
client_secret	The client secret.	string	Required
scope	List of permission scopes for this action.	array	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional
ca_cert	A Base64 encoded CA certificate to use for SSL verification	string	Optional

MS Graph OpenID Connect Refresh Token Grant

Authenticates using refresh token.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
cl_id	The client ID.	string	Required
cl_secret	The client secret.	string	Required
refresh_token	Refresh Token.	string	Optional
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional
ca_cert	A Base64 encoded CA certificate to use for SSL verification	string	Optional

Actions

Add Incident Comment

Append a user-defined comment to an existing incident in Microsoft Graph API by specifying the incident ID and comment content.

Endpoint

URL: /v1.0/security/incidents/{{incidentId}}/comments

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.incidentId	string	Required	ID of the Incident.
@odata.type	string	Optional	Response data
comment	string	Optional	The comment to be added.

Input Example

{"json_body":{"@odata.type":"microsoft.graph.security.alertComment","comment":"Demo for docs"},"path_parameters":{"incidentId":"545"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
value	array	Value for the parameter
value.comment	string	Value for the parameter
value.createdByDisplayName	string	Name of the resource
value.createdDateTime	string	Value for the parameter

Output Example

{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#security/incidents('545')/comments","value":[{"comment":"Demo for docs","createdByDisplayName":"API-App:Defender - Test - JHYap","createdDateTime":"2024-06-13T06:38:20.6536162Z"},{"comment":"Demo for docs","createdByDisplayName":"API-App:Defender - Test - JHYap","createdDateTime":"2024-06-13T06:51:40.9010261Z"},{"comment":"Demo for docs","createdByDisplayName":"Defender - Test - JHYap","createdDateTime":"2024-06-13T06:54:26.9428449Z"}...

Add Members

Add a new member to a specified group in Microsoft Graph API using the group ID and the member's unique identifier.

Endpoint

URL: /v1.0/groups/{{group-id}}/members/$ref

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.group-id	string	Required	The ID of the group to which the member will be added.
@odata.id	string	Optional	The ID of the directory object to add as a member.

Input Example

{"json_body":{"@odata.id":"https://graph.microsoft.com/v1.0/directoryObjects/{id}"},"path_parameters":{"group-id":"f0b2d6f5-097d-4177-91af-a24e530b53cc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{}

Retrieve detailed information for a specific sign-in event in Microsoft Entra using the unique tenant ID.

Endpoint

URL: /v1.0/auditLogs/signIns/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Audit Logs Get SignIn action

Input Example

{"path_parameters":{"id":"66ea54eb-6301-4ee5-be62-ff5a759b0100"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
value	array	Value for the parameter
value.id	string	Unique identifier
value.createdDateTime	string	Value for the parameter
value.userDisplayName	string	Name of the resource
value.userPrincipalName	string	Name of the resource
value.userId	string	Unique identifier
value.appId	string	Unique identifier
value.appDisplayName	string	Name of the resource
value.ipAddress	string	Value for the parameter
value.clientAppUsed	string	Value for the parameter
value.correlationId	string	Unique identifier
value.conditionalAccessStatus	string	Status value
value.isInteractive	boolean	Value for the parameter
value.riskDetail	string	Value for the parameter
value.riskLevelAggregated	string	Value for the parameter
value.riskLevelDuringSignIn	string	Value for the parameter
value.riskState	string	Value for the parameter
value.riskEventTypes	array	Type of the resource
value.riskEventTypes.file_name	string	Name of the resource
value.riskEventTypes.file	string	Type of the resource
value.resourceDisplayName	string	Name of the resource
value.resourceId	string	Unique identifier

Output Example

{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#auditLogs/signIns","value":[{"id":"66ea54eb-6301-4ee5-be62-ff5a759b0100","createdDateTime":"2023-12-01T16:03:24Z","userDisplayName":"Test Contoso","userPrincipalName":"[email protected]","userId":"26be570a-ae82-4189-b4e2-a37c6808512d","appId":"de8bc8b5-d9f9-48b1-a8ad-b748da725064","appDisplayName":"Graph explorer","ipAddress":"131.107.159.37","clientAppUsed":"Browser","correlationId":"d79f5bee-5860-4832-928f-3133e22ae912","cond...

Audit Logs List SignIns

Retrieve user sign-in logs from Microsoft Entra to analyze access patterns and trends for a specified tenant.

Endpoint

URL: /v1.0/auditLogs/signIns

Method: GET

Input

Argument Name	Type	Required	Description
parameters.$top	number	Optional	Sets the page size of results.
parameters.$skiptoken	string	Optional	Retrieves the next page of results from result sets that span multiple pages.
parameters.$filter	string	Optional	Filters results (rows).

Input Example

{"parameters":{"$top":2,"$skiptoken":"9177f2e3532fcd4c4d225f68f7b9bdf7_1","$filter":"createdDateTime ge 2024-07-01T00:00:00Z and createdDateTime le 2024-07-14T23:59:59Z"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
@odata.nextLink	string	Response data
value	array	Value for the parameter
value.id	string	Unique identifier
value.createdDateTime	string	Value for the parameter
value.userDisplayName	string	Name of the resource
value.userPrincipalName	string	Name of the resource
value.userId	string	Unique identifier
value.appId	string	Unique identifier
value.appDisplayName	string	Name of the resource
value.ipAddress	string	Value for the parameter
value.clientAppUsed	string	Value for the parameter
value.correlationId	string	Unique identifier
value.conditionalAccessStatus	string	Status value
value.isInteractive	boolean	Value for the parameter
value.riskDetail	string	Value for the parameter
value.riskLevelAggregated	string	Value for the parameter
value.riskLevelDuringSignIn	string	Value for the parameter
value.riskState	string	Value for the parameter
value.riskEventTypes	array	Type of the resource
value.riskEventTypes.file_name	string	Name of the resource
value.riskEventTypes.file	string	Type of the resource
value.resourceDisplayName	string	Name of the resource

Output Example

{"@odata.context":"string","@odata.nextLink":"string","value":[{"id":"12345678-1234-1234-1234-123456789abc","createdDateTime":"string","userDisplayName":"Example Name","userPrincipalName":"Example Name","userId":"string","appId":"string","appDisplayName":"Example Name","ipAddress":"string","clientAppUsed":"string","correlationId":"string","conditionalAccessStatus":"active","isInteractive":true,"riskDetail":"string","riskLevelAggregated":"string","riskLevelDuringSignIn":"string"}]}

Create Contact

Add a new contact to a specified folder in Microsoft Graph API using the provided folder ID and contact details.

Endpoint

URL: /v1.0/users/{{id}}/contacts

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Create Contact action
givenName	string	Optional	The contact's given name.
surname	string	Optional	The contact's surname.
emailAddresses	array	Optional	The contact's email addresses.
emailAddresses.address	string	Optional	The email address of the contact.
emailAddresses.name	string	Optional	The display name of the contact.
businessPhones	array	Optional	The contact's business phone numbers.

Input Example

{"json_body":{"givenName":"Pavel","surname":"Bansky","emailAddresses":[{"address":"[email protected]","name":"Pavel Bansky"}],"businessPhones":["+1 732 555 0102"]},"path_parameters":{"id":"aaron.ooi_swimlane.com#EXT#@swimlaneintegrations.onmicrosoft.com"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
createdDateTime	string	Time value
lastModifiedDateTime	string	Time value
displayName	string	Name of the resource

Output Example

{"id":"id-value","createdDateTime":"2015-11-09T02:14:32Z","lastModifiedDateTime":"2015-11-09T02:14:32Z","displayName":"Pavel Bansky"}

Create Event

Create a new calendar event in a specified user's calendar using their email address through the Microsoft Graph API.

Endpoint

URL: /v1.0/users/{{email_address}}/events

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.email_address	string	Required	Parameters for the Create Event action
headers	object	Optional	HTTP headers for the request
headers.Prefer	string	Optional	Specify the time zone for the start and end times in the response.
subject	string	Optional	The text of the event's subject line.
body	object	Optional	The body of the message associated with the event. It can be in HTML or text format.
body.contentType	string	Optional	The content of the item.
body.content	string	Optional	The type of the content.
start	object	Optional	The start date, time, and time zone of the event. By default, the start time is in UTC.
start.dateTime	string	Optional	A single point of time in a combined date and time representation (T; for example, 2017-08-29T04:00:00.0000000).
start.timeZone	string	Optional	Represents a time zone, for example, "Pacific Standard Time".
end	object	Optional	The date, time, and time zone that the event ends. By default, the end time is in UTC.
end.dateTime	string	Optional	A single point of time in a combined date and time representation (T; for example, 2017-08-29T04:00:00.0000000).
end.timeZone	string	Optional	Represents a time zone, for example, "Pacific Standard Time".
location	object	Optional	The location of the event.
location.displayName	string	Optional	The name associated with the location.
locations	array	Optional	The locations where the event is held or attended from. The location and locations properties always correspond with each other. If you update the location property, any prior locations in the locations collection would be removed and replaced by the new location value.
locations.displayName	string	Optional	The name associated with the location.
locations.locationType	string	Optional	The type of location.
locations.uniqueIdType	string	Optional	For internal use only.
locations.locationEmailAddress	string	Optional	Optional email address of the location.
locations.locationUri	string	Optional	Optional URI representing the location.
locations.uniqueId	string	Optional	For internal use only.
locations.address	object	Optional	The street address of the location.
locations.address.city	string	Optional	The city.
locations.address.countryOrRegion	string	Optional	The country or region. It's a free-format string value, for example, "United States".

Input Example

{"path_parameters":{"email_address":"[email protected]"},"headers":{"Prefer":"outlook.timezone=\"Pacific Standard Time\""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
@odata.etag	string	Response data
id	string	Unique identifier
createdDateTime	string	Time value
lastModifiedDateTime	string	Time value
changeKey	string	Output field: changeKey
categories	array	Output field: categories
transactionId	object	Unique identifier
originalStartTimeZone	string	Output field: originalStartTimeZone
originalEndTimeZone	string	Output field: originalEndTimeZone
iCalUId	string	Unique identifier
uid	string	Unique identifier
reminderMinutesBeforeStart	number	Output field: reminderMinutesBeforeStart
isReminderOn	boolean	Output field: isReminderOn
hasAttachments	boolean	Output field: hasAttachments
subject	string	Output field: subject
bodyPreview	string	Request body data
importance	string	Output field: importance
sensitivity	string	Output field: sensitivity
isAllDay	boolean	Output field: isAllDay
isCancelled	boolean	Output field: isCancelled
isOrganizer	boolean	Output field: isOrganizer
responseRequested	boolean	Output field: responseRequested

Output Example

{"@odata.context":"string","@odata.etag":"string","id":"12345678-1234-1234-1234-123456789abc","createdDateTime":"string","lastModifiedDateTime":"string","changeKey":"string","categories":["string"],"transactionId":{},"originalStartTimeZone":"string","originalEndTimeZone":"string","iCalUId":"string","uid":"string","reminderMinutesBeforeStart":123,"isReminderOn":true,"hasAttachments":true}

Create rejectedSender

Add a user or group to the rejected sender list in Microsoft Graph API by specifying their unique ID and @odata.id.

Endpoint

URL: /v1.0/groups/{{id}}/rejectedSenders/$ref

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The unique identifier for the group.
@odata.id	string	Optional	The ID of a user or group object.

Input Example

{"json_body":{"@odata.id":"https://graph.microsoft.com/v1.0/users/[email protected]"},"path_parameters":{"id":"732227b1-1927-49d4-bba9-cc30e6baf602"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"response_text":"string"}

Delete Email

Permanently remove an email from a specified mailbox using the provided email address and email ID through Microsoft Graph API.

Endpoint

URL: /v1.0/users/{{email_address}}/messages/{{email_id}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.email_address	string	Required	The account associated with the email
path_parameters.email_id	string	Required	The ID of the email

Input Example

{"path_parameters":{"email_address":"string","email_id":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"response_text":"string"}

Delete Email Authentication Method

Remove a user's specified email authentication method in Microsoft Graph API using their email address and method ID.

Endpoint

URL: /v1.0/users/{{email_address}}/authentication/emailMethods/{{emailMethods-id}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.email_address	string	Required	The account associated with the email.
path_parameters.emailMethods-id	string	Required	The ID of the email authentication method, referenced by , is always 3ddfcfc8-9383-446f-83cc-3ab9be4be18f. Delete the email method from your own account. For a signed-in user to update their own authentication method, they must have satisfied a multi-factor authentication requirement during sign in.

Input Example

{"path_parameters":{"email_address":"[email protected]","emailMethods-id":"3ddfcfc8-9383-446f-83cc-3ab9be4be18f"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"response_text":"string"}

Delete FIDO2 Authentication Method

Remove a user's FIDO2 security key authentication method in Microsoft Graph API using the specified email address and method ID.

Endpoint

URL: /v1.0/users/{{email_address}}/authentication/fido2Methods/{{id}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.email_address	string	Required	The account associated with the email.
path_parameters.id	string	Required	The ID of the FIDO2 Security Key authentication method.

Input Example

{"path_parameters":{"email_address":"[email protected]","id":"_jpuR-TGZtk6aQCLF3BQjA2"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"response_text":"string"}

Delete Microsoft Authenticator Auth Method

Remove a user's specific Microsoft Authenticator authentication method using their email address and authenticator ID in Microsoft Graph API.

Endpoint

URL: /v1.0/users/{{email_address}}/authentication/microsoftAuthenticatorMethods/{{microsoftAuthenticatorAuthenticationMethodId}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.email_address	string	Required	The account associated with the email.
path_parameters.microsoftAuthenticatorAuthenticationMethodId	string	Required	The ID of the Microsoft Authenticator authentication method.

Input Example

{"path_parameters":{"email_address":"[email protected]","microsoftAuthenticatorAuthenticationMethodId":"_jpuR-TGZtk6aQCLF3BQjA2"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"response_text":"string"}

Delete Phone Authentication Method

Remove a user's phone authentication method in Microsoft Graph API using the specified email address and unique phoneMethodId.

Endpoint

URL: /v1.0/users/{{email_address}}/authentication/phoneMethods/{{phoneMethodId}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.email_address	string	Required	The account associated with the email.
path_parameters.phoneMethodId	string	Required	The ID of the phone authentication method. The Phone Method ID values correspond to deleting specific phone types are b6332ec1-7057-4abe-9331-3d72feddfe41 for alternateMobile, e37fc753-ff3b-4958-9484-eaa9425c82bc for office, and 3179e48a-750b-4051-897c-87b9720928f7 for mobile.

Input Example

{"path_parameters":{"email_address":"[email protected]","phoneMethodId":"3179e48a-750b-4051-897c-87b9720928f7"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"response_text":"string"}

Delete Software OATH Authentication Method

Remove a user's Software OATH token authentication method from Microsoft Graph API using the specified email address and authentication method ID.

Endpoint

URL: /v1.0/users/{{email_address}}/authentication/softwareOathMethods/{{id}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.email_address	string	Required	The account associated with the email.
path_parameters.id	string	Required	The ID of the Software OATH token authentication method.

Input Example

{"path_parameters":{"email_address":"[email protected]","id":"b172893e-893e-b172-3e89-72b13e8972b1"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"response_text":"string"}

Delete Temporary Access Pass Auth Method

Remove a user's Temporary Access Pass authentication method in Microsoft Graph API using the specified email address and authentication method ID.

Endpoint

URL: /v1.0/users/{{email_address}}/authentication/temporaryAccessPassMethods/{{id}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.email_address	string	Required	The account associated with the email.
path_parameters.id	string	Required	The ID of the Temporary Access Pass authentication method.

Input Example

{"path_parameters":{"email_address":"[email protected]","id":"05267842-25b2-4b21-8abd-8e4982796f7f"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"response_text":"string"}

Delete Windows Hello For Business Auth Method

Remove a Windows Hello For Business authentication method from a user account in Microsoft Graph API using the specified email address and authentication method ID.

Endpoint

URL: /v1.0/users/{{email_address}}/authentication/windowsHelloForBusinessMethods/{{windowsHelloForBusinessAuthenticationMethodId}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.email_address	string	Required	The account associated with the email.
path_parameters.windowsHelloForBusinessAuthenticationMethodId	string	Required	The ID of the Windows Hello For Business authentication method.

Input Example

{"path_parameters":{"email_address":"[email protected]","windowsHelloForBusinessAuthenticationMethodId":"_jpuR-TGZtk6aQCLF3BQjA2"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"response_text":"string"}

Expand and Get Item Properties Attached to Message

Retrieve detailed properties of a specific email attachment in Microsoft Graph API using the provided email address, email ID, and attachment ID.

Endpoint

URL: /v1.0/users/{{email_address}}/messages/{{email_id}}/attachments/{{attachment_id}}/

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.email_address	string	Required	The account associated with the email.
path_parameters.email_id	string	Required	The ID of the email to retrieve attachments from.
path_parameters.attachment_id	string	Required	Attachment ID.
remove_content_bytes	boolean	Optional	Remove Content Bytes from the response.
parameters.$expand	string	Optional	To get the properties of an item attachment (contact, event, or message).

Input Example

{"parameters":{"$expand":"microsoft.graph.itemattachment/item"},"path_parameters":{"email_address":"[email protected]","email_id":"AAMkADMxZmU3ZWQ4LTMzNGItNGY3ZC1iM2UxLWM3MDQzOGVjMzlkNwBGAAAAAAAHYPwuVwMWSrFeyLv6XHMzBwCBJRT9-oiDTLpLg45RvPkCAAAAAAEMAACBJRT9-oiDTLpLg45RvPkCAAQxsRLaAAA=","attachment_id":"AAMkADMxZmU3ZWQ4LTMzNGItNGY3ZC1iM2UxLWM3MDQzOGVjMzlkNwBGAAAAAAAHYPwuVwMWSrFeyLv6XHMzBwCBJRT9-oiDTLpLg45RvPkCAAAAAAEMAACBJRT9-oiDTLpLg45RvPkCAAQxsRLaAAABEgAQABYpe5LWcI5Cg91dH8N8e_s="},"remove_content_bytes":true}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
@odata.type	string	Response data
id	string	Unique identifier
lastModifiedDateTime	string	Time value
name	string	Name of the resource
contentType	object	Type of the resource
size	number	Output field: size
isInline	boolean	Output field: isInline
[email protected]	string	Response data
[email protected]	string	Response data
item	object	Output field: item
[email protected]	string	Response data
item.id	string	Unique identifier
item.createdDateTime	string	Time value
item.lastModifiedDateTime	string	Time value
item.receivedDateTime	string	Time value
item.sentDateTime	string	Time value
item.hasAttachments	boolean	Output field: item.hasAttachments
item.internetMessageId	string	Unique identifier
item.subject	string	Output field: item.subject
item.bodyPreview	string	Request body data
item.importance	string	Output field: item.importance
item.conversationId	string	Unique identifier

Output Example

{"@odata.context":"string","@odata.type":"string","id":"12345678-1234-1234-1234-123456789abc","lastModifiedDateTime":"string","name":"Example Name","contentType":{},"size":123,"isInline":true,"[email protected]":"string","[email protected]":"string","item":{"@odata.type":"string","id":"12345678-1234-1234-1234-123456789abc","createdDateTime":"string","lastModifiedDateTime":"string","receivedDateTime":"string","sentDateTime":"string","hasAttachments":true,"internetMessageId":"stri...

Export Email as EML

Export a specific email as an EML file from Microsoft Graph API using the provided email ID and address.

Endpoint

URL: /v1.0/users/{{email_address}}/messages/{{id}}/$value

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.email_address	string	Required	Parameters for the Export Email as EML action
path_parameters.id	string	Required	Parameters for the Export Email as EML action
filename	string	Optional	Filename for the generated eml file. Default - .eml

Input Example

{"path_parameters":{"email_address":"[email protected]","id":"KH5kvS_JT3JBwCGdzOUGK1yRYre5W5mstJUAAAAAAEMAACGdzOUGK1yRYre5W5mstJUAAOQSnsJAAA="}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
file	object	Attachments
file.file	string	Output field: file.file
file.file_name	string	Name of the resource

Output Example

{"file":{"file":"string","file_name":"Example Name"}}

Forward Email

Forward an email from a specified address to selected recipients with an optional comment using Microsoft Graph API.

Endpoint

URL: /v1.0/users/{{email_address}}/messages/{{email_id}}/forward

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.email_address	string	Required	The account associated with the email
path_parameters.email_id	string	Required	The ID of the email
comment	string	Optional	A comment to include. Can be an empty string.
toRecipients	array	Optional	The list of direct recipient objects.
toRecipients.emailAddress	object	Required	Parameter for Forward Email
toRecipients.emailAddress.address	string	Required	Parameter for Forward Email
toRecipients.emailAddress.name	string	Optional	Name of the resource

Input Example

{"path_parameters":{"email_address":"string","email_id":"string"},"comment":"string","toRecipients":[{"emailAddress":{"address":"string","name":"Example Name"}}]}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"response_text":"string"}

Get a User

Retrieve a user account from Microsoft Graph API using the sign-in name to access detailed user information.

Endpoint

URL: /v1.0/users

Method: GET

Input

Argument Name	Type	Required	Description
parameters.$select	string	Optional	Select results.
parameters.$filter	string	Optional	Filters results (rows).
parameters.$count	boolean	Optional	Include count of items.
parameters.$expand	string	Optional	Expand related entities.
parameters.$orderby	string	Optional	Order items by property values.
parameters.$search	string	Optional	Search items by search phrases.
parameters.$top	integer	Optional	Show only the first n items.

Input Example

{"parameters":{"$select":"string","$filter":"string","$count":true,"$expand":"string","$orderby":"string","$search":"string","$top":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
value	array	Value for the parameter
value.businessPhones	array	Value for the parameter
value.businessPhones.file_name	string	Name of the resource
value.businessPhones.file	string	Value for the parameter
value.displayName	string	Name of the resource
value.givenName	object	Name of the resource
value.jobTitle	object	Value for the parameter
value.mail	object	Value for the parameter
value.mobilePhone	object	Value for the parameter
value.officeLocation	object	Value for the parameter
value.preferredLanguage	object	Value for the parameter
value.surname	object	Name of the resource
value.userPrincipalName	string	Name of the resource
value.id	string	Unique identifier

Output Example

{"@odata.context":"string","value":[{"businessPhones":[],"displayName":"Example Name","givenName":{},"jobTitle":{},"mail":{},"mobilePhone":{},"officeLocation":{},"preferredLanguage":{},"surname":{},"userPrincipalName":"Example Name","id":"12345678-1234-1234-1234-123456789abc"}]}

Get Email Attachments

Retrieve all attachments from a specific email by providing the email address and email ID using Microsoft Graph API.

Endpoint

URL: /v1.0/users/{{email_address}}/messages/{{email_id}}/attachments

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.email_address	string	Required	The account associated with the email
path_parameters.email_id	string	Required	The ID of the email to retrieve attachments from
parameters.$expand	string	Optional	To get the properties of an item attachment (contact, event, or message).
remove_content_bytes	boolean	Optional	The account associated with the email

Input Example

{"parameters":{"$expand":"microsoft.graph.itemattachment/item"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
attachments	array	Output field: attachments
attachments.0	object	Output field: attachments.0
attachments.0.file_name	string	Name of the resource
attachments.0.file	string	Output field: attachments.0.file
@odata.context	string	Response data
value	array	Value for the parameter
[email protected]	string	Response data
[email protected]	string	Response data
value.id	string	Unique identifier
value.lastModifiedDateTime	string	Value for the parameter
value.name	string	Name of the resource
value.contentType	string	Type of the resource
value.size	number	Value for the parameter
value.isInline	boolean	Value for the parameter
value.contentId	object	Unique identifier
value.contentLocation	object	Value for the parameter

Output Example

{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#users('integrations%40swimlaneintegra...","value":[{"@odata.type":"#microsoft.graph.fileAttachment","@odata.mediaContentType":"image/png","id":"AAMkADMxZmU3ZWQ4LTMzNGItNGY3ZC1iM2UxLWM3MDQzOGVjMzlkNwBGAAAAAAAHYPwuVwMWSrFeyLv6...","lastModifiedDateTime":"2022-05-11T04:55:25Z","name":"test_file.png","contentType":"image/png","size":1569,"isInline":false,"contentId":null,"contentLocation":null}]}

Get Emails

Fetch a list of emails from a specified email address using Microsoft Graph API by providing the email address as a path parameter.

Endpoint

URL: /v1.0/users/{{email_address}}/messages

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.email_address	string	Required	The account associated with the email
parameters.count	string	Optional	Include a count of the total number of items in a collection alongside the page of data values returned from Microsoft Graph
parameters.filter	string	Optional	Use the $filter query parameter to retrieve just a subset of a collection. For guidance on using $filter, see https://learn.microsoft.com/en-us/graph/filter-query-parameter
parameters.orderby	string	Optional	To sort the results in ascending or descending order, append either asc or desc to the field name, separated by a space.
parameters.top	number	Optional	Sets the page size of results
headers	object	Optional	HTTP headers for the request
headers.Prefer	string	Optional	The format of the body and uniqueBody properties to be returned in. Values can be "text" or "html". A Preference-Applied header is returned as confirmation if this Prefer header is specified. If the header is not specified, the body and uniqueBody properties are returned in HTML format.

Input Example

{"headers":{"Prefer":"outlook.body-content-type='text'"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
@odata.count	number	Response data
value	array	Value for the parameter
[email protected]	string	Response data
value.id	string	Unique identifier
value.createdDateTime	string	Value for the parameter
value.lastModifiedDateTime	string	Value for the parameter
value.changeKey	string	Value for the parameter
value.categories	array	Value for the parameter
value.categories.file_name	string	Name of the resource
value.categories.file	string	Value for the parameter
value.receivedDateTime	string	Value for the parameter
value.sentDateTime	string	Value for the parameter
value.hasAttachments	boolean	Value for the parameter
value.internetMessageId	string	Unique identifier
value.subject	string	Value for the parameter
value.bodyPreview	string	Request body data
value.importance	string	Value for the parameter
value.parentFolderId	string	Unique identifier
value.conversationId	string	Unique identifier
value.conversationIndex	string	Value for the parameter
value.isDeliveryReceiptRequested	object	Value for the parameter
value.isReadReceiptRequested	boolean	Value for the parameter

Output Example

{"@odata.context":"string","@odata.count":123,"value":[{"@odata.etag":"string","id":"12345678-1234-1234-1234-123456789abc","createdDateTime":"string","lastModifiedDateTime":"string","changeKey":"string","categories":[],"receivedDateTime":"string","sentDateTime":"string","hasAttachments":true,"internetMessageId":"string","subject":"string","bodyPreview":"string","importance":"string","parentFolderId":"string","conversationId":"string"}],"@odata.nextLink":"string"}

Get Emails from a Folder

Fetch emails from a specified folder in a user's mailbox using the provided email address and folder ID via Microsoft Graph API.

Endpoint

URL: /v1.0/users/{{email_address}}/mailFolders/{{folder_id}}/messages

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.email_address	string	Required	The account associated with the email
path_parameters.folder_id	string	Required	The Folder to get emails from
parameters.count	string	Optional	Include a count of the total number of items in a collection alongside the page of data values returned from Microsoft Graph
parameters.filter	string	Optional	Use the $filter query parameter to retrieve just a subset of a collection. For guidance on using $filter, see https://learn.microsoft.com/en-us/graph/filter-query-parameter
parameters.orderby	string	Optional	To sort the results in ascending or descending order, append either asc or desc to the field name, separated by a space.
parameters.top	number	Optional	Sets the page size of results
headers	object	Optional	HTTP headers for the request
headers.Prefer	string	Optional	The format of the body and uniqueBody properties to be returned in. Values can be "text" or "html". A Preference-Applied header is returned as confirmation if this Prefer header is specified. If the header is not specified, the body and uniqueBody properties are returned in HTML format.

Input Example

{"headers":{"Prefer":"outlook.body-content-type='text'"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
@odata.count	number	Response data
value	array	Value for the parameter
[email protected]	string	Response data
value.id	string	Unique identifier
value.createdDateTime	string	Value for the parameter
value.lastModifiedDateTime	string	Value for the parameter
value.changeKey	string	Value for the parameter
value.categories	array	Value for the parameter
value.categories.file_name	string	Name of the resource
value.categories.file	string	Value for the parameter
value.receivedDateTime	string	Value for the parameter
value.sentDateTime	string	Value for the parameter
value.hasAttachments	boolean	Value for the parameter
value.internetMessageId	string	Unique identifier
value.subject	string	Value for the parameter
value.bodyPreview	string	Request body data
value.importance	string	Value for the parameter
value.parentFolderId	string	Unique identifier
value.conversationId	string	Unique identifier
value.conversationIndex	string	Value for the parameter
value.isDeliveryReceiptRequested	object	Value for the parameter
value.isReadReceiptRequested	boolean	Value for the parameter

Output Example

Get Emails From Folder

Fetch emails from a specified folder in a user's Microsoft Graph API account using the provided email address and folder ID.

Endpoint

URL: /v1.0/users/{{email_address}}/mailFolders/{{folder_id}}/messages

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.email_address	string	Required	The account associated with the email
path_parameters.folder_id	string	Required	The folder ID, or a well-known folder name. For a list of supported well-known folder names, see https://learn.microsoft.com/en-us/graph/api/resources/mailfolder?view=graph-rest-1.0
parameters.count	string	Optional	Include a count of the total number of items in a collection alongside the page of data values returned from Microsoft Graph
parameters.filter	string	Optional	Use the $filter query parameter to retrieve just a subset of a collection. For guidance on using $filter, see https://learn.microsoft.com/en-us/graph/filter-query-parameter
parameters.orderby	string	Optional	To sort the results in ascending or descending order, append either asc or desc to the field name, separated by a space.
parameters.top	number	Optional	Sets the page size of results

Input Example

{"path_parameters":{"email_address":"string","folder_id":"string"},"parameters":{"count":"false","filter":"string","orderby":"string","top":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
@odata.count	number	Response data
value	array	Value for the parameter
[email protected]	string	Response data
value.id	string	Unique identifier
value.createdDateTime	string	Value for the parameter
value.lastModifiedDateTime	string	Value for the parameter
value.changeKey	string	Value for the parameter
value.categories	array	Value for the parameter
value.categories.file_name	string	Name of the resource
value.categories.file	string	Value for the parameter
value.receivedDateTime	string	Value for the parameter
value.sentDateTime	string	Value for the parameter
value.hasAttachments	boolean	Value for the parameter
value.internetMessageId	string	Unique identifier
value.subject	string	Value for the parameter
value.bodyPreview	string	Request body data
value.importance	string	Value for the parameter
value.parentFolderId	string	Unique identifier
value.conversationId	string	Unique identifier
value.conversationIndex	string	Value for the parameter
value.isDeliveryReceiptRequested	boolean	Value for the parameter
value.isReadReceiptRequested	boolean	Value for the parameter

Output Example

Get Folders

Retrieve all email folders for a specified email address to enable organized access and management of mailbox folder data using Microsoft Graph API.

Endpoint

URL: v1.0/users/{{email_address}}/mailFolders

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.email_address	string	Required	The account associated with the email
parameters.include_hidden_folders	boolean	Optional	Include hidden folders in the results

Input Example

{"path_parameters":{"email_address":"string"},"parameters":{"include_hidden_folders":true}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
value	array	Value for the parameter
value.id	string	Unique identifier
value.displayName	string	Name of the resource
value.parentFolderId	string	Unique identifier
value.childFolderCount	number	Value for the parameter
value.unreadItemCount	number	Value for the parameter
value.totalItemCount	number	Value for the parameter
value.sizeInBytes	number	Value for the parameter
value.isHidden	boolean	Unique identifier
@odata.nextLink	string	Response data

Output Example

{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#users('integrations%40swimlaneintegra...","value":[{"id":"AQMkADMxZmU3ZWQ4LTMzADRiLTRmN2QtYjNlMS1jNzA0MzhlYzM5ZDcALgAAAwdg-C5XAxZKsV7Iu-pcczMBAIElFP3_iINMukuDjlG8_QIAAAIBOwAAAA==","displayName":"Archive","parentFolderId":"AQMkADMxZmU3ZWQ4LTMzADRiLTRmN2QtYjNlMS1jNzA0MzhlYzM5ZDcALgAAAwdg-C5XAxZKsV7Iu-pcczMBAIElFP3_iINMukuDjlG8_QIAAAIBCAAAAA==","childFolderCount":0,"unreadItemCount":1,"totalItemCount":7,"sizeInBytes":777420,"isHidden":fa...

Get Group

Fetch the properties and relationships of a Microsoft Graph group using its ID, unique name, or exact display name.

Endpoint

URL: /v1.0/groups/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The group ID, uniqueName alternate key, or exact display name used to look up the group. Display name lookup fails if zero or multiple groups match.
parameters.$select	string	Optional	Comma-separated list of properties to return.
parameters.$expand	string	Optional	Comma-separated list of relationships to include.

Input Example

{"parameters":{"$select":"id,displayName,description,mail"},"path_parameters":{"id":"f0b2d6f5-097d-4177-91af-a24e530b53cc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
id	string	Unique identifier
displayName	string	Name of the resource
description	string	Output field: description
mail	string	Output field: mail
mailEnabled	boolean	Output field: mailEnabled
mailNickname	string	Name of the resource
securityEnabled	boolean	Output field: securityEnabled
securityIdentifier	string	Unique identifier
visibility	string	Output field: visibility
groupTypes	array	Type of the resource
proxyAddresses	array	Output field: proxyAddresses
membershipRule	string	Output field: membershipRule
membershipRuleProcessingState	string	Output field: membershipRuleProcessingState
createdDateTime	string	Time value
renewedDateTime	string	Time value

Output Example

{"@odata.context":"string","id":"12345678-1234-1234-1234-123456789abc","displayName":"Example Name","description":"string","mail":"string","mailEnabled":true,"mailNickname":"Example Name","securityEnabled":true,"securityIdentifier":"string","visibility":"string","groupTypes":["string"],"proxyAddresses":["string"],"membershipRule":"string","membershipRuleProcessingState":"string","createdDateTime":"string"}

Get List of Child Folders

Retrieve all child folders within a specified parent folder using the provided email address and folder ID from Microsoft Graph API.

Endpoint

URL: /v1.0/users/{{email_address}}/mailFolders/{{folder_id}}/childFolders

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.email_address	string	Required	The account associated with the email.
path_parameters.folder_id	string	Required	The mailFolder's unique identifier.
parameters.includeHiddenFolders	boolean	Optional	To include hidden child folders in the response.

Input Example

{"parameters":{"includeHiddenFolders":true},"path_parameters":{"email_address":"[email protected]","folder_id":"AQMkADAwATNiZmYAZC1jODNkLTI5MjUtMDACLTAwCgAuAAAD4NNqHYKaBkOb7N4GZr"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
value	array	Value for the parameter
value.id	string	Unique identifier
value.displayName	string	Name of the resource
value.parentFolderId	string	Unique identifier
value.childFolderCount	number	Value for the parameter
value.unreadItemCount	number	Value for the parameter
value.totalItemCount	number	Value for the parameter
value.sizeInBytes	number	Value for the parameter
value.isHidden	boolean	Unique identifier

Output Example

{"@odata.context":"string","value":[{"id":"12345678-1234-1234-1234-123456789abc","displayName":"Example Name","parentFolderId":"string","childFolderCount":123,"unreadItemCount":123,"totalItemCount":123,"sizeInBytes":123,"isHidden":true}]}

Get Manager Root Level

Retrieve the root-level details of a user's direct manager in Microsoft Graph API using the user's ID or userPrincipalName.

Endpoint

URL: v1.0/users/{{id|userPrincipalName}}

Method: GET

Input

Argument Name	Type	Required	Description
`path_parameters.id	userPrincipalName`	string	Required	The user's ID or UserPrincipalName
headers	object	Optional	HTTP headers for the request
headers.ConsistencyLevel	string	Optional	Required when the request includes the $levels=n in the $expand query parameter.
parameters.$levels	string	Optional	The n value of $levels can be max (to return all managers) or a number between 1 and 1000.
parameters.$select	string	Optional	To select the individual Manager's properties.
parameters.$expand	string	Optional	To retrieve the Manager's Information for specified Levels, Selected ID and DisplayName.

Input Example

{"parameters":{"$levels":"max","$select":"id","$expand":"manager($levels=max;$select=id,displayName)"},"path_parameters":{"id|userPrincipalName":"357b1656-cfad-4b3f-a4c4-4a03bdcd6468"},"headers":{"ConsistencyLevel":"eventual"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
businessPhones	array	Output field: businessPhones
businessPhones.file_name	string	Name of the resource
businessPhones.file	string	Output field: businessPhones.file
displayName	string	Name of the resource
givenName	object	Name of the resource
jobTitle	object	Output field: jobTitle
mail	string	Output field: mail
mobilePhone	object	Output field: mobilePhone
officeLocation	object	Output field: officeLocation
preferredLanguage	object	Output field: preferredLanguage
surname	object	Name of the resource
userPrincipalName	string	Name of the resource
id	string	Unique identifier

Output Example

{"@odata.context":"string","businessPhones":[{"file_name":"Example Name","file":"string"}],"displayName":"Example Name","givenName":{},"jobTitle":{},"mail":"string","mobilePhone":{},"officeLocation":{},"preferredLanguage":{},"surname":{},"userPrincipalName":"Example Name","id":"12345678-1234-1234-1234-123456789abc"}

Get Presence

Retrieve the current presence status of a user from Microsoft Graph API using their unique ID as a path parameter.

Endpoint

URL: /users/{{id}}/presence

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The unique identifier of the user.

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
availability	string	Output field: availability
activity	string	Output field: activity
outOfOfficeSettings	object	Output field: outOfOfficeSettings
outOfOfficeSettings.message	object	Response message
outOfOfficeSettings.isOutOfOffice	boolean	Output field: outOfOfficeSettings.isOutOfOffice
sequenceNumber	string	Output field: sequenceNumber

Output Example

{"id":"66825e03-7ef5-42da-9069-724602c31f6b","availability":"DoNotDisturb","activity":"Presenting","outOfOfficeSettings":{"message":null,"isOutOfOffice":false},"sequenceNumber":"A0129311063"}

Get User by ID

Retrieve detailed information for a specific user in Microsoft Graph API using the user's unique ID as a path parameter.

Endpoint

URL: v1.0/users/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Get User by ID action
parameters.$select	string	Optional	Parameters for the Get User by ID action

Input Example

{"parameters":{"$select":"displayName,givenName,postalCode"},"path_parameters":{"id":"87d349ed-44d7-43e1-9a83-5f2406dee5bd"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
businessPhones	array	Output field: businessPhones
displayName	string	Name of the resource
givenName	string	Name of the resource
jobTitle	string	Output field: jobTitle
mail	string	Output field: mail
mobilePhone	string	Output field: mobilePhone
officeLocation	string	Output field: officeLocation
preferredLanguage	string	Output field: preferredLanguage
surname	string	Name of the resource
userPrincipalName	string	Name of the resource
id	string	Unique identifier

Output Example

{"businessPhones":["string"],"displayName":"Example Name","givenName":"Example Name","jobTitle":"string","mail":"string","mobilePhone":"string","officeLocation":"string","preferredLanguage":"string","surname":"Example Name","userPrincipalName":"Example Name","id":"12345678-1234-1234-1234-123456789abc"}

List a Users Direct Membership

Retrieve direct group memberships, directory roles, and administrative units for a user in Microsoft Graph API using their email address.

Endpoint

URL: /v1.0/users/{{email_address}}/memberOf

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.email_address	string	Required	The account associated with the email.
parameters.$filter	string	Optional	Filters results (rows).
parameters.$count	string	Optional	Include count of items.
parameters.$search	string	Optional	Search items by search phrases.

Input Example

{"parameters":{"$search":"search","$count":"count","$filter":"filter"},"path_parameters":{"email_address":"[email protected]"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
value	array	Value for the parameter
[email protected]	string	Response data
value.id	string	Unique identifier
value.deletedDateTime	object	Value for the parameter
value.description	string	Value for the parameter
value.displayName	string	Name of the resource
value.roleTemplateId	string	Unique identifier
value.isMemberManagementRestricted	boolean	Value for the parameter
value.membershipRule	object	Value for the parameter
value.membershipType	object	Type of the resource
value.membershipRuleProcessingState	object	Value for the parameter
value.visibility	object	Value for the parameter

Output Example

{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#directoryObjects","value":[{"@odata.type":"#microsoft.graph.directoryRole","id":"4c04548e-9bc4-45fb-8738-168610ddbe0c","deletedDateTime":null,"description":"Can manage all aspects of Azure AD and Microsoft services that use Azure AD identities.","displayName":"Global Administrator","roleTemplateId":"62e90394-69f5-4237-9190-012177145e10"},{"@odata.type":"#microsoft.graph.directoryRole","id":"417c2fd9-6d31-4d37-927f-a6e54d37a4a4","delet...

List Analyzed Emails

Retrieve a comprehensive list of analyzed email objects and their properties from Microsoft Graph API.

Endpoint

URL: /beta/security/collaboration/analyzedEmails

Method: GET

Input

Argument Name	Type	Required	Description
parameters.$count	boolean	Optional	Retrieves the total count of matching resources.
parameters.$filter	string	Optional	Use the filter query parameter to retrieve just a subset of a collection. For guidance on using filter, see https://learn.microsoft.com/en-us/graph/filter-query-parameter.
parameters.$top	number	Optional	Sets the page size of results.
parameters.$skiptoken	string	Optional	Retrieves the next page of results from result sets that span multiple pages. (Some APIs use $skip instead.)
parameters.startTime	string	Optional	The start time of the email search.
parameters.endTime	string	Optional	The end time of the email search.

Input Example

{"parameters":{"$count":true,"$filter":"startswith(givenName, 'J')","$top":10,"$skiptoken":"X%274453707402000100000017"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
value	array	Value for the parameter
[email protected]	string	Response data
value.id	string	Unique identifier
value.loggedDateTime	string	Value for the parameter
value.networkMessageId	string	Unique identifier
value.internetMessageId	string	Unique identifier
value.senderDetail	object	Value for the parameter
[email protected]	string	Response data
value.recipientEmailAddress	string	Value for the parameter
value.distributionList	string	Value for the parameter
value.subject	string	Value for the parameter
value.returnPath	string	Value for the parameter
value.directionality	string	Value for the parameter
value.originalDelivery	object	Value for the parameter
[email protected]	string	Response data
value.latestDelivery	object	Value for the parameter
[email protected]	string	Response data
value.attachmentsCount	string	Value for the parameter
value.urlsCount	string	URL endpoint for the request
value.language	string	Value for the parameter
value.sizeInBytes	string	Value for the parameter
value.alertIds	array	Unique identifier
value.exchangeTransportRules	array	Value for the parameter

Output Example

{"value":[{"@odata.type":"string","id":"12345678-1234-1234-1234-123456789abc","loggedDateTime":"string","networkMessageId":"string","internetMessageId":"string","senderDetail":{},"recipientEmailAddress":"string","distributionList":"string","subject":"string","returnPath":"string","directionality":"string","originalDelivery":{},"latestDelivery":{},"attachmentsCount":"string","urlsCount":"string"}]}

List Group Members

Retrieve the direct members of a specified group in Microsoft Graph by providing the group ID.

Endpoint

URL: /v1.0/groups/{{group-id}}/members

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.group-id	string	Required	The unique identifier of the group whose members will be listed.
parameters.$top	number	Optional	Sets the page size of results.
parameters.$skiptoken	string	Optional	Retrieves the next page of results from a paginated response.
parameters.$select	string	Optional	Comma-separated list of member properties to return.

Input Example

{"parameters":{"$top":100,"$select":"id,displayName,userPrincipalName"},"path_parameters":{"group-id":"f0b2d6f5-097d-4177-91af-a24e530b53cc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
@odata.nextLink	string	Response data
value	array	Value for the parameter
[email protected]	string	Response data
value.id	string	Unique identifier
value.displayName	string	Name of the resource
value.userPrincipalName	string	Name of the resource
value.mail	string	Value for the parameter
value.mailEnabled	boolean	Value for the parameter
value.securityEnabled	boolean	Value for the parameter
value.appId	string	Unique identifier

Output Example

{"@odata.context":"string","@odata.nextLink":"string","value":[{"@odata.type":"string","id":"12345678-1234-1234-1234-123456789abc","displayName":"Example Name","userPrincipalName":"Example Name","mail":"string","mailEnabled":true,"securityEnabled":true,"appId":"string"}]}

List Risk Detections

Retrieve Microsoft Entra ID Protection risk detection events with details such as event type, affected user, IP address, location, and timestamps for enhanced security analysis.

Endpoint

URL: /v1.0/identityProtection/riskDetections

Method: GET

Input

Argument Name	Type	Required	Description
parameters.$filter	string	Optional	OData filter for detections, such as a user ID, user principal name, risk event type, risk level, or detection timestamp.
parameters.$select	string	Optional	Comma-separated detection properties to return.
parameters.$top	number	Optional	Number of detections to return per page, from 1 through 500.

Input Example

{"parameters":{"$filter":"string","$select":"string","$top":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code returned by Microsoft Graph.
reason	string	HTTP reason phrase returned by Microsoft Graph.
@odata.context	string	Response data
@odata.nextLink	string	URL for the next page when more detections are available.
value	array	Individual Microsoft Entra ID Protection risk detections.
value.id	string	Unique identifier
value.requestId	string	Unique identifier
value.correlationId	string	Unique identifier
value.riskEventType	string	Detection type, such as impossibleTravel, unfamiliarFeatures, leakedCredentials, or maliciousIPAddress.
value.riskState	string	Value for the parameter
value.riskLevel	string	Value for the parameter
value.riskDetail	string	Value for the parameter
value.source	string	Value for the parameter
value.detectionTimingType	string	Type of the resource
value.activity	string	Value for the parameter
value.tokenIssuerType	string	Type of the resource
value.ipAddress	string	Value for the parameter
value.location	object	Value for the parameter
value.location.city	string	Value for the parameter
value.location.state	string	Value for the parameter
value.location.countryOrRegion	string	Value for the parameter
value.location.geoCoordinates	object	Value for the parameter
value.location.geoCoordinates.latitude	number	Value for the parameter
value.location.geoCoordinates.longitude	number	Value for the parameter
value.location.geoCoordinates.altitude	number	Value for the parameter

Output Example

{"@odata.context":"string","@odata.nextLink":"string","value":[{"id":"12345678-1234-1234-1234-123456789abc","requestId":"string","correlationId":"string","riskEventType":"string","riskState":"string","riskLevel":"string","riskDetail":"string","source":"string","detectionTimingType":"string","activity":"string","tokenIssuerType":"string","ipAddress":"string","location":{},"activityDateTime":"string","detectedDateTime":"string"}]}

List riskyUsers

Retrieve a list of riskyUser objects from Microsoft Graph API to identify potential security risks without requiring additional inputs.

Endpoint

URL: /v1.0/identityProtection/riskyUsers

Method: GET

Input

Argument Name	Type	Required	Description
parameters.$filter	string	Optional	Filters results (rows).
parameters.$select	string	Optional	Filters properties (columns).
parameters.$top	number	Optional	Sets the page size of results. The maximum page size with top is 500 objects.

Input Example

{"parameters":{"$filter":"riskLevel eq 'high' ","$select":"givenName,surname","$top":10}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
value	array	Value for the parameter
[email protected]	string	Response data
value.id	string	Unique identifier
value.isDeleted	boolean	Value for the parameter
value.isProcessing	boolean	Value for the parameter
value.riskLastUpdatedDateTime	string	Value for the parameter
value.riskLevel	string	Value for the parameter
value.riskState	string	Value for the parameter
value.riskDetail	string	Value for the parameter
value.userDisplayName	string	Name of the resource
value.userPrincipalName	string	Name of the resource

Output Example

{"value":[{"@odata.type":"#microsoft.graph.riskyUser","id":"d1d4a5d4-a5d4-d1d4-d4a5-d4d1d4a5d4d1","isDeleted":true,"isProcessing":true,"riskLastUpdatedDateTime":"2025-06-05T05:18:27Z","riskLevel":"High","riskState":"Active","riskDetail":"Suspicious activity detected","userDisplayName":"John Doe","userPrincipalName":"[email protected]"}]}

List Password Methods

Retrieve all registered password authentication methods for a user in Microsoft Graph API by specifying the user's ID.

Endpoint

URL: /v1.0/users/{{id}}/authentication/passwordMethods

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	User ID

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
value	array	Value for the parameter
value.id	string	Unique identifier
value.password	object	Value for the parameter
value.creationDateTime	object	Value for the parameter
value.createdDateTime	object	Value for the parameter

Output Example

{"@odata.context":"string","value":[{"id":"12345678-1234-1234-1234-123456789abc","password":{},"creationDateTime":{},"createdDateTime":{}}]}

Reset Password

Initiate a password reset for a specified user by providing their ID and authentication method ID using the Microsoft Graph API.

Endpoint

URL: /v1.0/users/{{id}}/authentication/methods/{{methodId}}/resetPassword

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	User ID
path_parameters.methodId	string	Required	Password Method ID
newPassword	string	Optional	The new password. Required for tenants with hybrid password scenarios. If omitted for a cloud-only password, the system returns a system-generated password.
include_uppercase	boolean	Optional	Include Atleast One Uppercase Letter.
include_lowercase	boolean	Optional	Include Atleast One Lowercase Letter.
include_digit	boolean	Optional	Include Atleast One One Digit.
include_special	boolean	Optional	Include Atleast One Special Character.
length	number	Optional	Password length with minimum 20.
auto_generate	boolean	Optional	Auto Generate Random password.

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc","methodId":"string"},"newPassword":"string","include_uppercase":true,"include_lowercase":true,"include_digit":true,"include_special":true,"length":20,"auto_generate":true}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
newPassword	string	Output field: newPassword

Output Example

{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#microsoft.graph.passwordResetResponse","newPassword":"Cuyo5459"}

Get Identity Directory Device Registered User List

Retrieve a list of users registered to a specific device in Microsoft Graph API by providing the device's unique ID.

Endpoint

URL: /v1.0/devices/{{id}}/registeredUsers

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Device ID
parameters.filter	string	Optional	Use the filter query parameter to retrieve just a subset of a collection. For guidance on using filter, see https://learn.microsoft.com/en-us/graph/filter-query-parameter
parameters.orderBy	string	Optional	Use the orderby query parameter to specify the sort order of the items returned from Microsoft Graph.
parameters.top	number	Optional	Sets the page size of results.

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"parameters":{"filter":"string","orderBy":"string","top":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
value	array	Value for the parameter
[email protected]	string	Response data
value.id	string	Unique identifier
value.businessPhones	array	Value for the parameter
value.displayName	string	Name of the resource
value.givenName	string	Name of the resource
value.jobTitle	object	Value for the parameter
value.mail	object	Value for the parameter
value.mobilePhone	object	Value for the parameter
value.officeLocation	object	Value for the parameter
value.preferredLanguage	string	Value for the parameter
value.surname	string	Name of the resource
value.userPrincipalName	string	Name of the resource

Output Example

{"@odata.context":"string","value":[{"@odata.type":"string","id":"12345678-1234-1234-1234-123456789abc","businessPhones":[],"displayName":"Example Name","givenName":"Example Name","jobTitle":{},"mail":{},"mobilePhone":{},"officeLocation":{},"preferredLanguage":"string","surname":"Example Name","userPrincipalName":"Example Name"}]}

Get Identity Directory Objects by IDs List

Retrieve specific users or groups from Microsoft Graph API by providing their IDs and types for precise directory data access.

Endpoint

URL: /v1.0/directoryObjects/getByIds

Method: POST

Input

Argument Name	Type	Required	Description
ids	array	Optional	A collection of IDs for which to return objects. The IDs are GUIDs, represented as strings. You can specify up to 1000 IDs
types	array	Optional	A collection of resource types that specifies the set of resource collections to search, for example user, group, and device objects

Input Example

{"ids":["string"],"types":["string"]}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
value	array	Value for the parameter
[email protected]	string	Response data
value.id	string	Unique identifier
value.deletedDateTime	object	Value for the parameter
value.classification	object	Value for the parameter
value.createdDateTime	string	Value for the parameter
value.creationOptions	array	Value for the parameter
value.description	string	Value for the parameter
value.displayName	string	Name of the resource
value.expirationDateTime	object	Value for the parameter
value.groupTypes	array	Type of the resource
value.isAssignableToRole	object	Value for the parameter
value.mail	string	Value for the parameter
value.mailEnabled	boolean	Value for the parameter
value.mailNickname	string	Name of the resource
value.membershipRule	object	Value for the parameter
value.membershipRuleProcessingState	object	Value for the parameter
value.onPremisesDomainName	object	Name of the resource
value.onPremisesLastSyncDateTime	object	Value for the parameter
value.onPremisesNetBiosName	object	Name of the resource
value.onPremisesSamAccountName	object	Name of the resource
value.onPremisesSecurityIdentifier	object	Unique identifier

Output Example

{"@odata.context":"string","value":[{"@odata.type":"string","id":"12345678-1234-1234-1234-123456789abc","deletedDateTime":{},"classification":{},"createdDateTime":"string","creationOptions":[],"description":"string","displayName":"Example Name","expirationDateTime":{},"groupTypes":[],"isAssignableToRole":{},"mail":"string","mailEnabled":true,"mailNickname":"Example Name","membershipRule":{}}]}

Delete Identity Directory Device Registered User

Remove a registered user from a device in the Microsoft Graph API directory using the specified device ID and user ID.

Endpoint

URL: /v1.0/devices/{{id}}/registeredUsers/{{userId}}/$ref

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Device ID
path_parameters.userId	string	Required	User ID

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc","userId":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
error	object	Error message if any
error.code	string	Error message if any
error.message	string	Response message
error.innerError	object	Error message if any
error.innerError.date	string	Error message if any
error.innerError.request-id	string	Unique identifier
error.innerError.client-request-id	string	Unique identifier

Output Example

{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}

Delete Identity Directory Device

Remove a specific device from the Microsoft Graph Identity Directory by providing its unique device ID as a path parameter.

Endpoint

URL: /v1.0/devices/{{id}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Device ID

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
error	object	Error message if any
error.code	string	Error message if any
error.message	string	Response message
error.innerError	object	Error message if any
error.innerError.date	string	Error message if any
error.innerError.request-id	string	Unique identifier
error.innerError.client-request-id	string	Unique identifier

Output Example

{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}

Get Identity Directory Device

Retrieve detailed information for a specific device in Microsoft Graph Identity Directory using the unique device ID.

Endpoint

URL: /v1.0/devices/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
parameters.filter	string	Optional	Use the filter query parameter to retrieve just a subset of a collection. For guidance on using filter, see https://learn.microsoft.com/en-us/graph/filter-query-parameter
parameters.orderBy	string	Optional	Use the orderby query parameter to specify the sort order of the items returned from Microsoft Graph.
parameters.top	number	Optional	Sets the page size of results.
path_parameters.id	string	Required	Device ID

Input Example

{"parameters":{"filter":"string","orderBy":"string","top":123},"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
id	string	Unique identifier
deletedDateTime	object	Time value
accountEnabled	boolean	Output field: accountEnabled
approximateLastSignInDateTime	string	Time value
complianceExpirationDateTime	object	Time value
createdDateTime	string	Time value
deviceCategory	object	Output field: deviceCategory
deviceId	string	Unique identifier
deviceMetadata	object	Response data
deviceOwnership	string	Output field: deviceOwnership
deviceVersion	number	Output field: deviceVersion
displayName	string	Name of the resource
domainName	object	Name of the resource
enrollmentProfileName	object	Name of the resource
enrollmentType	string	Type of the resource
externalSourceName	object	Name of the resource
isCompliant	boolean	Output field: isCompliant
isManaged	boolean	Output field: isManaged
isRooted	boolean	Output field: isRooted
managementType	string	Type of the resource
manufacturer	string	Output field: manufacturer
mdmAppId	string	Unique identifier

Output Example

{"@odata.context":"string","id":"12345678-1234-1234-1234-123456789abc","deletedDateTime":{},"accountEnabled":true,"approximateLastSignInDateTime":"string","complianceExpirationDateTime":{},"createdDateTime":"string","deviceCategory":{},"deviceId":"string","deviceMetadata":{},"deviceOwnership":"string","deviceVersion":123,"displayName":"Example Name","domainName":{},"enrollmentProfileName":{}}

Create Identity Directory Device

Register a new device in Microsoft Graph by providing account status, display name, operating system, OS version, and device ID.

Endpoint

URL: /v1.0/devices

Method: POST

Input

Argument Name	Type	Required	Description
accountEnabled	boolean	Optional	true if the account is enabled; otherwise, false. Required. Default is true
alternativeSecurityIds	array	Optional	Alternative Security IDs
alternativeSecurityIds.type	number	Optional	Unique identifier
alternativeSecurityIds.identityProvider	string	Optional	Unique identifier
alternativeSecurityIds.key	string	Optional	Unique identifier
displayName	string	Optional	The display name for the device
operatingSystem	string	Optional	The type of operating system on the device
operatingSystemVersion	string	Optional	The version of the operating system on the device
approximateLastSignInDateTime	string	Optional	The timestamp type represents date and time information using ISO 8601 format and is always in UTC time
complianceExpirationDateTime	string	Optional	The timestamp type represents date and time information using ISO 8601 format and is always in UTC time
deviceId	string	Optional	Unique identifier
extensionAttributes	object	Optional	Contains extension attributes 1-15 for the device. The individual extension attributes are not selectable. These properties are mastered in cloud and can be set during creation or update of a device object in Azure AD
extensionAttributes.extensionAttribute1	string	Optional	Parameter for Create Identity Directory Device
extensionAttributes.extensionAttribute2	string	Optional	Parameter for Create Identity Directory Device
extensionAttributes.extensionAttribute3	string	Optional	Parameter for Create Identity Directory Device
extensionAttributes.extensionAttribute4	string	Optional	Parameter for Create Identity Directory Device
extensionAttributes.extensionAttribute5	string	Optional	Parameter for Create Identity Directory Device
extensionAttributes.extensionAttribute6	string	Optional	Parameter for Create Identity Directory Device
extensionAttributes.extensionAttribute7	string	Optional	Parameter for Create Identity Directory Device
extensionAttributes.extensionAttribute8	string	Optional	Parameter for Create Identity Directory Device
extensionAttributes.extensionAttribute9	string	Optional	Parameter for Create Identity Directory Device
extensionAttributes.extensionAttribute10	string	Optional	Parameter for Create Identity Directory Device
extensionAttributes.extensionAttribute11	string	Optional	Parameter for Create Identity Directory Device
extensionAttributes.extensionAttribute12	string	Optional	Parameter for Create Identity Directory Device
extensionAttributes.extensionAttribute13	string	Optional	Parameter for Create Identity Directory Device

Input Example

{"accountEnabled":true,"alternativeSecurityIds":[{"type":123,"identityProvider":"string","key":"string"}],"displayName":"Example Name","operatingSystem":"string","operatingSystemVersion":"string","approximateLastSignInDateTime":"string","complianceExpirationDateTime":"string","deviceId":"string","extensionAttributes":{"extensionAttribute1":"string","extensionAttribute2":"string","extensionAttribute3":"string","extensionAttribute4":"string","extensionAttribute5":"string","extensionAttribute6":"string","extensionAttribute7":"string","extensionAttribute8":"string","extensionAttribute9":"string","extensionAttribute10":"string","extensionAttribute11":"string","extensionAttribute12":"string","extensionAttribute13":"string","extensionAttribute14":"string","extensionAttribute15":"string"},"isCompliant":true,"isManaged":true,"onPremisesLastSyncDateTime":"string","onPremisesSyncEnabled":true,"profileType":"RegisteredDevice","systemLabels":["string"]}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
error	object	Error message if any
error.code	string	Error message if any
error.message	string	Response message
error.innerError	object	Error message if any
error.innerError.date	string	Error message if any
error.innerError.request-id	string	Unique identifier
error.innerError.client-request-id	string	Unique identifier

Output Example

{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}

Add Identity Directory Device Reg User

Endpoint

URL: /v1.0/devices/{{id}}/registeredUsers/$ref

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Device ID
@odata.id	string	Optional	Odata ID Type User

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"@odata.id":"string"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
error	object	Error message if any
error.code	string	Error message if any
error.message	string	Response message
error.innerError	object	Error message if any
error.innerError.date	string	Error message if any
error.innerError.request-id	string	Unique identifier
error.innerError.client-request-id	string	Unique identifier

Output Example

{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}

Get Identity Directory Device Groups List

Retrieve all groups linked to a specific device by providing its directory ID using Microsoft Graph API.

Endpoint

URL: /v1.0/devices/{{id}}/memberOf

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Device ID
parameters.filter	string	Optional	Use the filter query parameter to retrieve just a subset of a collection. For guidance on using filter, see https://learn.microsoft.com/en-us/graph/filter-query-parameter
parameters.orderBy	string	Optional	Use the orderby query parameter to specify the sort order of the items returned from Microsoft Graph.
parameters.top	number	Optional	Sets the page size of results.

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"parameters":{"filter":"string","orderBy":"string","top":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
value	array	Value for the parameter
value.file_name	string	Name of the resource
value.file	string	Value for the parameter

Output Example

{"@odata.context":"string","value":[{"file_name":"Example Name","file":"string"}]}

Get Identity Directory Device List

Retrieve details of registered devices, including identifiers and display names, from the Microsoft Graph Identity Directory.

Endpoint

URL: /v1.0/devices

Method: GET

Input

Argument Name	Type	Required	Description
parameters.$filter	string	Optional	Use the filter query parameter to retrieve just a subset of a collection. For guidance on using filter, see https://learn.microsoft.com/en-us/graph/filter-query-parameter
parameters.$orderBy	string	Optional	Use the orderby query parameter to specify the sort order of the items returned from Microsoft Graph.
parameters.$top	number	Optional	Sets the page size of results.

Input Example

{"parameters":{"$filter":"string","$orderBy":"string","$top":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
@odata.nextLink	string	Response data
value	array	Value for the parameter
value.id	string	Unique identifier
value.deletedDateTime	object	Value for the parameter
value.accountEnabled	boolean	Value for the parameter
value.approximateLastSignInDateTime	string	Value for the parameter
value.complianceExpirationDateTime	object	Value for the parameter
value.createdDateTime	string	Value for the parameter
value.deviceCategory	object	Value for the parameter
value.deviceId	string	Unique identifier
value.deviceMetadata	object	Response data
value.deviceOwnership	string	Value for the parameter
value.deviceVersion	number	Value for the parameter
value.displayName	string	Name of the resource
value.domainName	object	Name of the resource
value.enrollmentProfileName	object	Name of the resource
value.enrollmentType	string	Type of the resource
value.externalSourceName	object	Name of the resource
value.isCompliant	boolean	Value for the parameter
value.isManaged	boolean	Value for the parameter
value.isRooted	boolean	Value for the parameter
value.managementType	string	Type of the resource

Output Example

{"@odata.context":"string","@odata.nextLink":"string","value":[{"id":"12345678-1234-1234-1234-123456789abc","deletedDateTime":{},"accountEnabled":true,"approximateLastSignInDateTime":"string","complianceExpirationDateTime":{},"createdDateTime":"string","deviceCategory":{},"deviceId":"string","deviceMetadata":{},"deviceOwnership":"string","deviceVersion":123,"displayName":"Example Name","domainName":{},"enrollmentProfileName":{},"enrollmentType":"string"}]}

Create Identity Directory Role Member

Add a new member to a directory role in Microsoft Graph API by providing the role's unique ID and the member's @odata.id.

Endpoint

URL: /v1.0/directoryRoles/{{id}}/members/$ref

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Directory Role ID
@odata.id	string	Optional	OData ID Type User

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"@odata.id":"string"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"response_text":"string"}

Delete Identity Directory Role Assignment

Remove a directory role assignment in Microsoft Graph API by specifying the unique role ID.

Endpoint

URL: /v1.0/roleManagement/directory/roleAssignments/{{id}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Role Assignment ID

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
error	object	Error message if any
error.code	string	Error message if any
error.message	string	Response message
error.innerError	object	Error message if any
error.innerError.date	string	Error message if any
error.innerError.request-id	string	Unique identifier
error.innerError.client-request-id	string	Unique identifier

Output Example

{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}

Create Identity Directory Role Management

Create a new directory role in Microsoft Graph API by specifying the display name, enabled status, and role permissions.

Endpoint

URL: /v1.0/roleManagement/directory/roleDefinitions

Method: POST

Input

Argument Name	Type	Required	Description
displayName	string	Optional	The display name for the role definition
isEnabled	boolean	Optional	Flag indicating if the role is enabled for assignment. If false, the role is not available for assignment
rolePermissions	array	Optional	List of permissions included in the role
rolePermissions.allowedResourceActions	array	Optional	Set of tasks that can be performed on a resource
rolePermissions.condition	string	Optional	Optional constraints that must be met for the permission to be effective
rolePermissions.excludedResourceActions	array	Optional	Set of tasks that may not be performed on a resource
description	string	Optional	The description for the unifiedRoleDefinition
id	string	Optional	The unique identifier for the role definition. Key, not nullable, Read-only. Inherited from entity
isBuiltIn	boolean	Optional	Flag indicating whether the role definition is part of the default set included in Azure Active Directory (Azure AD) or a custom definition
resourceScopes	array	Optional	List of the scopes or permissions the role definition applies to
templateId	string	Optional	Custom template identifier that can be set when isBuiltIn is false but is read-only when isBuiltIn is true. This identifier is typically used if one needs an identifier to be the same across different directories
version	string	Optional	Indicates version of the role definition

Input Example

{"displayName":"Example Name","isEnabled":true,"rolePermissions":[{"allowedResourceActions":["string"],"condition":"string","excludedResourceActions":["string"]}],"description":"string","id":"12345678-1234-1234-1234-123456789abc","isBuiltIn":true,"resourceScopes":["string"],"templateId":"string","version":"string"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
error	object	Error message if any
error.code	string	Error message if any
error.message	string	Response message
error.innerError	object	Error message if any
error.innerError.date	string	Error message if any
error.innerError.request-id	string	Unique identifier
error.innerError.client-request-id	string	Unique identifier

Output Example

{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}

Add Directory Administrative Unit Member

Add a member to a specific Directory Administrative Unit in Microsoft Graph API by providing the unit ID and the member's @odata.id.

Endpoint

URL: /v1.0/directory/administrativeUnits/{{id}}/members/$ref

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Unit ID
@odata.id	string	Optional	The OData id of the user, group or DirectoryObject to add

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"@odata.id":"string"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"response_text":"string"}

Delete Directory Administrative Unit Member

Remove a specified member from a Directory Administrative Unit in Microsoft Graph API using the provided unit and member IDs.

Endpoint

URL: /v1.0/directory/administrativeUnits/{{id}}/members/{{memberId}}/$ref

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Unit ID
path_parameters.memberId	string	Required	Member ID

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc","memberId":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"response_text":"string"}

Get Directory Administrative Unit List

Retrieve a list of administrative units from Microsoft Graph API to support efficient directory segmentation and management.

Endpoint

URL: /v1.0/directory/administrativeUnits

Method: GET

Input

Argument Name	Type	Required	Description
parameters.filter	string	Optional	Use the filter query parameter to retrieve just a subset of a collection. For guidance on using filter, see https://learn.microsoft.com/en-us/graph/filter-query-parameter
parameters.orderBy	string	Optional	Use the orderby query parameter to specify the sort order of the items returned from Microsoft Graph.
parameters.top	number	Optional	Sets the page size of results.

Input Example

{"parameters":{"filter":"string","orderBy":"string","top":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
value	array	Value for the parameter
value.id	string	Unique identifier
value.deletedDateTime	object	Value for the parameter
value.displayName	string	Name of the resource
value.description	object	Value for the parameter
value.membershipRule	object	Value for the parameter
value.membershipType	object	Type of the resource
value.membershipRuleProcessingState	object	Value for the parameter
value.visibility	object	Value for the parameter

Output Example

{"@odata.context":"string","value":[{"id":"12345678-1234-1234-1234-123456789abc","deletedDateTime":{},"displayName":"Example Name","description":{},"membershipRule":{},"membershipType":{},"membershipRuleProcessingState":{},"visibility":{}}]}

Get Directory Administrative Unit Member

Retrieve details of a specific member from a Directory Administrative Unit in Microsoft Graph API using the provided unit ID and member ID.

Endpoint

URL: /v1.0/directory/administrativeUnits/{{id}}/members/{{memberId}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	ID
path_parameters.memberId	string	Required	Member ID

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc","memberId":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
@odata.type	string	Response data
id	string	Unique identifier
businessPhones	array	Output field: businessPhones
businessPhones.file_name	string	Name of the resource
businessPhones.file	string	Output field: businessPhones.file
displayName	string	Name of the resource
givenName	string	Name of the resource
jobTitle	object	Output field: jobTitle
mail	string	Output field: mail
mobilePhone	object	Output field: mobilePhone
officeLocation	object	Output field: officeLocation
preferredLanguage	string	Output field: preferredLanguage
surname	object	Name of the resource
userPrincipalName	string	Name of the resource

Output Example

{"@odata.context":"string","@odata.type":"string","id":"12345678-1234-1234-1234-123456789abc","businessPhones":[{"file_name":"Example Name","file":"string"}],"displayName":"Example Name","givenName":"Example Name","jobTitle":{},"mail":"string","mobilePhone":{},"officeLocation":{},"preferredLanguage":"string","surname":{},"userPrincipalName":"Example Name"}

Get Directory Admin Unit Member List

Retrieve a list of members for a specified Directory Administrative Unit in Microsoft Graph API using the unit's unique ID.

Endpoint

URL: /v1.0/directory/administrativeUnits/{{id}}/members

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Unit ID

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
value	array	Value for the parameter
[email protected]	string	Response data
value.id	string	Unique identifier
value.businessPhones	array	Value for the parameter
value.businessPhones.file_name	string	Name of the resource
value.businessPhones.file	string	Value for the parameter
value.displayName	string	Name of the resource
value.givenName	string	Name of the resource
value.jobTitle	object	Value for the parameter
value.mail	string	Value for the parameter
value.mobilePhone	object	Value for the parameter
value.officeLocation	object	Value for the parameter
value.preferredLanguage	string	Value for the parameter
value.surname	object	Name of the resource
value.userPrincipalName	string	Name of the resource

Output Example

{"@odata.context":"string","value":[{"@odata.type":"string","id":"12345678-1234-1234-1234-123456789abc","businessPhones":[],"displayName":"Example Name","givenName":"Example Name","jobTitle":{},"mail":"string","mobilePhone":{},"officeLocation":{},"preferredLanguage":"string","surname":{},"userPrincipalName":"Example Name"}]}

Get Directory Administrative Unit

Retrieve detailed information about a specific Directory Administrative Unit in Microsoft Graph API using its unique ID.

Endpoint

URL: /v1.0/directory/administrativeUnits/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Unit ID
parameters.filter	string	Optional	Use the filter query parameter to retrieve just a subset of a collection. For guidance on using filter, see https://learn.microsoft.com/en-us/graph/filter-query-parameter
parameters.orderBy	string	Optional	Use the orderby query parameter to specify the sort order of the items returned from Microsoft Graph.
parameters.top	number	Optional	Sets the page size of results.

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"parameters":{"filter":"string","orderBy":"string","top":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
id	string	Unique identifier
deletedDateTime	object	Time value
displayName	string	Name of the resource
description	object	Output field: description
isMemberManagementRestricted	boolean	Output field: isMemberManagementRestricted
visibility	object	Output field: visibility
membershipRule	object	Output field: membershipRule
membershipType	object	Type of the resource
membershipRuleProcessingState	object	Output field: membershipRuleProcessingState

Output Example

{"@odata.context":"string","id":"12345678-1234-1234-1234-123456789abc","deletedDateTime":{},"displayName":"Example Name","description":{},"isMemberManagementRestricted":true,"visibility":{},"membershipRule":{},"membershipType":{},"membershipRuleProcessingState":{}}

Delete Identity Directory Role Member

Remove a user from a directory role in Microsoft Graph API by specifying the role ID and member ID.

Endpoint

URL: /v1.0/directoryRoles/{{id}}/members/{{memberId}}/$ref

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Role ID
path_parameters.memberId	string	Required	Member ID

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc","memberId":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
error	object	Error message if any
error.code	string	Error message if any
error.message	string	Response message
error.innerError	object	Error message if any
error.innerError.date	string	Error message if any
error.innerError.request-id	string	Unique identifier
error.innerError.client-request-id	string	Unique identifier

Output Example

{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}

Get Identity Directory Role

Retrieve detailed information about a specific directory role in Microsoft Graph API using the unique role ID.

Endpoint

URL: /v1.0/directoryRoles/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Directory Role ID
parameters.count	string	Optional	Include a count of the total number of items in a collection alongside the page of data values returned from Microsoft Graph
parameters.filter	string	Optional	Use the $filter query parameter to retrieve just a subset of a collection. For guidance on using $filter, see https://learn.microsoft.com/en-us/graph/filter-query-parameter
parameters.orderby	string	Optional	To sort the results in ascending or descending order, append either asc or desc to the field name, separated by a space.
parameters.top	number	Optional	Sets the page size of results

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"parameters":{"count":"false","filter":"string","orderby":"string","top":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
id	string	Unique identifier
deletedDateTime	object	Time value
description	string	Output field: description
displayName	string	Name of the resource
roleTemplateId	string	Unique identifier

Output Example

{"@odata.context":"string","id":"12345678-1234-1234-1234-123456789abc","deletedDateTime":{},"description":"string","displayName":"Example Name","roleTemplateId":"string"}

Get Identity Directory Role Assignment Member

Retrieve directory role assignment details for a specified identity in Microsoft Graph API using the unique identifier.

Endpoint

URL: /v1.0/roleManagement/directory/roleAssignments/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Role Assignment ID

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
error	object	Error message if any
error.code	string	Error message if any
error.message	string	Response message
error.innerError	object	Error message if any
error.innerError.date	string	Error message if any
error.innerError.request-id	string	Unique identifier
error.innerError.client-request-id	string	Unique identifier

Output Example

{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}

Delete Identity Directory Role Management

Remove a specific directory role in Microsoft Graph API by providing the unique role ID as a path parameter.

Endpoint

URL: /v1.0/roleManagement/directory/roleDefinitions/{{id}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Role Management ID

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
error	object	Error message if any
error.code	string	Error message if any
error.message	string	Response message
error.innerError	object	Error message if any
error.innerError.date	string	Error message if any
error.innerError.request-id	string	Unique identifier
error.innerError.client-request-id	string	Unique identifier

Output Example

{"error":{"code":"ResourceNotFound","message":"Invalid version: rolemanagement","innerError":{"date":"2022-12-20T20:37:28","request-id":"14c4462e-7088-48de-adf6-d6283055090d","client-request-id":"14c4462e-7088-48de-adf6-d6283055090d"}}}

Get Identity Directory Role Management List

Retrieve a list of directory roles for identity and access management from Microsoft Graph API.

Endpoint

URL: /v1.0/roleManagement/directory/roleDefinitions

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
value	array	Value for the parameter
value.id	string	Unique identifier
value.description	string	Value for the parameter
value.displayName	string	Name of the resource
value.isBuiltIn	boolean	Value for the parameter
value.isEnabled	boolean	Value for the parameter
value.resourceScopes	array	Value for the parameter
value.templateId	string	Unique identifier
value.version	string	Value for the parameter
value.rolePermissions	array	Value for the parameter
value.rolePermissions.allowedResourceActions	array	Value for the parameter
value.rolePermissions.condition	object	Value for the parameter
[email protected]	string	Response data
value.inheritsPermissionsFrom	array	Value for the parameter
value.inheritsPermissionsFrom.file_name	string	Name of the resource
value.inheritsPermissionsFrom.file	string	Value for the parameter

Output Example

{"@odata.context":"string","value":[{"id":"12345678-1234-1234-1234-123456789abc","description":"string","displayName":"Example Name","isBuiltIn":true,"isEnabled":true,"resourceScopes":[],"templateId":"string","version":"string","rolePermissions":[],"[email protected]":"string","inheritsPermissionsFrom":[]}]}

Get Identity Directory Role Management

Retrieve detailed information for a specific directory role in Microsoft Graph API using the unique role ID.

Endpoint

URL: /v1.0/roleManagement/directory/roleDefinitions/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Role Management ID

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
error	object	Error message if any
error.code	string	Error message if any
error.message	string	Response message
error.innerError	object	Error message if any
error.innerError.date	string	Error message if any
error.innerError.request-id	string	Unique identifier
error.innerError.client-request-id	string	Unique identifier

Output Example

{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}

Delete Identity Directory Domain

Remove a specified domain from your Microsoft tenant by providing the unique domain ID as a path parameter.

Endpoint

URL: v1.0/domains/{{id}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Delete Identity Directory Domain action

Input Example

{"path_parameters":{"id":"myradom.test.directory"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"response_text":"string"}

Get Identity Directory Domain

Retrieve detailed information about a specific domain in Microsoft Graph API using the provided domain ID.

Endpoint

URL: v1.0/domains/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Get Identity Directory Domain action

Input Example

{"path_parameters":{"id":"myradom.test.directory"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
authenticationType	string	Type of the resource
availabilityStatus	object	Status value
id	string	Unique identifier
isAdminManaged	boolean	Output field: isAdminManaged
isDefault	boolean	Output field: isDefault
isInitial	boolean	Output field: isInitial
isRoot	boolean	Output field: isRoot
isVerified	boolean	Output field: isVerified
supportedServices	array	Output field: supportedServices
supportedServices.file_name	string	Name of the resource
supportedServices.file	string	Output field: supportedServices.file
passwordValidityPeriodInDays	object	Unique identifier
passwordNotificationWindowInDays	object	Output field: passwordNotificationWindowInDays
state	object	Output field: state

Output Example

{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#domains/$entity","authenticationType":"Managed","availabilityStatus":null,"id":"myradom.test.directory","isAdminManaged":true,"isDefault":false,"isInitial":false,"isRoot":false,"isVerified":false,"supportedServices":[],"passwordValidityPeriodInDays":null,"passwordNotificationWindowInDays":null,"state":null}

Get Identity Directory Domain List

Retrieve a list of all configured domains from Microsoft Graph API to support efficient identity and directory management.

Endpoint

URL: v1.0/domains

Method: GET

Input

Argument Name	Type	Required	Description
parameters.count	string	Optional	Include a count of the total number of items in a collection alongside the page of data values returned from Microsoft Graph
parameters.filter	string	Optional	Use the $filter query parameter to retrieve just a subset of a collection. For guidance on using $filter, see https://learn.microsoft.com/en-us/graph/filter-query-parameter
parameters.orderby	string	Optional	To sort the results in ascending or descending order, append either asc or desc to the field name, separated by a space.
parameters.top	number	Optional	Sets the page size of results

Input Example

{"parameters":{"count":"false","filter":"string","orderby":"string","top":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
value	array	Value for the parameter
value.authenticationType	string	Type of the resource
value.availabilityStatus	object	Status value
value.id	string	Unique identifier
value.isAdminManaged	boolean	Value for the parameter
value.isDefault	boolean	Value for the parameter
value.isInitial	boolean	Value for the parameter
value.isRoot	boolean	Value for the parameter
value.isVerified	boolean	Value for the parameter
value.supportedServices	array	Value for the parameter
value.passwordValidityPeriodInDays	number	Unique identifier
value.passwordNotificationWindowInDays	number	Value for the parameter
value.state	object	Value for the parameter

Output Example

{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#domains","value":[{"authenticationType":"Managed","availabilityStatus":null,"id":"bestcompanyever.com","isAdminManaged":true,"isDefault":false,"isInitial":false,"isRoot":false,"isVerified":false,"supportedServices":[],"passwordValidityPeriodInDays":null,"passwordNotificationWindowInDays":null,"state":null},{"authenticationType":"Managed","availabilityStatus":null,"id":"swimlaneintegrations.onmicrosoft.com","isAdminManaged":true,"isDef...

Create Identity Directory Domain

Add a new domain to your Microsoft Graph API tenant by providing the domain ID in the request body.

Endpoint

URL: v1.0/domains

Method: POST

Input

Argument Name	Type	Required	Description
authenticationType	string	Optional	Type of the resource
availabilityStatus	string	Optional	Status value
id	string	Optional	Unique identifier
isAdminManaged	boolean	Optional	Parameter for Create Identity Directory Domain
isDefault	boolean	Optional	Parameter for Create Identity Directory Domain
isInitial	boolean	Optional	Parameter for Create Identity Directory Domain
isRoot	boolean	Optional	Parameter for Create Identity Directory Domain
isVerified	boolean	Optional	Parameter for Create Identity Directory Domain
passwordNotificationWindowInDays	number	Optional	Parameter for Create Identity Directory Domain
passwordValidityPeriodInDays	number	Optional	Unique identifier
state	object	Optional	Parameter for Create Identity Directory Domain
[email protected]	string	Optional	Response data
supportedServices	array	Optional	Parameter for Create Identity Directory Domain

Input Example

{"authenticationType":"string","availabilityStatus":"active","id":"12345678-1234-1234-1234-123456789abc","isAdminManaged":true,"isDefault":true,"isInitial":true,"isRoot":true,"isVerified":true,"passwordNotificationWindowInDays":123,"passwordValidityPeriodInDays":123,"state":{"@odata.type":"string"},"supportedServices":["string"]}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
authenticationType	string	Type of the resource
availabilityStatus	object	Status value
id	string	Unique identifier
isAdminManaged	boolean	Output field: isAdminManaged
isDefault	boolean	Output field: isDefault
isInitial	boolean	Output field: isInitial
isRoot	boolean	Output field: isRoot
isVerified	boolean	Output field: isVerified
supportedServices	array	Output field: supportedServices
supportedServices.file_name	string	Name of the resource
supportedServices.file	string	Output field: supportedServices.file
passwordValidityPeriodInDays	object	Unique identifier
passwordNotificationWindowInDays	object	Output field: passwordNotificationWindowInDays
state	object	Output field: state

Output Example

Get Identity Directory Object

Retrieve a specific directory object from Microsoft Graph API using the unique object ID provided in the path parameters.

Endpoint

URL: /v1.0/directoryObjects/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Directory Object ID

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
@odata.type	string	Response data
id	string	Unique identifier
deletedDateTime	object	Time value
classification	object	Output field: classification
createdDateTime	string	Time value
creationOptions	array	Output field: creationOptions
description	string	Output field: description
displayName	string	Name of the resource
expirationDateTime	object	Time value
groupTypes	array	Type of the resource
isAssignableToRole	object	Output field: isAssignableToRole
mail	string	Output field: mail
mailEnabled	boolean	Output field: mailEnabled
mailNickname	string	Name of the resource
membershipRule	object	Output field: membershipRule
membershipRuleProcessingState	object	Output field: membershipRuleProcessingState
onPremisesDomainName	object	Name of the resource
onPremisesLastSyncDateTime	object	Time value
onPremisesNetBiosName	object	Name of the resource
onPremisesSamAccountName	object	Name of the resource
onPremisesSecurityIdentifier	object	Unique identifier
onPremisesSyncEnabled	object	Output field: onPremisesSyncEnabled

Output Example

{"@odata.context":"string","@odata.type":"string","id":"12345678-1234-1234-1234-123456789abc","deletedDateTime":{},"classification":{},"createdDateTime":"string","creationOptions":["string"],"description":"string","displayName":"Example Name","expirationDateTime":{},"groupTypes":["string"],"isAssignableToRole":{},"mail":"string","mailEnabled":true,"mailNickname":"Example Name"}

Get Identity Directory Role Members List

Retrieve users and groups assigned to a specified directory role in Microsoft Graph API using the provided role-id.

Endpoint

URL: v1.0/directoryRoles/{{role-id}}/members

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.role-id	string	Required	Parameters for the Get Identity Directory Role Members List action

Input Example

{"path_parameters":{"role-id":"b8d0b017-384c-40cb-b37b-99ee5d3f8a8f"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
value	array	Value for the parameter
[email protected]	string	Response data
value.id	string	Unique identifier
value.businessPhones	array	Value for the parameter
value.businessPhones.file_name	string	Name of the resource
value.businessPhones.file	string	Value for the parameter
value.displayName	string	Name of the resource
value.givenName	string	Name of the resource
value.jobTitle	object	Value for the parameter
value.mail	string	Value for the parameter
value.mobilePhone	object	Value for the parameter
value.officeLocation	object	Value for the parameter
value.preferredLanguage	object	Value for the parameter
value.surname	string	Name of the resource
value.userPrincipalName	string	Name of the resource

Output Example

{"@odata.context":"string","value":[{"@odata.type":"string","id":"12345678-1234-1234-1234-123456789abc","businessPhones":[],"displayName":"Example Name","givenName":"Example Name","jobTitle":{},"mail":"string","mobilePhone":{},"officeLocation":{},"preferredLanguage":{},"surname":"Example Name","userPrincipalName":"Example Name"}]}

Cancel Security Action

Cancel an ongoing security action in Microsoft Graph API by providing the required action_id as a path parameter.

Endpoint

URL: /beta/security/securityActions/{{action_id}}/cancelSecurityAction

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.action_id	string	Required	Action ID

Input Example

{"path_parameters":{"action_id":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"response_text":"string"}

Create Security Action

Initiate a new security action in Microsoft Graph API by providing the action name, reason, vendor details, and required parameters.

Endpoint

URL: /beta/security/securityActions

Method: POST

Input

Argument Name	Type	Required	Description
name	string	Optional	Action Name
actionReason	string	Optional	Action Reason
vendorInformation	object	Optional	Vendor Information
vendorInformation.vendor	string	Required	Vendor
vendorInformation.provider	string	Required	Provider
parameters	array	Optional	Collection of parameters (key-value pairs) necessary to invoke the action, for example, URL or fileHash to block).
parameters.name	string	Required	Parameters for the Create Security Action action
parameters.value	string	Required	Parameters for the Create Security Action action

Input Example

{"name":"Example Name","actionReason":"string","vendorInformation":{"vendor":"string","provider":"string"},"parameters":[{"name":"Example Name","value":"string"}]}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
error	object	Error message if any
error.code	string	Error message if any
error.message	string	Response message
error.innerError	object	Error message if any
error.innerError.date	string	Error message if any
error.innerError.request-id	string	Unique identifier
error.innerError.client-request-id	string	Unique identifier

Output Example

{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}

Get Security Action

Retrieve detailed information for a specific security action in Microsoft Graph API using the required action_id path parameter.

Endpoint

URL: /beta/security/securityActions/{{action_id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.action_id	string	Required	Action ID
parameters.filter	string	Optional	Use the filter query parameter to retrieve just a subset of a collection. For guidance on using filter, see https://learn.microsoft.com/en-us/graph/filter-query-parameter
parameters.orderBy	string	Optional	Use the orderby query parameter to specify the sort order of the items returned from Microsoft Graph.
parameters.top	number	Optional	Sets the page size of results.

Input Example

{"path_parameters":{"action_id":"string"},"parameters":{"filter":"string","orderBy":"string","top":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
error	object	Error message if any
error.code	string	Error message if any
error.message	string	Response message
error.innerError	object	Error message if any
error.innerError.date	string	Error message if any
error.innerError.request-id	string	Unique identifier
error.innerError.client-request-id	string	Unique identifier

Output Example

{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}

Get Security Actions List

Retrieve configurations and details of security actions from the Microsoft Graph Security API.

Endpoint

URL: /beta/security/securityActions

Method: GET

Input

Argument Name	Type	Required	Description
parameters.filter	string	Optional	Use the filter query parameter to retrieve just a subset of a collection. For guidance on using filter, see https://learn.microsoft.com/en-us/graph/filter-query-parameter
parameters.orderBy	string	Optional	Use the orderby query parameter to specify the sort order of the items returned from Microsoft Graph.
parameters.top	number	Optional	Sets the page size of results.

Input Example

{"parameters":{"filter":"string","orderBy":"string","top":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
value	array	Value for the parameter
value.file_name	string	Name of the resource
value.file	string	Value for the parameter

Output Example

{"@odata.context":"string","value":[{"file_name":"Example Name","file":"string"}]}

Get Alert

Retrieve detailed information for a specific security alert by providing the alert_id using the Microsoft Graph Security API.

Endpoint

URL: /v1.0/security/alerts_v2/{{alert_id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.alert_id	string	Required	ID of the Alert.

Input Example

{"path_parameters":{"alert_id":"fabefb2117-8e9b-d555-b800-08dc0572c0de"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
id	string	Unique identifier
providerAlertId	string	Unique identifier
incidentId	string	Unique identifier
status	string	Status value
severity	string	Output field: severity
classification	string	Output field: classification
determination	string	Output field: determination
serviceSource	string	Output field: serviceSource
detectionSource	string	Output field: detectionSource
productName	string	Name of the resource
detectorId	string	Unique identifier
tenantId	string	Unique identifier
title	string	Output field: title
description	string	Output field: description
recommendedActions	string	Output field: recommendedActions
category	string	Output field: category
assignedTo	string	Output field: assignedTo
alertWebUrl	string	URL endpoint for the request
incidentWebUrl	string	URL endpoint for the request
actorDisplayName	object	Name of the resource
threatDisplayName	object	Name of the resource
threatFamilyName	object	Name of the resource

Output Example

{"@odata.context":"string","id":"12345678-1234-1234-1234-123456789abc","providerAlertId":"string","incidentId":"string","status":"active","severity":"string","classification":"string","determination":"string","serviceSource":"string","detectionSource":"string","productName":"Example Name","detectorId":"string","tenantId":"string","title":"string","description":"string"}

List Alerts

Retrieve security alerts from the Microsoft Graph Security API to monitor potential threats and anomalies.

Endpoint

URL: /v1.0/security/alerts_v2

Method: GET

Input

Argument Name	Type	Required	Description
parameters.$count	string	Optional	Retrieves the total count of matching resources.
parameters.$skip	number	Optional	Indexes into a result set. Also used by some APIs to implement paging and can be used together with $top to manually page results.
parameters.$top	number	Optional	Sets the page size of results.
parameters.$filter	string	Optional	Use the filter query parameter to retrieve just a subset of a collection. For guidance on using filter, see https://learn.microsoft.com/en-us/graph/filter-query-parameter.
parameters.return_as_turbine_schema	boolean	Optional	When true, alerts are mapped to normalized Turbine Schema alert objects and returned in the Alerts field. When false, the raw Microsoft Graph API response is returned.
parameters.alert_organization	string	Optional	Optional organization name to include in the Turbine Schema alert. Used only when return_as_turbine_schema is true.
parameters.ioc_types	array	Optional	List of observable types to extract. Supported: ipv4_public, ipv4_private, ipv6_public, ipv6_private, domain, url, email, sha1, sha256, md5. If omitted or empty, all types are extracted.
parameters.domains_ignore_list	string	Optional	Comma-separated domain values to exclude from observable extraction.
parameters.ip_cidr_ignore_list	string	Optional	Comma-separated CIDR ranges to exclude from observable extraction.
parameters.regex_ignore	string	Optional	Regex pattern — any observable value matching this pattern is excluded.
parameters.ioc_ignore_paths	array	Optional	Array of slash-separated field paths to strip from each alert before extracting observables. Supports wildcards () and nested paths. Example: ["processCommandLine", "context//ipAddress"].

Input Example

{"parameters":{"$count":"string","$skip":123,"$top":123,"$filter":"string","return_as_turbine_schema":true,"alert_organization":"string","ioc_types":["string"],"domains_ignore_list":"string","ip_cidr_ignore_list":"string","regex_ignore":"string","ioc_ignore_paths":["string"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
Alerts	array	Normalized Turbine Schema alerts (when return_as_turbine_schema is true).
total_processed	integer	Number of Turbine Schema alerts returned.
@odata.context	string	Response data
value	array	Value for the parameter
value.id	string	Unique identifier
value.providerAlertId	string	Unique identifier
value.incidentId	string	Unique identifier
value.status	string	Status value
value.severity	string	Value for the parameter
value.classification	string	Value for the parameter
value.determination	string	Value for the parameter
value.serviceSource	string	Value for the parameter
value.detectionSource	string	Value for the parameter
value.productName	string	Name of the resource
value.detectorId	string	Unique identifier
value.tenantId	string	Unique identifier
value.title	string	Value for the parameter
value.description	string	Value for the parameter
value.recommendedActions	string	Value for the parameter
value.category	string	Value for the parameter
value.assignedTo	string	Value for the parameter
value.alertWebUrl	string	URL endpoint for the request
value.incidentWebUrl	string	URL endpoint for the request

Output Example

{"Alerts":[],"total_processed":123,"@odata.context":"string","value":[{"id":"12345678-1234-1234-1234-123456789abc","providerAlertId":"string","incidentId":"string","status":"active","severity":"string","classification":"string","determination":"string","serviceSource":"string","detectionSource":"string","productName":"Example Name","detectorId":"string","tenantId":"string","title":"string","description":"string","recommendedActions":"string"}]}

Get Control Profile

Retrieve detailed information for a specific security control profile using its unique ID from the Microsoft Graph Security API.

Endpoint

URL: /v1.0/security/secureScoreControlProfiles/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Control Profile ID

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
id	string	Unique identifier
azureTenantId	string	Unique identifier
actionType	string	Type of the resource
actionUrl	string	URL endpoint for the request
controlCategory	string	Output field: controlCategory
title	string	Output field: title
deprecated	boolean	Output field: deprecated
implementationCost	string	Output field: implementationCost
lastModifiedDateTime	object	Time value
maxScore	number	Score value
rank	number	Output field: rank
remediation	string	Output field: remediation
remediationImpact	string	Output field: remediationImpact
service	string	Output field: service
threats	array	Output field: threats
threats.file_name	string	Name of the resource
threats.file	string	Output field: threats.file
tier	string	Output field: tier
userImpact	string	Output field: userImpact
vendorInformation	object	Output field: vendorInformation
vendorInformation.provider	string	Unique identifier
vendorInformation.providerVersion	object	Unique identifier

Output Example

{"@odata.context":"string","id":"12345678-1234-1234-1234-123456789abc","azureTenantId":"string","actionType":"string","actionUrl":"string","controlCategory":"string","title":"string","deprecated":true,"implementationCost":"string","lastModifiedDateTime":{},"maxScore":123,"rank":123,"remediation":"string","remediationImpact":"string","service":"string"}

Get Secure Scores List

Retrieve a list of Secure Scores from Microsoft Graph Security API to assess your organization's overall security posture.

Endpoint

URL: /v1.0/security/secureScores

Method: GET

Input

Argument Name	Type	Required	Description
parameters.filter	string	Optional	Use the filter query parameter to retrieve just a subset of a collection. For guidance on using filter, see https://learn.microsoft.com/en-us/graph/filter-query-parameter
parameters.orderBy	string	Optional	Use the orderby query parameter to specify the sort order of the items returned from Microsoft Graph.
parameters.top	number	Optional	Sets the page size of results.

Input Example

{"parameters":{"filter":"string","orderBy":"string","top":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
@odata.nextLink	string	Response data
value	array	Value for the parameter
value.id	string	Unique identifier
value.azureTenantId	string	Unique identifier
value.activeUserCount	number	Value for the parameter
value.createdDateTime	string	Value for the parameter
value.currentScore	number	Value for the parameter
value.enabledServices	array	Value for the parameter
value.licensedUserCount	number	Value for the parameter
value.maxScore	number	Value for the parameter
value.vendorInformation	object	Value for the parameter
value.vendorInformation.provider	string	Unique identifier
value.vendorInformation.providerVersion	object	Unique identifier
value.vendorInformation.subProvider	object	Unique identifier
value.vendorInformation.vendor	string	Value for the parameter
value.averageComparativeScores	array	Value for the parameter
value.averageComparativeScores.file_name	string	Name of the resource
value.averageComparativeScores.file	string	Value for the parameter
value.controlScores	array	Value for the parameter
value.controlScores.controlCategory	string	Value for the parameter
value.controlScores.controlName	string	Name of the resource
value.controlScores.description	object	Value for the parameter

Output Example

{"@odata.context":"string","@odata.nextLink":"string","value":[{"id":"12345678-1234-1234-1234-123456789abc","azureTenantId":"string","activeUserCount":123,"createdDateTime":"string","currentScore":123,"enabledServices":[],"licensedUserCount":123,"maxScore":123,"vendorInformation":{},"averageComparativeScores":[],"controlScores":[]}]}

Get Secure Control Profiles

Retrieve a list of secure control profiles to help enhance your organization's security posture using the Microsoft Graph Security API.

Endpoint

URL: /v1.0/security/secureScoreControlProfiles

Method: GET

Input

Argument Name	Type	Required	Description
parameters.filter	string	Optional	Use the filter query parameter to retrieve just a subset of a collection. For guidance on using filter, see https://learn.microsoft.com/en-us/graph/filter-query-parameter
parameters.orderBy	string	Optional	Use the orderby query parameter to specify the sort order of the items returned from Microsoft Graph.
parameters.top	number	Optional	Sets the page size of results.

Input Example

{"parameters":{"filter":"string","orderBy":"string","top":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
@odata.nextLink	string	Response data
value	array	Value for the parameter
value.id	string	Unique identifier
value.azureTenantId	string	Unique identifier
value.actionType	string	Type of the resource
value.actionUrl	string	URL endpoint for the request
value.controlCategory	string	Value for the parameter
value.title	string	Value for the parameter
value.deprecated	boolean	Value for the parameter
value.implementationCost	string	Value for the parameter
value.lastModifiedDateTime	object	Value for the parameter
value.maxScore	number	Value for the parameter
value.rank	number	Value for the parameter
value.remediation	string	Value for the parameter
value.remediationImpact	string	Value for the parameter
value.service	string	Value for the parameter
value.threats	array	Value for the parameter
value.threats.file_name	string	Name of the resource
value.threats.file	string	Value for the parameter
value.tier	string	Value for the parameter
value.userImpact	string	Value for the parameter
value.vendorInformation	object	Value for the parameter

Output Example

{"@odata.context":"string","@odata.nextLink":"string","value":[{"id":"12345678-1234-1234-1234-123456789abc","azureTenantId":"string","actionType":"string","actionUrl":"string","controlCategory":"string","title":"string","deprecated":true,"implementationCost":"string","lastModifiedDateTime":{},"maxScore":123,"rank":123,"remediation":"string","remediationImpact":"string","service":"string","threats":[]}]}

Get Secure Score

Retrieve a specific secure score from Microsoft Graph Security API by providing the required score ID as a path parameter.

Endpoint

URL: /v1.0/security/secureScores/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Secure Score ID

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
id	string	Unique identifier
azureTenantId	string	Unique identifier
activeUserCount	number	Count value
createdDateTime	string	Time value
currentScore	number	Score value
enabledServices	array	Output field: enabledServices
licensedUserCount	number	Count value
maxScore	number	Score value
vendorInformation	object	Output field: vendorInformation
vendorInformation.provider	string	Unique identifier
vendorInformation.providerVersion	object	Unique identifier
vendorInformation.subProvider	object	Unique identifier
vendorInformation.vendor	string	Output field: vendorInformation.vendor
averageComparativeScores	array	Output field: averageComparativeScores
averageComparativeScores.file_name	string	Name of the resource
averageComparativeScores.file	string	Output field: averageComparativeScores.file
controlScores	array	Output field: controlScores
controlScores.controlCategory	string	Output field: controlScores.controlCategory
controlScores.controlName	string	Name of the resource
controlScores.description	string	Output field: controlScores.description
controlScores.score	number	Score value
controlScores.IsApplicable	string	Output field: controlScores.IsApplicable

Output Example

{"@odata.context":"string","id":"12345678-1234-1234-1234-123456789abc","azureTenantId":"string","activeUserCount":123,"createdDateTime":"string","currentScore":123,"enabledServices":["string"],"licensedUserCount":123,"maxScore":123,"vendorInformation":{"provider":"string","providerVersion":{},"subProvider":{},"vendor":"string"},"averageComparativeScores":[{"file_name":"Example Name","file":"string"}],"controlScores":[{"controlCategory":"string","controlName":"Example Name","description":"string"...

Get Threat Assessment

Retrieve detailed threat insights for a specified ID using the Microsoft Graph Security API.

Endpoint

URL: /v1.0/informationProtection/threatAssessmentRequests/{{id}}?$expand=results

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Assessment ID

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
@odata.type	string	Response data
id	string	Unique identifier
createdDateTime	string	Time value
contentType	string	Type of the resource
expectedAssessment	string	Output field: expectedAssessment
category	string	Output field: category
status	string	Status value
requestSource	string	Output field: requestSource
recipientEmail	string	Output field: recipientEmail
destinationRoutingReason	string	Response reason phrase
contentData	string	Response data
createdBy	object	Output field: createdBy
createdBy.user	object	Output field: createdBy.user
createdBy.user.id	string	Unique identifier
createdBy.user.displayName	string	Name of the resource
[email protected]	string	Response data
results	array	Result of the operation
results.id	string	Unique identifier
results.createdDateTime	string	Result of the operation
results.resultType	string	Type of the resource
results.message	string	Result of the operation

Output Example

{"@odata.context":"string","@odata.type":"string","id":"12345678-1234-1234-1234-123456789abc","createdDateTime":"string","contentType":"string","expectedAssessment":"string","category":"string","status":"active","requestSource":"string","recipientEmail":"string","destinationRoutingReason":"string","contentData":"string","createdBy":{"user":{"id":"12345678-1234-1234-1234-123456789abc","displayName":"Example Name"}},"[email protected]":"string","results":[{"id":"12345678-1234-1234-1234-1234567...

Get Threat Assessment List

Retrieve and analyze threat assessments to enhance security posture using the Microsoft Graph Security API.

Endpoint

URL: /v1.0/informationProtection/threatAssessmentRequests

Method: GET

Input

Argument Name	Type	Required	Description
parameters.filter	string	Optional	Use the filter query parameter to retrieve just a subset of a collection. For guidance on using filter, see https://learn.microsoft.com/en-us/graph/filter-query-parameter
parameters.orderBy	string	Optional	Use the orderby query parameter to specify the sort order of the items returned from Microsoft Graph.
parameters.top	number	Optional	Sets the page size of results.

Input Example

{"parameters":{"filter":"string","orderBy":"string","top":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
value	array	Value for the parameter
[email protected]	string	Response data
value.id	string	Unique identifier
value.createdDateTime	string	Value for the parameter
value.contentType	string	Type of the resource
value.expectedAssessment	string	Value for the parameter
value.category	string	Value for the parameter
value.status	string	Status value
value.requestSource	string	Value for the parameter
value.recipientEmail	string	Value for the parameter
value.destinationRoutingReason	string	Value for the parameter
value.contentData	string	Response data
value.createdBy	object	Value for the parameter
value.createdBy.user	object	Value for the parameter

Output Example

{"@odata.context":"string","value":[{"@odata.type":"string","id":"12345678-1234-1234-1234-123456789abc","createdDateTime":"string","contentType":"string","expectedAssessment":"string","category":"string","status":"active","requestSource":"string","recipientEmail":"string","destinationRoutingReason":"string","contentData":"string","createdBy":{}}]}

Delete Threat Intelligence Indicator

Remove a specific Threat Intelligence indicator from Microsoft Graph Security API using the unique ID provided.

Endpoint

URL: /beta/security/tiIndicators/{{id}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Threat Intelligence Indicator ID

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
error	object	Error message if any
error.code	string	Error message if any
error.message	string	Response message
error.innerError	object	Error message if any
error.innerError.date	string	Error message if any
error.innerError.request-id	string	Unique identifier
error.innerError.client-request-id	string	Unique identifier

Output Example

{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}

Get Threat Intelligence Indicator

Retrieve detailed information for a specific Threat Intelligence Indicator from Microsoft Graph Security API using its unique ID.

Endpoint

URL: /beta/security/tiIndicators/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Threat Intelligence Indicator ID

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
id	string	Unique identifier
azureTenantId	string	Unique identifier
action	string	Output field: action
additionalInformation	object	Output field: additionalInformation
activityGroupNames	array	Name of the resource
activityGroupNames.file_name	string	Name of the resource
activityGroupNames.file	string	Name of the resource
confidence	object	Unique identifier
description	string	Output field: description
diamondModel	object	Output field: diamondModel
emailEncoding	object	Output field: emailEncoding
emailLanguage	object	Output field: emailLanguage
emailRecipient	object	Output field: emailRecipient
emailSenderAddress	object	Output field: emailSenderAddress
emailSenderName	object	Name of the resource
emailSourceDomain	object	Output field: emailSourceDomain
emailSourceIpAddress	object	Output field: emailSourceIpAddress
emailSubject	object	Output field: emailSubject
emailXMailer	object	Output field: emailXMailer
expirationDateTime	string	Time value
externalId	object	Unique identifier
fileCompileDateTime	object	Time value

Output Example

{"@odata.context":"string","id":"12345678-1234-1234-1234-123456789abc","azureTenantId":"string","action":"string","additionalInformation":{},"activityGroupNames":[{"file_name":"Example Name","file":"string"}],"confidence":{},"description":"string","diamondModel":{},"emailEncoding":{},"emailLanguage":{},"emailRecipient":{},"emailSenderAddress":{},"emailSenderName":{},"emailSourceDomain":{}}

Get Threat Intelligence Indicators List

Retrieve threat intelligence indicators from Microsoft Graph Security API to support analysis and strengthen threat detection.

Endpoint

URL: /beta/security/tiIndicators

Method: GET

Input

Argument Name	Type	Required	Description
parameters.filter	string	Optional	Use the filter query parameter to retrieve just a subset of a collection. For guidance on using filter, see https://learn.microsoft.com/en-us/graph/filter-query-parameter
parameters.orderBy	string	Optional	Use the orderby query parameter to specify the sort order of the items returned from Microsoft Graph.
parameters.top	number	Optional	Sets the page size of results.

Input Example

{"parameters":{"filter":"string","orderBy":"string","top":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
value	array	Value for the parameter
value.id	string	Unique identifier
value.azureTenantId	string	Unique identifier
value.action	string	Value for the parameter
value.additionalInformation	object	Value for the parameter
value.activityGroupNames	array	Name of the resource
value.activityGroupNames.file_name	string	Name of the resource
value.activityGroupNames.file	string	Name of the resource
value.confidence	object	Unique identifier
value.description	string	Value for the parameter
value.diamondModel	object	Value for the parameter
value.emailEncoding	object	Value for the parameter
value.emailLanguage	object	Value for the parameter
value.emailRecipient	object	Value for the parameter
value.emailSenderAddress	object	Value for the parameter
value.emailSenderName	object	Name of the resource
value.emailSourceDomain	object	Value for the parameter
value.emailSourceIpAddress	object	Value for the parameter
value.emailSubject	object	Value for the parameter
value.emailXMailer	object	Value for the parameter
value.expirationDateTime	string	Value for the parameter
value.externalId	object	Unique identifier

Output Example

{"@odata.context":"string","value":[{"id":"12345678-1234-1234-1234-123456789abc","azureTenantId":"string","action":"string","additionalInformation":{},"activityGroupNames":[],"confidence":{},"description":"string","diamondModel":{},"emailEncoding":{},"emailLanguage":{},"emailRecipient":{},"emailSenderAddress":{},"emailSenderName":{},"emailSourceDomain":{},"emailSourceIpAddress":{}}]}

Update Alert

Update an existing security alert in Microsoft Graph Security API by specifying the alert ID and providing additional request details.

Endpoint

URL: /v1.0/security/alerts_v2/{{alert_id}}

Method: PATCH

Input

Argument Name	Type	Required	Description
path_parameters.alert_id	string	Required	ID of the Alert
assignedTo	string	Optional	Owner of the incident, or null if no owner is assigned.
determination	string	Optional	Specifies the determination of the alert.
classification	string	Optional	Specifies the classification of the alert.
customDetails	string	Optional	User defined custom fields with string values.
status	string	Optional	Alert lifecycle status (stage).

Input Example

{"path_parameters":{"alert_id":"string"},"assignedTo":"string","determination":"string","classification":"string","customDetails":"string","status":"active"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
id	string	Unique identifier
providerAlertId	string	Unique identifier
incidentId	string	Unique identifier
status	string	Status value
severity	string	Output field: severity
classification	string	Output field: classification
determination	object	Output field: determination
serviceSource	string	Output field: serviceSource
detectionSource	string	Output field: detectionSource
productName	string	Name of the resource
detectorId	string	Unique identifier
tenantId	string	Unique identifier
title	string	Output field: title
description	string	Output field: description
recommendedActions	string	Output field: recommendedActions
category	string	Output field: category
assignedTo	string	Output field: assignedTo
alertWebUrl	string	URL endpoint for the request
incidentWebUrl	string	URL endpoint for the request
actorDisplayName	object	Name of the resource
threatDisplayName	object	Name of the resource
threatFamilyName	object	Name of the resource

Output Example

{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#security/alerts_v2/$entity","id":"maf25f0fa0-126a-4297-aff6-ae579cb984a3","providerAlertId":"f25f0fa0-126a-4297-aff6-ae579cb984a3","incidentId":"563","status":"new","severity":"medium","classification":"truePositive","determination":null,"serviceSource":"microsoftAppGovernance","detectionSource":"appGovernanceDetection","productName":"App Governance","detectorId":"b62ae531-7aa6-4bc8-91b9-49a9be960145","tenantId":"f5d73c4c-bb3d-421b-8b...

Create Threat Intel Indicator Azure Sentinel

Create a threat intelligence indicator in Azure Sentinel by specifying action, tenant ID, description, expiration date, target product, threat type, and TLP level.

Endpoint

URL: /beta/security/tiIndicators

Method: POST

Input

Argument Name	Type	Required	Description
action	string	Optional	The action to apply if the indicator is matched from within the targetProduct security tool. Possible values are unknown, allow, block or alert
activityGroupNames	array	Optional	The cyber threat intelligence name(s) for the parties responsible for the malicious activity covered by the threat indicator
additionalInformation	string	Optional	A catchall area into which extra data from the indicator not covered by the other tiIndicator properties may be placed. Data placed into additionalInformation will typically not be utilized by the targetProduct security tool
azureTenantId	string	Optional	Stamped by the system when the indicator is ingested. The Azure Active Directory tenant id of submitting client
confidence	number	Optional	An integer representing the confidence the data within the indicator accurately identifies malicious behavior. Acceptable values are 0-100 with 100 being the highest.
description	string	Optional	Brief description (100 characters or less) of the threat represented by the indicator
diamondModel	string	Optional	The area of the Diamond Model in which this indicator exists. Possible values are unknown, adversary, capability, infrastructure and victim
domainName	string	Optional	Domain name associated with this indicator. Should be of the format subdomain.domain.topleveldomain (For example, baddomain.domain.net)
emailEncoding	string	Optional	The type of text encoding used in the email
emailLanguage	string	Optional	The Language of the email
emailRecipient	string	Optional	Email Recipient Address
emailSenderAddress	string	Optional	Email Sender Address
emailSenderName	string	Optional	Email Sender Name
emailSourceDomain	string	Optional	Parameter for Create Threat Intel Indicator Azure Sentinel
emailSourceIpAddress	string	Optional	Parameter for Create Threat Intel Indicator Azure Sentinel
emailSubject	string	Optional	Parameter for Create Threat Intel Indicator Azure Sentinel
emailXMailer	string	Optional	X-Mailer value used in the email
expirationDateTime	string	Optional	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time
externalId	string	Optional	Unique identifier
fileCompileDateTime	string	Optional	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time
fileCreatedDateTime	string	Optional	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time
fileHashType	string	Optional	The type of hash stored in fileHashValue. Possible values are unknown, sha1, sha256, md5, authenticodeHash256, lsHash, ctph
fileHashValue	string	Optional	Value for the parameter
fileMutexName	string	Optional	Name of the resource
fileName	string	Optional	Name of the resource

Input Example

{"action":"string","activityGroupNames":["string"],"additionalInformation":"string","azureTenantId":"string","confidence":123,"description":"string","diamondModel":"string","domainName":"Example Name","emailEncoding":"string","emailLanguage":"string","emailRecipient":"string","emailSenderAddress":"string","emailSenderName":"Example Name","emailSourceDomain":"string","emailSourceIpAddress":"string","emailSubject":"string","emailXMailer":"string","expirationDateTime":"string","externalId":"string","fileCompileDateTime":"string","fileCreatedDateTime":"string","fileHashType":"string","fileHashValue":"string","fileMutexName":"Example Name","fileName":"Example Name","filePacker":"string","filePath":"string","fileSize":123,"fileType":"string","isActive":"string","killChain":["string"],"knownFalsePositives":"string","lastReportedDateTime":"string","malwareFamilyNames":"Example Name","networkCidrBlock":"string","networkDestinationAsn":123,"networkDestinationCidrBlock":"string","networkDestinationIPv4":"string","networkDestinationIPv6":"string","networkDestinationPort":123,"networkIPv4":"string","networkIPv6":"string","networkPort":123,"networkProtocol":123,"networkSourceAsn":123,"networkSourceCidrBlock":"string","networkSourceIPv4":"string","networkSourceIPv6":"string","networkSourcePort":123,"passiveOnly":"string"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
id	string	Unique identifier
azureTenantId	string	Unique identifier
action	string	Output field: action
additionalInformation	object	Output field: additionalInformation
activityGroupNames	array	Name of the resource
activityGroupNames.file_name	string	Name of the resource
activityGroupNames.file	string	Name of the resource
confidence	object	Unique identifier
description	string	Output field: description
diamondModel	object	Output field: diamondModel
emailEncoding	object	Output field: emailEncoding
emailLanguage	object	Output field: emailLanguage
emailRecipient	object	Output field: emailRecipient
emailSenderAddress	object	Output field: emailSenderAddress
emailSenderName	object	Name of the resource
emailSourceDomain	object	Output field: emailSourceDomain
emailSourceIpAddress	object	Output field: emailSourceIpAddress
emailSubject	object	Output field: emailSubject
emailXMailer	object	Output field: emailXMailer
expirationDateTime	string	Time value
externalId	object	Unique identifier
fileCompileDateTime	object	Time value

Output Example

Create Threat Intel Indicator Microsoft Defender

Create a threat intelligence indicator in Microsoft Defender with specified action and active status using Microsoft Graph API.

Endpoint

URL: /beta/security/tiIndicators

Method: POST

Input

Argument Name	Type	Required	Description
action	string	Optional	The action to apply if the indicator is matched from within the targetProduct security tool. Possible values are unknown, allow, block or alert
activityGroupNames	array	Optional	The cyber threat intelligence name(s) for the parties responsible for the malicious activity covered by the threat indicator
additionalInformation	string	Optional	A catchall area into which extra data from the indicator not covered by the other tiIndicator properties may be placed. Data placed into additionalInformation will typically not be utilized by the targetProduct security tool
azureTenantId	string	Optional	Stamped by the system when the indicator is ingested. The Azure Active Directory tenant id of submitting client
confidence	number	Optional	An integer representing the confidence the data within the indicator accurately identifies malicious behavior. Acceptable values are 0-100 with 100 being the highest.
description	string	Optional	Brief description (100 characters or less) of the threat represented by the indicator
diamondModel	string	Optional	The area of the Diamond Model in which this indicator exists. Possible values are unknown, adversary, capability, infrastructure and victim
domainName	string	Optional	Domain name associated with this indicator. Should be of the format subdomain.domain.topleveldomain (For example, baddomain.domain.net)
emailEncoding	string	Optional	The type of text encoding used in the email
emailLanguage	string	Optional	The Language of the email
emailRecipient	string	Optional	Email Recipient Address
emailSenderAddress	string	Optional	Email Sender Address
emailSenderName	string	Optional	Email Sender Name
emailSourceDomain	string	Optional	Parameter for Create Threat Intel Indicator Microsoft Defender
emailSourceIpAddress	string	Optional	Parameter for Create Threat Intel Indicator Microsoft Defender
emailSubject	string	Optional	Parameter for Create Threat Intel Indicator Microsoft Defender
emailXMailer	string	Optional	X-Mailer value used in the email
expirationDateTime	string	Optional	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time
externalId	string	Optional	Unique identifier
fileCompileDateTime	string	Optional	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time
fileCreatedDateTime	string	Optional	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time
fileHashType	string	Optional	The type of hash stored in fileHashValue. Possible values are unknown, sha1, sha256, md5, authenticodeHash256, lsHash, ctph
fileHashValue	string	Optional	Value for the parameter
fileMutexName	string	Optional	Name of the resource
fileName	string	Optional	Name of the resource

Input Example

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
id	string	Unique identifier
azureTenantId	string	Unique identifier
action	string	Output field: action
additionalInformation	object	Output field: additionalInformation
activityGroupNames	array	Name of the resource
activityGroupNames.file_name	string	Name of the resource
activityGroupNames.file	string	Name of the resource
confidence	object	Unique identifier
description	string	Output field: description
diamondModel	object	Output field: diamondModel
emailEncoding	object	Output field: emailEncoding
emailLanguage	object	Output field: emailLanguage
emailRecipient	object	Output field: emailRecipient
emailSenderAddress	object	Output field: emailSenderAddress
emailSenderName	object	Name of the resource
emailSourceDomain	object	Output field: emailSourceDomain
emailSourceIpAddress	object	Output field: emailSourceIpAddress
emailSubject	object	Output field: emailSubject
emailXMailer	object	Output field: emailXMailer
expirationDateTime	string	Time value
externalId	object	Unique identifier
fileCompileDateTime	object	Time value

Output Example

Get eDiscovery Case

Retrieve details and related information for a specific eDiscovery case in Microsoft Graph API using the provided ediscoveryCaseId.

Endpoint

URL: /v1.0/security/cases/ediscoveryCases/{{ediscoveryCaseId}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.ediscoveryCaseId	string	Required	eDiscovery Case ID

Input Example

{"path_parameters":{"ediscoveryCaseId":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
description	string	Output field: description
lastModifiedDateTime	string	Time value
status	string	Status value
closedDateTime	object	Time value
externalId	string	Unique identifier
id	string	Unique identifier
displayName	string	Name of the resource
createdDateTime	string	Time value
lastModifiedBy	object	Output field: lastModifiedBy
closedBy	object	Output field: closedBy

Output Example

{"@odata.context":"https://graph.microsoft.com/beta/$metadata#security/cases/ediscoveryCases/$entit...","description":"","lastModifiedDateTime":"2022-05-22T18:36:46.597Z","status":"active","closedDateTime":null,"externalId":"324516","id":"22aa2acd-7554-4330-9ba9-ce20014aaae4","displayName":"CONTOSO LITIGATION-005","createdDateTime":"2022-05-22T18:36:46.597Z","lastModifiedBy":null,"closedBy":null}

List eDiscovery Cases

Retrieve a comprehensive list of eDiscoveryCase objects and their properties from the Microsoft Graph API.

Endpoint

URL: /v1.0/security/cases/ediscoveryCases

Method: GET

Input

Argument Name	Type	Required	Description
parameters.filter	string	Optional	Use the filter query parameter to retrieve just a subset of a collection. For guidance on using filter, see https://learn.microsoft.com/en-us/graph/filter-query-parameter
parameters.orderBy	string	Optional	Use the orderby query parameter to specify the sort order of the items returned from Microsoft Graph.
parameters.top	number	Optional	Sets the page size of results.

Input Example

{"parameters":{"filter":"string","orderBy":"string","top":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
@odata.count	number	Response data
value	array	Value for the parameter
value.description	string	Value for the parameter
value.lastModifiedDateTime	string	Value for the parameter
value.status	string	Status value
value.closedDateTime	object	Value for the parameter
value.externalId	string	Unique identifier
value.id	string	Unique identifier
value.displayName	string	Name of the resource
value.createdDateTime	string	Value for the parameter
value.lastModifiedBy	object	Value for the parameter
value.lastModifiedBy.application	object	Value for the parameter
value.lastModifiedBy.user	object	Value for the parameter
value.lastModifiedBy.user.id	object	Unique identifier
value.lastModifiedBy.user.displayName	string	Name of the resource
value.closedBy	object	Value for the parameter
value.closedBy.application	object	Value for the parameter
value.closedBy.user	object	Value for the parameter
value.closedBy.user.id	object	Unique identifier
value.closedBy.user.displayName	string	Name of the resource

Output Example

{"@odata.context":"https://graph.microsoft.com/beta/$metadata#security/cases/ediscoveryCases","@odata.count":22,"value":[{"description":"","lastModifiedDateTime":"2022-05-19T23:30:41.23Z","status":"active","closedDateTime":null,"externalId":"","id":"60f86305-ac3e-408b-baa2-ea585dd8b0c0","displayName":"My case 1","createdDateTime":"2022-05-19T23:30:41.23Z","lastModifiedBy":{},"closedBy":{}},{"description":"","lastModifiedDateTime":"2022-05-18T23:05:07.82Z","status":"active","closedDateTime":null,...

List eDiscovery Case Custodians

Retrieve custodian objects and their properties for a specified eDiscovery case ID using Microsoft Graph API.

Endpoint

URL: /v1.0/security/cases/ediscoveryCases/{{ediscoveryCaseId}}/custodians

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.ediscoveryCaseId	string	Required	eDiscovery Case ID

Input Example

{"path_parameters":{"ediscoveryCaseId":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
@odata.count	number	Response data
value	array	Value for the parameter
value.status	string	Status value
value.holdStatus	string	Status value
value.createdDateTime	string	Value for the parameter
value.lastModifiedDateTime	string	Value for the parameter
value.releasedDateTime	object	Value for the parameter
value.id	string	Unique identifier
value.displayName	string	Name of the resource
value.email	string	Value for the parameter
value.acknowledgedDateTime	string	Value for the parameter

Output Example

{"@odata.context":"https://graph.microsoft.com/beta/$metadata#security/cases/ediscoveryCases('b0073...","@odata.count":1,"value":[{"status":"active","holdStatus":"notApplied","createdDateTime":"2022-05-23T00:58:19.0702426Z","lastModifiedDateTime":"2022-05-23T00:58:19.0702436Z","releasedDateTime":null,"id":"0053a61a3b6c42738f7606791716a22a","displayName":"Alex Wilber","email":"[email protected]","acknowledgedDateTime":"0001-01-01T00:00:00Z"}]}

List eDiscovery Case Operations

Retrieve operation objects and their properties for a specified eDiscovery case in Microsoft Graph API using the provided case ID.

Endpoint

URL: /v1.0/security/cases/ediscoveryCases/{{ediscoveryCaseId}}/operations

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.ediscoveryCaseId	string	Required	eDiscovery Case ID

Input Example

{"path_parameters":{"ediscoveryCaseId":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
value	array	Value for the parameter
value.createdDateTime	string	Value for the parameter
value.completedDateTime	string	Value for the parameter
value.percentProgress	number	Value for the parameter
value.status	string	Status value
value.action	string	Value for the parameter
value.id	string	Unique identifier
value.createdBy	object	Value for the parameter
value.createdBy.application	object	Value for the parameter
value.createdBy.user	object	Value for the parameter
value.createdBy.user.id	string	Unique identifier
value.createdBy.user.displayName	object	Name of the resource
value.createdBy.user.userPrincipalName	object	Name of the resource

Output Example

{"@odata.context":"https://graph.microsoft.com/beta/$metadata#security/cases/ediscoveryCases('b0073...","value":[{"createdDateTime":"2022-05-23T01:09:36.834501Z","completedDateTime":"2022-05-23T01:10:08.8710734Z","percentProgress":100,"status":"succeeded","action":"holdUpdate","id":"1ab699d7e53d46de944144c4a650d66f","createdBy":{}}]}

List eDiscovery Case Review Sets

Retrieve all eDiscovery review sets linked to a specified case in Microsoft Graph API using the required ediscoveryCaseId path parameter.

Endpoint

URL: /v1.0/security/cases/ediscoveryCases/{{ediscoveryCaseId}}/reviewSets

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.ediscoveryCaseId	string	Required	eDiscovery Case ID

Input Example

{"path_parameters":{"ediscoveryCaseId":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
value	array	Value for the parameter
value.displayName	string	Name of the resource
value.id	string	Unique identifier
value.createdDateTime	string	Value for the parameter
value.createdBy	object	Value for the parameter
value.createdBy.application	object	Value for the parameter
value.createdBy.user	object	Value for the parameter
value.createdBy.user.id	string	Unique identifier
value.createdBy.user.displayName	string	Name of the resource
value.createdBy.user.userPrincipalName	string	Name of the resource

Output Example

{"@odata.context":"https://graph.microsoft.com/beta/$metadata#security/cases/ediscoveryCases('b0073...","value":[{"displayName":"My review set","id":"025852b3-5062-4169-9609-9861a6fe2fe5","createdDateTime":"2022-05-23T16:26:08.7203883Z","createdBy":{}}]}

List eDiscovery Case Searches

Retrieve all eDiscovery search resources associated with a specific case in Microsoft Graph API by providing the required ediscoveryCaseId path parameter.

Endpoint

URL: /v1.0/security/cases/ediscoveryCases/{{ediscoveryCaseId}}/searches

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.ediscoveryCaseId	string	Required	eDiscovery Case ID

Input Example

{"path_parameters":{"ediscoveryCaseId":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
value	array	Value for the parameter
value.dataSourceScopes	string	Response data
value.description	string	Value for the parameter
value.lastModifiedDateTime	string	Value for the parameter
value.contentQuery	string	Value for the parameter
value.id	string	Unique identifier
value.displayName	string	Name of the resource
value.createdDateTime	string	Value for the parameter
value.lastModifiedBy	object	Value for the parameter
value.createdBy	object	Value for the parameter
value.createdBy.user	object	Value for the parameter
value.createdBy.user.id	string	Unique identifier
value.createdBy.user.displayName	string	Name of the resource
value.createdBy.user.userPrincipalName	string	Name of the resource
value.createdBy.application	object	Value for the parameter
value.createdBy.application.id	string	Unique identifier
value.createdBy.application.displayName	string	Name of the resource

Output Example

{"@odata.context":"https://graph.microsoft.com/beta/$metadata#security/cases/ediscoveryCases('b0073...","value":[{"dataSourceScopes":"none","description":"My first search","lastModifiedDateTime":"2022-05-23T04:38:07.5787454Z","contentQuery":"(Author=\"edison\")","id":"46867792-68e6-41db-9cd0-f651c2290d91","displayName":"My search 2","createdDateTime":"2022-05-23T04:38:07.5787454Z","lastModifiedBy":null,"createdBy":{}},{"dataSourceScopes":"none","description":"My first search","lastModifiedDateTi...

List eDiscovery Case Tags

Retrieve all eDiscoveryReviewTag objects for a specified case in Microsoft Graph API using the ediscoveryCaseId path parameter.

Endpoint

URL: /v1.0/security/cases/ediscoveryCases/{{ediscoveryCaseId}}/tags

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.ediscoveryCaseId	string	Required	eDiscovery Case ID

Input Example

{"path_parameters":{"ediscoveryCaseId":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
@odata.count	number	Response data
value	array	Value for the parameter
value.displayName	string	Name of the resource
value.lastModifiedDateTime	string	Value for the parameter
value.childSelectability	string	Value for the parameter
value.id	string	Unique identifier
value.createdBy	object	Value for the parameter
value.createdBy.user	object	Value for the parameter
value.createdBy.user.id	string	Unique identifier
value.createdBy.user.displayName	string	Name of the resource
value.createdBy.user.userPrincipalName	string	Name of the resource
value.description	string	Value for the parameter

Output Example

{"@odata.context":"https://graph.microsoft.com/beta/$metadata#security/cases/ediscoveryCases('58399...","@odata.count":5,"value":[{"displayName":"My tag","lastModifiedDateTime":"2022-05-23T19:41:01.7432683Z","childSelectability":"Many","id":"062de822f17a4a2e9b833aa3f6c37108","createdBy":{"user":{"id":"c25c3914-f9f7-43ee-9cba-a25377e0cec6","displayName":"MOD Administrator","userPrincipalName":"[email protected]"}}},{"displayName":"Responsive","description":"","lastModifiedDateTime...

Get Hunting Schema

Retrieve the Microsoft Defender XDR advanced hunting schema, including available tables, columns, and functions for building security queries.

Endpoint

URL: /beta/security/getHuntingSchema

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
tables	array	Advanced hunting tables the user is authorized to query.
tables.name	string	Name of the resource
tables.description	string	Output field: tables.description
tables.columns	array	Output field: tables.columns
tables.columns.name	string	Name of the resource
tables.columns.dataType	string	Response data
tables.columns.description	string	Output field: tables.columns.description
functions	object	Built-in and saved advanced hunting functions available to the user.
functions.builtInFunctions	array	Output field: functions.builtInFunctions
functions.builtInFunctions.huntingFunctionId	number	Unique identifier
functions.builtInFunctions.name	string	Name of the resource
functions.builtInFunctions.path	string	Output field: functions.builtInFunctions.path
functions.builtInFunctions.documentation	string	Output field: functions.builtInFunctions.documentation
functions.builtInFunctions.inputParameters	array	Parameters for the Get Hunting Schema action
functions.builtInFunctions.inputParameters.name	string	Parameters for the Get Hunting Schema action
functions.builtInFunctions.inputParameters.cslType	string	Parameters for the Get Hunting Schema action
functions.builtInFunctions.inputParameters.defaultValue	string	Parameters for the Get Hunting Schema action
functions.builtInFunctions.outputColumns	array	Output field: functions.builtInFunctions.outputColumns
functions.builtInFunctions.outputColumns.name	string	Name of the resource
functions.builtInFunctions.outputColumns.dataType	string	Response data
functions.builtInFunctions.outputColumns.description	string	Output field: functions.builtInFunctions.outputColumns.description
functions.savedFunctions	array	Output field: functions.savedFunctions
functions.savedFunctions.huntingFunctionId	number	Unique identifier

Output Example

{"tables":[{"name":"Example Name","description":"string","columns":[]}],"functions":{"builtInFunctions":[{}],"savedFunctions":[{}]}}

Get Incident

Retrieve detailed information and related data for a specific incident by providing its incidentId from Microsoft Graph API.

Endpoint

URL: /v1.0/security/incidents/{{incidentId}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.incidentId	string	Required	Incident ID

Input Example

{"path_parameters":{"incidentId":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.type	string	Response data
id	string	Unique identifier
incidentWebUrl	string	URL endpoint for the request
redirectIncidentId	object	Unique identifier
displayName	string	Name of the resource
tenantId	string	Unique identifier
createdDateTime	string	Time value
lastUpdateDateTime	string	Time value
assignedTo	string	Output field: assignedTo
classification	string	Output field: classification
determination	string	Output field: determination
status	string	Status value
severity	string	Output field: severity
customTags	array	Output field: customTags
comments	array	Output field: comments
comments.comment	string	Output field: comments.comment
comments.createdBy	string	Output field: comments.createdBy
comments.createdTime	string	Time value

Output Example

{"@odata.type":"#microsoft.graph.incident","id":"2972395","incidentWebUrl":"https://security.microsoft.com/incidents/2972395?tid=12f988bf-16f1-11af-11ab-1d7...","redirectIncidentId":null,"displayName":"Multi-stage incident involving Initial access & Command and control on multiple ...","tenantId":"b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c","createdDateTime":"2021-08-13T08:43:35.5533333Z","lastUpdateDateTime":"2021-09-30T09:35:45.1133333Z","assignedTo":"[email protected]","classification":"...

Get Repeat Offenders

Retrieve a list of tenant users compromised multiple times in simulation and training campaigns using the Microsoft Graph API.

Endpoint

URL: /V1.0/reports/security/getAttackSimulationRepeatOffenders

Method: GET

Input

Argument Name	Type	Required	Description
parameters.filter	string	Optional	Use the filter query parameter to retrieve just a subset of a collection. For guidance on using filter, see https://learn.microsoft.com/en-us/graph/filter-query-parameter
parameters.orderBy	string	Optional	Use the orderby query parameter to specify the sort order of the items returned from Microsoft Graph.
parameters.top	number	Optional	Sets the page size of results.

Input Example

{"parameters":{"filter":"string","orderBy":"string","top":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
@odata.nextLink	string	Response data
value	array	Value for the parameter
value.repeatOffenceCount	number	Value for the parameter
value.attackSimulationUser	object	Value for the parameter
value.attackSimulationUser.userId	string	Unique identifier
value.attackSimulationUser.displayName	string	Name of the resource
value.attackSimulationUser.email	string	Value for the parameter

Output Example

Get Simulation

Retrieve detailed information about a specific attack simulation campaign in Microsoft Graph API using the unique simulationId.

Endpoint

URL: /V1.0/security/attackSimulation/simulations/{{simulationId}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.simulationId	string	Required	Simulation ID

Input Example

{"path_parameters":{"simulationId":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.type	string	Response data
id	string	Unique identifier
incidentWebUrl	string	URL endpoint for the request
redirectIncidentId	object	Unique identifier
displayName	string	Name of the resource
tenantId	string	Unique identifier
createdDateTime	string	Time value
lastUpdateDateTime	string	Time value
assignedTo	string	Output field: assignedTo
classification	string	Output field: classification
determination	string	Output field: determination
status	string	Status value
severity	string	Output field: severity
customTags	array	Output field: customTags
comments	array	Output field: comments
comments.comment	string	Output field: comments.comment
comments.createdBy	string	Output field: comments.createdBy
comments.createdTime	string	Time value

Output Example

Get Simulation Automation

Retrieve detailed information about a specific attack simulation automation in Microsoft Graph API using the provided simulationId.

Endpoint

URL: /V1.0/security/attackSimulation/simulationAutomations/{{simulationId}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.simulationId	string	Required	Simulation ID

Input Example

{"path_parameters":{"simulationId":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.type	string	Response data
id	string	Unique identifier
displayName	string	Name of the resource
description	string	Output field: description
status	string	Status value
createdDateTime	string	Time value
createdBy	object	Output field: createdBy
createdBy.id	string	Unique identifier
createdBy.displayName	string	Name of the resource
createdBy.email	string	Output field: createdBy.email
lastModifiedDateTime	string	Time value
lastModifiedBy	object	Output field: lastModifiedBy
lastModifiedBy.id	string	Unique identifier
lastModifiedBy.displayName	string	Name of the resource
lastModifiedBy.email	string	Output field: lastModifiedBy.email
lastRunDateTime	string	Time value
nextRunDateTime	string	Time value

Output Example

{"@odata.type":"#microsoft.graph.simulationAutomation","id":"fbad62b0-b32d-b6ac-9f48-d84bbea08f96","displayName":"Reed Flores","description":"Sample Simulation Automation Description","status":"running","createdDateTime":"2022-01-01T01:01:01.01Z","createdBy":{"id":"99af58b9-ef1a-412b-a581-cb42fe8c8e21","displayName":"Reed Flores","email":"[email protected]"},"lastModifiedDateTime":"2022-01-01T01:01:01.01Z","lastModifiedBy":{"id":"99af58b9-ef1a-412b-a581-cb42fe8c8e21","displayName":"Reed Flores","...

Get Simulation Coverage for Users

Retrieve training coverage details for tenant users involved in attack simulation and training campaigns using Microsoft Graph API.

Endpoint

URL: /V1.0/reports/security/getAttackSimulationSimulationUserCoverage

Method: GET

Input

Argument Name	Type	Required	Description
parameters.filter	string	Optional	Use the filter query parameter to retrieve just a subset of a collection. For guidance on using filter, see https://learn.microsoft.com/en-us/graph/filter-query-parameter
parameters.orderBy	string	Optional	Use the orderby query parameter to specify the sort order of the items returned from Microsoft Graph.
parameters.top	number	Optional	Sets the page size of results.

Input Example

{"parameters":{"filter":"string","orderBy":"string","top":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
@odata.nextLink	string	Response data
value	array	Value for the parameter
value.simulationCount	object	Value for the parameter
value.latestSimulationDateTime	object	Value for the parameter
value.clickCount	object	Value for the parameter
value.compromisedCount	object	Value for the parameter
value.attackSimulationUser	object	Value for the parameter
value.attackSimulationUser.userId	string	Unique identifier
value.attackSimulationUser.displayName	string	Name of the resource
value.attackSimulationUser.email	string	Value for the parameter

Output Example

{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#Collection(microsoft.graph.attackSimu...","@odata.nextLink":"https://graph.microsoft.com/v1.0/reports/security/getAttackSimulationSimulationU...","value":[{"simulationCount":1063,"latestSimulationDateTime":"2022-02-10T10:45:50Z","clickCount":0,"compromisedCount":0,"attackSimulationUser":{}},{"simulationCount":null,"latestSimulationDateTime":null,"clickCount":null,"compromisedCount":null,"attackSimulationUser":{}}]}

Get Simulation Overview

Retrieve an overview of a specific attack simulation and training campaign in Microsoft Graph API using the required simulationId path parameter.

Endpoint

URL: /V1.0/security/attackSimulation/simulations/{{simulationId}}/report/overview

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.simulationId	string	Required	Simulation ID

Input Example

{"path_parameters":{"simulationId":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
value	array	Value for the parameter
[email protected]	string	Response data
value.id	string	Unique identifier
value.displayName	string	Name of the resource
value.description	string	Value for the parameter
value.status	string	Status value
value.createdDateTime	string	Value for the parameter
value.createdBy	object	Value for the parameter
value.createdBy.id	string	Unique identifier
value.createdBy.displayName	string	Name of the resource
value.createdBy.email	string	Value for the parameter
value.lastModifiedDateTime	string	Value for the parameter
value.lastModifiedBy	object	Value for the parameter
value.lastModifiedBy.id	string	Unique identifier
value.lastModifiedBy.displayName	string	Name of the resource
value.lastModifiedBy.email	string	Value for the parameter
value.lastRunDateTime	string	Value for the parameter
value.nextRunDateTime	string	Value for the parameter

Output Example

{"value":[{"@odata.type":"#microsoft.graph.simulationAutomation","id":"fbad62b0-b32d-b6ac-9f48-d84bbea08f96","displayName":"Reed Flores","description":"Sample Simulation Automation Description","status":"running","createdDateTime":"2022-01-01T01:01:01.01Z","createdBy":{},"lastModifiedDateTime":"2022-01-01T01:01:01.01Z","lastModifiedBy":{},"lastRunDateTime":"2022-01-01T01:01:01.01Z","nextRunDateTime":"2022-01-01T01:01:01.01Z"}]}

Get Training Coverage for Users

Retrieve a list of tenant users' training coverage in attack simulation and training campaigns using Microsoft Graph API.

Endpoint

URL: /V1.0/reports/security/getAttackSimulationTrainingUserCoverage

Method: GET

Input

Argument Name	Type	Required	Description
parameters.filter	string	Optional	Use the filter query parameter to retrieve just a subset of a collection. For guidance on using filter, see https://learn.microsoft.com/en-us/graph/filter-query-parameter
parameters.orderBy	string	Optional	Use the orderby query parameter to specify the sort order of the items returned from Microsoft Graph.
parameters.top	number	Optional	Sets the page size of results.

Input Example

{"parameters":{"filter":"string","orderBy":"string","top":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
@odata.nextLink	string	Response data
value	array	Value for the parameter
value.userTrainings	array	Value for the parameter
value.userTrainings.assignedDateTime	string	Value for the parameter
value.userTrainings.completionDateTime	string	Value for the parameter
value.userTrainings.trainingStatus	string	Status value
value.userTrainings.displayName	string	Name of the resource
value.attackSimulationUser	object	Value for the parameter
value.attackSimulationUser.userId	string	Unique identifier
value.attackSimulationUser.displayName	object	Name of the resource
value.attackSimulationUser.email	object	Value for the parameter

Output Example

List Incidents

Retrieve and monitor incidents from Microsoft 365 Defender to help manage and track organizational security attacks.

Endpoint

URL: /v1.0/security/incidents

Method: GET

Input

Argument Name	Type	Required	Description
parameters.$count	string	Optional	Retrieves the total count of matching resources.
parameters.$skip	number	Optional	Indexes into a result set. Also used by some APIs to implement paging and can be used together with $top to manually page results.
parameters.$top	number	Optional	Sets the page size of results.
parameters.$expand	string	Optional	Retrieves related resources.
parameters.$filter	string	Optional	Use the filter query parameter to retrieve just a subset of a collection. For guidance on using filter, see https://learn.microsoft.com/en-us/graph/filter-query-parameter.
parameters.return_as_turbine_schema	boolean	Optional	When true, incidents are mapped to normalized Turbine Schema alert objects and returned in the Alerts field. When false, the raw Microsoft Graph API response is returned.
parameters.alert_organization	string	Optional	Optional organization name to include in the Turbine Schema alert. Used only when return_as_turbine_schema is true.
parameters.ioc_types	array	Optional	List of observable types to extract. Supported: ipv4_public, ipv4_private, ipv6_public, ipv6_private, domain, url, email, sha1, sha256, md5. If omitted or empty, all types are extracted.
parameters.domains_ignore_list	string	Optional	Comma-separated domain values to exclude from observable extraction.
parameters.ip_cidr_ignore_list	string	Optional	Comma-separated CIDR ranges to exclude from observable extraction.
parameters.regex_ignore	string	Optional	Regex pattern — any observable value matching this pattern is excluded.
parameters.ioc_ignore_paths	array	Optional	Array of slash-separated field paths to strip from each alert before extracting observables. Supports wildcards () and nested paths. Example: ["processCommandLine", "context//ipAddress"].

Input Example

{"parameters":{"$count":"string","$skip":123,"$top":123,"$expand":"string","$filter":"string","return_as_turbine_schema":true,"alert_organization":"string","ioc_types":["string"],"domains_ignore_list":"string","ip_cidr_ignore_list":"string","regex_ignore":"string","ioc_ignore_paths":["string"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
Alerts	array	Normalized Turbine Schema alerts (when return_as_turbine_schema is true).
total_processed	integer	Number of Turbine Schema alerts returned.
value	array	Value for the parameter
[email protected]	string	Response data
value.id	string	Unique identifier
value.incidentWebUrl	string	URL endpoint for the request
value.redirectIncidentId	object	Unique identifier
value.tenantId	string	Unique identifier
value.displayName	string	Name of the resource
value.createdDateTime	string	Value for the parameter
value.lastUpdateDateTime	string	Value for the parameter
value.assignedTo	string	Value for the parameter
value.classification	string	Value for the parameter
value.determination	string	Value for the parameter
value.status	string	Status value
value.severity	string	Value for the parameter
value.customTags	array	Value for the parameter
value.comments	array	Value for the parameter
value.comments.comment	string	Value for the parameter
value.comments.createdBy	string	Value for the parameter
value.comments.createdTime	string	Value for the parameter

Output Example

{"value":[{"@odata.type":"#microsoft.graph.security.incident","id":"2972395","incidentWebUrl":"https://security.microsoft.com/incidents/2972395?tid=12f988bf-16f1-11af-11ab-1d7...","redirectIncidentId":null,"tenantId":"b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c","displayName":"Multi-stage incident involving Initial access & Command and control on multiple ...","createdDateTime":"2021-08-13T08:43:35.5533333Z","lastUpdateDateTime":"2021-09-30T09:35:45.1133333Z","assignedTo":"[email protected]"...

List Simulation Automations

Retrieve an overview of attack simulation automations and security test settings configured in a Microsoft Graph tenant.

Endpoint

URL: /V1.0/security/attackSimulation/simulationAutomations

Method: GET

Input

Argument Name	Type	Required	Description
parameters.filter	string	Optional	Use the filter query parameter to retrieve just a subset of a collection. For guidance on using filter, see https://learn.microsoft.com/en-us/graph/filter-query-parameter
parameters.orderBy	string	Optional	Use the orderby query parameter to specify the sort order of the items returned from Microsoft Graph.
parameters.top	number	Optional	Sets the page size of results.

Input Example

{"parameters":{"filter":"string","orderBy":"string","top":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
value	array	Value for the parameter
[email protected]	string	Response data
value.id	string	Unique identifier
value.displayName	string	Name of the resource
value.description	string	Value for the parameter
value.status	string	Status value
value.createdDateTime	string	Value for the parameter
value.createdBy	object	Value for the parameter
value.createdBy.id	string	Unique identifier
value.createdBy.displayName	string	Name of the resource
value.createdBy.email	string	Value for the parameter
value.lastModifiedDateTime	string	Value for the parameter
value.lastModifiedBy	object	Value for the parameter
value.lastModifiedBy.id	string	Unique identifier
value.lastModifiedBy.displayName	string	Name of the resource
value.lastModifiedBy.email	string	Value for the parameter
value.lastRunDateTime	string	Value for the parameter
value.nextRunDateTime	string	Value for the parameter

Output Example

List Simulation Users

Retrieve users and their actions from an attack simulation campaign in Microsoft Graph API using the specified simulationId.

Endpoint

URL: /V1.0/security/attackSimulation/simulations/{{simulationId}}/report/simulationUsers

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.simulationId	string	Required	Simulation ID

Input Example

{"path_parameters":{"simulationId":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
value	array	Value for the parameter
value.isCompromised	boolean	Value for the parameter
value.compromisedDateTime	string	Value for the parameter
value.simulationEvents	array	Value for the parameter
value.simulationEvents.eventName	string	Name of the resource
value.simulationEvents.eventDateTime	string	Value for the parameter
value.simulationEvents.ipAddress	string	Value for the parameter
value.simulationEvents.osPlatformDeviceDetails	string	Value for the parameter
value.simulationEvents.browser	string	Value for the parameter
value.trainingEvents	array	Value for the parameter
value.trainingEvents.displayName	string	Name of the resource
value.trainingEvents.latestTrainingStatus	string	Status value
value.trainingEvents.trainingAssignedProperties	object	Value for the parameter
value.trainingEvents.trainingAssignedProperties.contentDateTime	string	Value for the parameter
value.trainingEvents.trainingAssignedProperties.ipAddress	string	Value for the parameter
value.trainingEvents.trainingAssignedProperties.osPlatformDeviceDetails	string	Value for the parameter
value.trainingEvents.trainingAssignedProperties.browser	string	Value for the parameter
value.trainingEvents.trainingAssignedProperties.potentialScoreImpact	number	Value for the parameter
value.trainingEvents.trainingUpdatedProperties	object	Value for the parameter
value.trainingEvents.trainingUpdatedProperties.contentDateTime	string	Value for the parameter
value.trainingEvents.trainingUpdatedProperties.ipAddress	string	Value for the parameter
value.trainingEvents.trainingUpdatedProperties.osPlatformDeviceDetails	string	Value for the parameter
value.trainingEvents.trainingUpdatedProperties.browser	string	Value for the parameter

Output Example

{"value":[{"isCompromised":true,"compromisedDateTime":"2021-01-01T01:02:01.01Z","simulationEvents":[],"trainingEvents":[],"assignedTrainingsCount":1,"completedTrainingsCount":0,"inProgressTrainingsCount":0,"reportedPhishDateTime":"2021-01-01T01:01:01.01Z","simulationUser":{}}]}

List Simulations

Retrieve attack simulation campaigns from a Microsoft Graph tenant to assess organizational security preparedness.

Endpoint

URL: /v1.0/security/attackSimulation/simulations

Method: GET

Input

Argument Name	Type	Required	Description
parameters.filter	string	Optional	Use the filter query parameter to retrieve just a subset of a collection. For guidance on using filter, see https://learn.microsoft.com/en-us/graph/filter-query-parameter
parameters.orderBy	string	Optional	Use the orderby query parameter to specify the sort order of the items returned from Microsoft Graph.
parameters.top	number	Optional	Sets the page size of results.

Input Example

{"parameters":{"filter":"string","orderBy":"string","top":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
value	array	Value for the parameter
value.id	string	Unique identifier
value.displayName	string	Name of the resource
value.description	string	Value for the parameter
value.attackType	string	Type of the resource
value.attackTechnique	string	Value for the parameter
value.status	string	Status value
value.createdDateTime	string	Value for the parameter
value.createdBy	object	Value for the parameter
value.createdBy.id	string	Unique identifier
value.createdBy.displayName	string	Name of the resource
value.createdBy.email	string	Value for the parameter
value.lastModifiedDateTime	string	Value for the parameter
value.lastModifiedBy	object	Value for the parameter
value.lastModifiedBy.id	string	Unique identifier
value.lastModifiedBy.displayName	string	Name of the resource
value.lastModifiedBy.email	string	Value for the parameter
value.launchDateTime	string	Value for the parameter
value.completionDateTime	string	Value for the parameter
value.isAutomated	boolean	Value for the parameter
value.automationId	string	Unique identifier
value.payloadDeliveryPlatform	string	Value for the parameter

Output Example

{"value":[{"id":"f1b13829-3829-f1b1-2938-b1f12938b1f1","displayName":"Sample Simulation","description":"Sample Simulation Description","attackType":"social","attackTechnique":"credentialHarvesting","status":"scheduled","createdDateTime":"2021-01-01T01:01:01.01Z","createdBy":{},"lastModifiedDateTime":"2021-01-01T01:01:01.01Z","lastModifiedBy":{},"launchDateTime":"2021-01-01T02:01:01.01Z","completionDateTime":"2021-01-07T01:01:01.01Z","isAutomated":false,"automationId":"f1b13829-3829-f1b1-2938-b1f...

Run Hunting Query

Execute advanced threat hunting queries in Microsoft 365 Defender via Microsoft Graph API to identify and analyze potential security threats.

Endpoint

URL: /v1.0/security/runHuntingQuery

Method: POST

Input

Argument Name	Type	Required	Description
query	string	Optional	The hunting query in Kusto Query Language (KQL)

Input Example

{"query":"string"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
schema	array	Output field: schema
schema.Name	string	Name of the resource
schema.Type	string	Type of the resource
results	array	Result of the operation
results.Timestamp	string	Result of the operation
results.FileName	string	Name of the resource
results.InitiatingProcessFileName	string	Name of the resource

Output Example

{"schema":[{"Name":"Timestamp","Type":"DateTime"},{"Name":"FileName","Type":"String"},{"Name":"InitiatingProcessFileName","Type":"String"}],"results":[{"Timestamp":"2020-08-30T06:38:35.7664356Z","FileName":"conhost.exe","InitiatingProcessFileName":"powershell.exe"},{"Timestamp":"2020-08-30T06:38:30.5163363Z","FileName":"conhost.exe","InitiatingProcessFileName":"powershell.exe"}]}

Delete Subscription

Remove an existing Microsoft Graph API subscription and stop receiving change notifications by specifying the subscriptionId.

Endpoint

URL: /v1.0/subscriptions/{{subscriptionId}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.subscriptionId	string	Required	The unique identifier of the subscription to delete.

Input Example

{"path_parameters":{"subscriptionId":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
error	object	Error object when the delete request fails.
error.code	string	Error message if any
error.message	string	Response message
error.innerError	object	Error message if any
error.innerError.date	string	Error message if any
error.innerError.request-id	string	Unique identifier
error.innerError.client-request-id	string	Unique identifier

Output Example

{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}

Get Subscription

Retrieve detailed information for a specific Microsoft Graph API security subscription using the provided subscriptionId.

Endpoint

URL: /v1.0/subscriptions/{{subscriptionId}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.subscriptionId	string	Required	The unique identifier of the subscription to retrieve.

Input Example

{"path_parameters":{"subscriptionId":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
id	string	Unique identifier for the subscription.
resource	string	The resource path subscribed to.
applicationId	string	Identifier of the application used to create the subscription.
changeType	string	Type of change that triggers notification.
clientState	string	Secret value sent with each notification for validation.
creatorId	string	User or service principal that created the subscription.
encryptionCertificate	string	Base64-encoded certificate for encrypting resource data.
encryptionCertificateId	string	Custom identifier for the decryption certificate.
expirationDateTime	string	Date and time when the subscription expires (UTC).
includeResourceData	boolean	Whether change notifications include resource data.
latestSupportedTlsVersion	string	TLS version supported by the notification endpoint.
lifecycleNotificationUrl	string	Endpoint for lifecycle notifications.
notificationQueryOptions	string	OData query options for targeting resource state.
notificationUrl	string	Endpoint that receives change notifications.
notificationUrlAppId	string	App ID for validation token generation.
notificationContentType	string	Content type of change notifications.

Output Example

{"@odata.context":"string","id":"12345678-1234-1234-1234-123456789abc","resource":"string","applicationId":"string","changeType":"string","clientState":"string","creatorId":"string","encryptionCertificate":"string","encryptionCertificateId":"string","expirationDateTime":"string","includeResourceData":true,"latestSupportedTlsVersion":"string","lifecycleNotificationUrl":"string","notificationQueryOptions":"string","notificationUrl":"string"}

Update Subscription

Renew or modify a Microsoft Graph API security subscription by updating its expiry time or notification URL using the required subscriptionId.

Endpoint

URL: /v1.0/subscriptions/{{subscriptionId}}

Method: PATCH

Input

Argument Name	Type	Required	Description
path_parameters.subscriptionId	string	Required	The unique identifier of the subscription to update.
expirationDateTime	string	Optional	New ISO 8601 date and time when subscription expires.
notificationUrl	string	Optional	New HTTPS endpoint URL for receiving change notifications.

Input Example

{"path_parameters":{"subscriptionId":"string"},"expirationDateTime":"string","notificationUrl":"string"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier for the subscription.
resource	string	The resource path subscribed to.
applicationId	string	Identifier of the application used to create the subscription.
changeType	string	Type of change that triggers notification.
clientState	string	Secret value sent with each notification for validation.
creatorId	string	User or service principal that created the subscription.
encryptionCertificate	string	Base64-encoded certificate for encrypting resource data.
encryptionCertificateId	string	Custom identifier for the decryption certificate.
expirationDateTime	string	Date and time when the subscription expires (UTC).
includeResourceData	boolean	Whether change notifications include resource data.
latestSupportedTlsVersion	string	TLS version supported by the notification endpoint.
lifecycleNotificationUrl	string	Endpoint for lifecycle notifications.
notificationQueryOptions	string	OData query options for targeting resource state.
notificationUrl	string	Endpoint that receives change notifications.
notificationUrlAppId	string	App ID for validation token generation.
notificationContentType	string	Content type of change notifications.

Output Example

{"id":"12345678-1234-1234-1234-123456789abc","resource":"string","applicationId":"string","changeType":"string","clientState":"string","creatorId":"string","encryptionCertificate":"string","encryptionCertificateId":"string","expirationDateTime":"string","includeResourceData":true,"latestSupportedTlsVersion":"string","lifecycleNotificationUrl":"string","notificationQueryOptions":"string","notificationUrl":"string","notificationUrlAppId":"string"}

Post Threat Assessment Email

Submit an email with recipient and attachments to Microsoft Graph API for security threat analysis and receive detailed assessment results.

Endpoint

URL: /v1.0/informationProtection/threatAssessmentRequests

Method: POST

Input

Argument Name	Type	Required	Description
attachments	array	Optional	Parameter for Post Threat Assessment Email
attachments.contentData	string	Optional	Response data
recipientEmail	string	Optional	The mail recipient whose policies are used to assess the mail
expectedAssessment	string	Optional	The expected assessment from the ubmitter. Possible values are block, unblock
category	string	Optional	The threat category. Possible values are spam, phishing, malware

Input Example

{"attachments":[{"contentData":"string"}],"recipientEmail":"string","expectedAssessment":"string","category":"string"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
error	object	Error message if any
error.code	string	Error message if any
error.message	string	Response message
error.innerError	object	Error message if any
error.innerError.date	string	Error message if any
error.innerError.request-id	string	Unique identifier
error.innerError.client-request-id	string	Unique identifier

Output Example

{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}

Post Threat Assessment File

Submit file attachments to Microsoft Graph API for security threat analysis and receive detailed assessment results.

Endpoint

URL: /v1.0/informationProtection/threatAssessmentRequests

Method: POST

Input

Argument Name	Type	Required	Description
attachments	array	Optional	Parameter for Post Threat Assessment File
attachments.contentData	string	Optional	Response data
attachments.fileName	string	Optional	Name of the resource
expectedAssessment	string	Optional	The expected assessment from the ubmitter. Possible values are block, unblock
category	string	Optional	The threat category. Possible values are spam, phishing, malware

Input Example

{"attachments":[{"contentData":"string","fileName":"Example Name"}],"expectedAssessment":"string","category":"string"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
error	object	Error message if any
error.code	string	Error message if any
error.message	string	Response message
error.innerError	object	Error message if any
error.innerError.date	string	Error message if any
error.innerError.request-id	string	Unique identifier
error.innerError.client-request-id	string	Unique identifier

Output Example

{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}

Post Threat Assessment URI

Submit a message URI and recipient email to Microsoft Graph API for security threat assessment and receive detailed evaluation results.

Endpoint

URL: /v1.0/informationProtection/threatAssessmentRequests

Method: POST

Input

Argument Name	Type	Required	Description
messageUri	string	Optional	The resource URI of the mail message for assessment
recipientEmail	string	Optional	The mail recipient whose policies are used to assess the mail
expectedAssessment	string	Optional	The expected assessment from the ubmitter. Possible values are block, unblock
category	string	Optional	The threat category. Possible values are spam, phishing, malware

Input Example

{"messageUri":"string","recipientEmail":"string","expectedAssessment":"string","category":"string"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
error	object	Error message if any
error.code	string	Error message if any
error.message	string	Response message
error.innerError	object	Error message if any
error.innerError.date	string	Error message if any
error.innerError.request-id	string	Unique identifier
error.innerError.client-request-id	string	Unique identifier

Output Example

{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}

Post Threat Assessment URL

Initiate a security threat assessment on a specified URL using Microsoft Graph API to identify potential risks. Requires the 'url' parameter in the JSON body.

Endpoint

URL: /v1.0/informationProtection/threatAssessmentRequests

Method: POST

Input

Argument Name	Type	Required	Description
url	string	Optional	The URL string
expectedAssessment	string	Optional	The expected assessment from the ubmitter. Possible values are block, unblock
category	string	Optional	The threat category. Possible values are spam, phishing, malware

Input Example

{"url":"https://example.com/api/resource","expectedAssessment":"string","category":"string"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
error	object	Error message if any
error.code	string	Error message if any
error.message	string	Response message
error.innerError	object	Error message if any
error.innerError.date	string	Error message if any
error.innerError.request-id	string	Unique identifier
error.innerError.client-request-id	string	Unique identifier

Output Example

{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}

Create Subscription

Create a webhook subscription in Microsoft Graph to receive change notifications for specified resources using changeType, notificationUrl, resource, and expirationDateTime.

Endpoint

URL: /v1.0/subscriptions

Method: POST

Input

Argument Name	Type	Required	Description
changeType	string	Optional	Type of change that triggers notification (e.g., created, updated, deleted).
notificationUrl	string	Optional	HTTPS endpoint URL to receive change notifications.
resource	string	Optional	Resource path to subscribe to (e.g., me/mailFolders('Inbox')/messages).
expirationDateTime	string	Optional	ISO 8601 date and time when subscription expires.
clientState	string	Optional	Optional secret value for validation (max 128 characters).
latestSupportedTlsVersion	string	Optional	TLS version for notifications (e.g., v1_2).

Input Example

{"changeType":"string","notificationUrl":"string","resource":"string","expirationDateTime":"string","clientState":"string","latestSupportedTlsVersion":"string"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
id	string	Unique identifier for the subscription.
resource	string	The resource path subscribed to.
applicationId	string	Identifier of the application used to create the subscription.
changeType	string	Type of change that triggers notification.
clientState	string	Secret value sent with each notification for validation.
creatorId	string	User or service principal that created the subscription.
encryptionCertificate	string	Base64-encoded certificate for encrypting resource data.
encryptionCertificateId	string	Custom identifier for the decryption certificate.
expirationDateTime	string	Date and time when the subscription expires (UTC).
includeResourceData	boolean	Whether change notifications include resource data.
latestSupportedTlsVersion	string	TLS version supported by the notification endpoint.
lifecycleNotificationUrl	string	Endpoint for lifecycle notifications.
notificationQueryOptions	string	OData query options for targeting resource state.
notificationUrl	string	Endpoint that receives change notifications.
notificationUrlAppId	string	App ID for validation token generation.
notificationContentType	string	Content type of change notifications.

Output Example

Send Channel Message

Send a new chat message to a specified Microsoft Teams channel using the team ID, channel ID, and message body.

Endpoint

URL: /v1.0/teams/{{team_id}}/channels/{{channel_id}}/messages

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.team_id	string	Required	The unique identifier of the team.
path_parameters.channel_id	string	Required	The unique identifier of the channel.
body	object	Optional	The content of the message.
body.content	string	Required	The content of the message.
body.contentType	string	Optional	The type of the content. Possible values are text and html.
subject	string	Optional	The subject of the chat message, in plaintext.
importance	string	Optional	The importance of the chat message. Possible values are normal, high, urgent.
mentions	array	Optional	List of entities mentioned in the chat message.
mentions.id	integer	Optional	Index of an entity being mentioned.
mentions.mentionText	string	Optional	String used to represent the mention.
mentions.mentioned	object	Optional	The entity (user, application, team, or channel) that was mentioned.
attachments	array	Optional	References to attached objects such as files, tabs, meetings or other messages.
attachments.id	string	Optional	Read-only. Unique id of the attachment.
attachments.contentType	string	Optional	The media type of the content attachment.
attachments.contentUrl	string	Optional	URL for the content of the attachment.
attachments.content	string	Optional	The content of the attachment.
attachments.name	string	Optional	Name of the attachment.
attachments.thumbnailUrl	string	Optional	URL to a thumbnail image that the channel can use.

Input Example

{"path_parameters":{"team_id":"string","channel_id":"string"},"body":{"content":"string","contentType":"string"},"subject":"string","importance":"string","mentions":[{"id":123,"mentionText":"string","mentioned":{}}],"attachments":[{"id":"12345678-1234-1234-1234-123456789abc","contentType":"string","contentUrl":"string","content":"string","name":"Example Name","thumbnailUrl":"string"}]}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text
id	string	The unique read-only identifier of the message.
createdDateTime	string	Timestamp of when the message was created.
lastModifiedDateTime	string	Timestamp of when the message was last modified.
etag	string	Version number of the chat message.
messageType	string	The type of chat message.
subject	string	The subject of the chat message.
importance	string	The importance of the chat message.
locale	string	Locale of the client used when the message was sent.
webUrl	string	Link to the message in Microsoft Teams.
from	object	Details of the sender of the chat message.
body	object	Plaintext/HTML representation of the content.
body.contentType	string	Request body data
body.content	string	Request body data
channelIdentity	object	If the message was sent in a channel, represents identity of the channel.
channelIdentity.teamId	string	Unique identifier
channelIdentity.channelId	string	Unique identifier
attachments	array	Attached files.
mentions	array	List of entities mentioned in the chat message.
reactions	array	Reactions for this chat message.

Output Example

{"response_text":"string","id":"string","createdDateTime":"string","lastModifiedDateTime":"string","etag":"string","messageType":"string","subject":"string","importance":"string","locale":"string","webUrl":"string","from":{},"body":{"contentType":"string","content":"string"},"channelIdentity":{"teamId":"string","channelId":"string"},"attachments":[],"mentions":[]}

Send Channel Message Reply

Send a reply to an existing message in a Microsoft Teams channel by providing the team ID, channel ID, message ID, and message body.

Endpoint

URL: /v1.0/teams/{{team_id}}/channels/{{channel_id}}/messages/{{message_id}}/replies

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.team_id	string	Required	The unique identifier of the team.
path_parameters.channel_id	string	Required	The unique identifier of the channel.
path_parameters.message_id	string	Required	The unique identifier of the message to reply to.
body	object	Optional	The content of the reply.
body.content	string	Required	The content of the reply.
body.contentType	string	Optional	The type of the content. Possible values are text and html.
subject	string	Optional	The subject of the chat message, in plaintext.
importance	string	Optional	The importance of the chat message. Possible values are normal, high, urgent.
mentions	array	Optional	List of entities mentioned in the chat message.
mentions.id	integer	Optional	Index of an entity being mentioned.
mentions.mentionText	string	Optional	String used to represent the mention.
mentions.mentioned	object	Optional	The entity (user, application, team, or channel) that was mentioned.
attachments	array	Optional	References to attached objects such as files, tabs, meetings or other messages.
attachments.id	string	Optional	Read-only. Unique id of the attachment.
attachments.contentType	string	Optional	The media type of the content attachment.
attachments.contentUrl	string	Optional	URL for the content of the attachment.
attachments.content	string	Optional	The content of the attachment.
attachments.name	string	Optional	Name of the attachment.
attachments.thumbnailUrl	string	Optional	URL to a thumbnail image that the channel can use.

Input Example

{"path_parameters":{"team_id":"string","channel_id":"string","message_id":"string"},"body":{"content":"string","contentType":"string"},"subject":"string","importance":"string","mentions":[{"id":123,"mentionText":"string","mentioned":{}}],"attachments":[{"id":"12345678-1234-1234-1234-123456789abc","contentType":"string","contentUrl":"string","content":"string","name":"Example Name","thumbnailUrl":"string"}]}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text
id	string	The unique read-only identifier of the reply message.
replyToId	string	Read-only. ID of the parent chat message or root chat message.
createdDateTime	string	Timestamp of when the message was created.
lastModifiedDateTime	string	Timestamp of when the message was last modified.
etag	string	Version number of the chat message.
messageType	string	The type of chat message.
subject	string	The subject of the chat message.
importance	string	The importance of the chat message.
locale	string	Locale of the client used when the message was sent.
webUrl	string	Link to the message in Microsoft Teams.
from	object	Details of the sender of the chat message.
body	object	Plaintext/HTML representation of the content.
body.contentType	string	Request body data
body.content	string	Request body data
channelIdentity	object	If the message was sent in a channel, represents identity of the channel.
channelIdentity.teamId	string	Unique identifier
channelIdentity.channelId	string	Unique identifier
attachments	array	Attached files.
mentions	array	List of entities mentioned in the chat message.
reactions	array	Reactions for this chat message.

Output Example

{"response_text":"string","id":"string","replyToId":"string","createdDateTime":"string","lastModifiedDateTime":"string","etag":"string","messageType":"string","subject":"string","importance":"string","locale":"string","webUrl":"string","from":{},"body":{"contentType":"string","content":"string"},"channelIdentity":{"teamId":"string","channelId":"string"},"attachments":[]}

Send Chat Message

Send a new message to a specified Microsoft Teams chat by providing the chat ID and message content using Microsoft Graph API.

Endpoint

URL: /v1.0/chats/{{chat_id}}/messages

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.chat_id	string	Required	The unique identifier of the chat.
body	object	Optional	The content of the message.
body.content	string	Required	The content of the message.
body.contentType	string	Optional	The type of the content. Possible values are text and html.
subject	string	Optional	The subject of the chat message, in plaintext.
importance	string	Optional	The importance of the chat message. Possible values are normal, high, urgent.
mentions	array	Optional	List of entities mentioned in the chat message.
mentions.id	integer	Optional	Index of an entity being mentioned.
mentions.mentionText	string	Optional	String used to represent the mention.
mentions.mentioned	object	Optional	The entity (user, application, team, or channel) that was mentioned.
attachments	array	Optional	References to attached objects such as files, tabs, meetings or other messages.
attachments.id	string	Optional	Read-only. Unique id of the attachment.
attachments.contentType	string	Optional	The media type of the content attachment.
attachments.contentUrl	string	Optional	URL for the content of the attachment.
attachments.content	string	Optional	The content of the attachment.
attachments.name	string	Optional	Name of the attachment.
attachments.thumbnailUrl	string	Optional	URL to a thumbnail image that the channel can use.

Input Example

{"path_parameters":{"chat_id":"string"},"body":{"content":"string","contentType":"string"},"subject":"string","importance":"string","mentions":[{"id":123,"mentionText":"string","mentioned":{}}],"attachments":[{"id":"12345678-1234-1234-1234-123456789abc","contentType":"string","contentUrl":"string","content":"string","name":"Example Name","thumbnailUrl":"string"}]}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text
id	string	The unique read-only identifier of the message.
createdDateTime	string	Timestamp of when the message was created.
lastModifiedDateTime	string	Timestamp of when the message was last modified.
etag	string	Version number of the chat message.
messageType	string	The type of chat message.
subject	string	The subject of the chat message.
importance	string	The importance of the chat message.
locale	string	Locale of the client used when the message was sent.
webUrl	string	Link to the message in Microsoft Teams.
chatId	string	If the message was sent in a chat, represents the identity of the chat.
from	object	Details of the sender of the chat message.
body	object	Plaintext/HTML representation of the content.
body.contentType	string	Request body data
body.content	string	Request body data
attachments	array	Attached files.
mentions	array	List of entities mentioned in the chat message.
reactions	array	Reactions for this chat message.

Output Example

{"response_text":"string","id":"string","createdDateTime":"string","lastModifiedDateTime":"string","etag":"string","messageType":"string","subject":"string","importance":"string","locale":"string","webUrl":"string","chatId":"string","from":{},"body":{"contentType":"string","content":"string"},"attachments":[],"mentions":[]}

Move Email

Relocate an email to a specified folder in a user's mailbox by providing the email address, email ID, and destination folder ID using Microsoft Graph API.

Endpoint

URL: /v1.0/users/{{email_address}}/messages/{{email_id}}/move

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.email_address	string	Required	The account associated with the email
path_parameters.email_id	string	Required	The ID of the email
destinationId	string	Optional	The destination folder ID, or a well-known folder name

Input Example

{"path_parameters":{"email_address":"string","email_id":"string"},"destinationId":"string"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
@odata.etag	string	Response data
id	string	Unique identifier
createdDateTime	string	Time value
lastModifiedDateTime	string	Time value
changeKey	string	Output field: changeKey
categories	array	Output field: categories
categories.file_name	string	Name of the resource
categories.file	string	Output field: categories.file
receivedDateTime	string	Time value
sentDateTime	string	Time value
hasAttachments	boolean	Output field: hasAttachments
internetMessageId	string	Unique identifier
subject	string	Output field: subject
bodyPreview	string	Request body data
importance	string	Output field: importance
parentFolderId	string	Unique identifier
conversationId	string	Unique identifier
conversationIndex	string	Output field: conversationIndex
isDeliveryReceiptRequested	object	Output field: isDeliveryReceiptRequested
isReadReceiptRequested	boolean	Output field: isReadReceiptRequested
isRead	boolean	Output field: isRead
isDraft	boolean	Output field: isDraft

Output Example

{"@odata.context":"string","@odata.etag":"string","id":"12345678-1234-1234-1234-123456789abc","createdDateTime":"string","lastModifiedDateTime":"string","changeKey":"string","categories":[{"file_name":"Example Name","file":"string"}],"receivedDateTime":"string","sentDateTime":"string","hasAttachments":true,"internetMessageId":"string","subject":"string","bodyPreview":"string","importance":"string","parentFolderId":"string"}

Reply to Email

Send a custom reply to a specific email by specifying the recipient's address and email ID using Microsoft Graph API.

Endpoint

URL: /v1.0/users/{{email_address}}/messages/{{email_id}}/reply

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.email_address	string	Required	The account associated with the email
path_parameters.email_id	string	Required	The ID of the email
comment	string	Optional	A comment to include. Can be an empty string.
saveToSentItems	boolean	Optional	Indicates whether to save the message in Sent Items. Specify it only if the parameter is false; default is true. Optional.
message	object	Optional	The message to send
message.subject	string	Optional	The subject of the email
message.body	object	Optional	The body of the message. It can be in HTML or text format.
message.body.content	string	Optional	The content of the item
message.body.contentType	string	Optional	The type of the content. Possible values are text and html.
message.sender	object	Optional	The account that is actually used to generate the message. In most cases, this value is the same as the from property
message.sender.address	string	Required	Response message
message.sender.name	string	Optional	Name of the resource
message.replyTo	array	Optional	The email addresses to use when replying.
message.replyTo.emailAddress	object	Required	Response message
message.replyTo.emailAddress.address	string	Required	Response message
message.replyTo.emailAddress.name	string	Optional	Name of the resource
message.toRecipients	array	Optional	The list of direct recipient objects.
message.toRecipients.emailAddress	object	Required	Response message
message.toRecipients.emailAddress.address	string	Required	Response message
message.toRecipients.emailAddress.name	string	Optional	Name of the resource
message.ccRecipients	array	Optional	The list of CC recipient objects.
message.ccRecipients.emailAddress	object	Required	Response message
message.ccRecipients.emailAddress.address	string	Required	Response message
message.ccRecipients.emailAddress.name	string	Optional	Name of the resource
message.bccRecipients	array	Optional	The list of BCC recipient objects.

Input Example

{"path_parameters":{"email_address":"string","email_id":"string"},"comment":"string","saveToSentItems":true,"message":{"subject":"string","body":{"content":"string","contentType":"string"},"sender":{"address":"string","name":"Example Name"},"replyTo":[{"emailAddress":{"address":"string","name":"Example Name"}}],"toRecipients":[{"emailAddress":{"address":"string","name":"Example Name"}}],"ccRecipients":[{"emailAddress":{"address":"string","name":"Example Name"}}],"bccRecipients":[{"emailAddress":{"address":"string","name":"Example Name"}}],"attachments":[{"contentBytes":"string","name":"Example Name","@odata.type":"#microsoft.graph.fileAttachment","contentType":"text/plain"}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"response_text":"string"}

Retrieve Authentication Methods

Retrieve a user's authentication methods from Microsoft Graph API by specifying the user's mail ID as a path parameter.

Endpoint

URL: /v1.0/users/{{mailid}}/authentication/methods

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.mailid	string	Required	The account associated with the email.

Input Example

{"path_parameters":{"mailid":"[email protected]"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
@microsoft.graph.tips	string	Output field: @microsoft.graph.tips
value	array	Value for the parameter
[email protected]	string	Response data
value.id	string	Unique identifier
value.password	object	Value for the parameter
value.createdDateTime	string	Value for the parameter
value.secretKey	object	Value for the parameter

Output Example

{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#users('integrations%40swimlaneintegra...","@microsoft.graph.tips":"Use $select to choose only the properties your app needs, as this can lead to pe...","value":[{"@odata.type":"#microsoft.graph.passwordAuthenticationMethod","id":"28c10230-6103-485e-b985-444c60001490","password":null,"createdDateTime":"2021-12-15T01:31:09Z"},{"@odata.type":"#microsoft.graph.softwareOathAuthenticationMethod","id":"c03db085-34e7-47bc-b7d6-b54069b6042f","...

Invalidate all refresh tokens and browser session cookies for a user to enforce secure sign-out using Microsoft Graph API. Requires the user's ID as a path parameter.

Endpoint

URL: v1.0/users/{{id}}/revokeSignInSessions

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	User ID

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
value	boolean	Value for the parameter

Output Example

{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#Edm.Boolean","value":true}

Send Email

Send an email to a specified recipient by providing the recipient's email address and message content using Microsoft Graph API.

Endpoint

URL: /v1.0/users/{{email_address}}/sendMail

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.email_address	string	Required	The account associated with the email
saveToSentItems	boolean	Optional	Indicates whether to save the message in Sent Items. Specify it only if the parameter is false; default is true. Optional.
message	object	Optional	The message to send
message.subject	string	Optional	The subject of the email
message.body	object	Optional	The body of the message. It can be in HTML or text format.
message.body.content	string	Optional	The content of the item
message.body.contentType	string	Optional	The type of the content. Possible values are text and html.
message.replyTo	array	Optional	The email addresses to use when replying.
message.replyTo.emailAddress	object	Required	Response message
message.replyTo.emailAddress.address	string	Required	Response message
message.replyTo.emailAddress.name	string	Optional	Name of the resource
message.toRecipients	array	Required	The list of direct recipient objects.
message.toRecipients.emailAddress	object	Required	Response message
message.toRecipients.emailAddress.address	string	Required	Response message
message.toRecipients.emailAddress.name	string	Optional	Name of the resource
message.ccRecipients	array	Optional	The list of CC recipient objects.
message.ccRecipients.emailAddress	object	Required	Response message
message.ccRecipients.emailAddress.address	string	Required	Response message
message.ccRecipients.emailAddress.name	string	Optional	Name of the resource
message.bccRecipients	array	Optional	The list of BCC recipient objects.
message.bccRecipients.emailAddress	object	Required	Response message
message.bccRecipients.emailAddress.address	string	Required	Response message
message.bccRecipients.emailAddress.name	string	Optional	Name of the resource
message.attachments	array	Optional	Items attached to this email
message.attachments.contentBytes	string	Optional	Response content

Input Example

{"path_parameters":{"email_address":"string"},"saveToSentItems":true,"message":{"subject":"string","body":{"content":"string","contentType":"string"},"replyTo":[{"emailAddress":{"address":"string","name":"Example Name"}}],"toRecipients":[{"emailAddress":{"address":"string","name":"Example Name"}}],"ccRecipients":[{"emailAddress":{"address":"string","name":"Example Name"}}],"bccRecipients":[{"emailAddress":{"address":"string","name":"Example Name"}}],"attachments":[{"contentBytes":"string","name":"Example Name","@odata.type":"#microsoft.graph.fileAttachment","contentType":"text/plain"}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"response_text":"string"}

Send Email with Attachments Data

Send a custom email with attachments to a specified recipient using Microsoft Graph API. Requires the recipient's email address and message content.

Endpoint

URL: /v1.0/users/{{email_address}}/sendMail

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.email_address	string	Required	The account associated with the email
saveToSentItems	boolean	Optional	Indicates whether to save the message in Sent Items. Specify it only if the parameter is false; default is true. Optional.
message	object	Optional	The message to send
message.subject	string	Optional	The subject of the email
message.body	object	Optional	The body of the message. It can be in HTML or text format.
message.body.content	string	Optional	The content of the item
message.body.contentType	string	Optional	The type of the content. Possible values are text and html.
message.replyTo	array	Optional	The email addresses to use when replying.
message.replyTo.emailAddress	object	Required	Response message
message.replyTo.emailAddress.address	string	Required	Response message
message.replyTo.emailAddress.name	string	Optional	Name of the resource
message.toRecipients	array	Required	The list of direct recipient objects.
message.toRecipients.emailAddress	object	Required	Response message
message.toRecipients.emailAddress.address	string	Required	Response message
message.toRecipients.emailAddress.name	string	Optional	Name of the resource
message.ccRecipients	array	Optional	The list of CC recipient objects.
message.ccRecipients.emailAddress	object	Required	Response message
message.ccRecipients.emailAddress.address	string	Required	Response message
message.ccRecipients.emailAddress.name	string	Optional	Name of the resource
message.bccRecipients	array	Optional	The list of BCC recipient objects.
message.bccRecipients.emailAddress	object	Required	Response message
message.bccRecipients.emailAddress.address	string	Required	Response message
message.bccRecipients.emailAddress.name	string	Optional	Name of the resource
message.attachments	array	Optional	Items attached to this email with content in text or base64 encoded string format.
message.attachments.contentBytes	string	Optional	The content of the attachment either in text or in base64 encoded string format.

Input Example

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"response_text":"string"}

Set Email Read Status

Update the read status of a specific email in Microsoft Graph API using the provided email address, email ID, and isRead value.

Endpoint

URL: /v1.0/users/{{email_address}}/messages/{{email_id}}

Method: PATCH

Input

Argument Name	Type	Required	Description
path_parameters.email_address	string	Required	Parameters for the Set Email Read Status action
path_parameters.email_id	string	Required	Parameters for the Set Email Read Status action
isRead	string	Optional	Parameter for Set Email Read Status

Input Example

{"json_body":{"isRead":"true"},"path_parameters":{"email_address":"[email protected]","email_id":"ed7b3366-10f2-4992-9edc-31024afd556b@BN8NAM12FT082.eop-nam12.prod.protection.outlook.com"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.context	string	Response data
@odata.etag	string	Response data
id	string	Unique identifier
createdDateTime	string	Time value
lastModifiedDateTime	string	Time value
changeKey	string	Output field: changeKey
categories	array	Output field: categories
categories.file_name	string	Name of the resource
categories.file	string	Output field: categories.file
receivedDateTime	string	Time value
sentDateTime	string	Time value
hasAttachments	boolean	Output field: hasAttachments
internetMessageId	string	Unique identifier
subject	string	Output field: subject
bodyPreview	string	Request body data
importance	string	Output field: importance
parentFolderId	string	Unique identifier
conversationId	string	Unique identifier
conversationIndex	string	Output field: conversationIndex
isDeliveryReceiptRequested	object	Output field: isDeliveryReceiptRequested
isReadReceiptRequested	boolean	Output field: isReadReceiptRequested
isRead	boolean	Output field: isRead
isDraft	boolean	Output field: isDraft

Output Example

{"@odata.context":"string","@odata.etag":"string","id":"12345678-1234-1234-1234-123456789abc","createdDateTime":"string","lastModifiedDateTime":"string","changeKey":"string","categories":[{"file_name":"Example Name","file":"string"}],"receivedDateTime":"string","sentDateTime":"string","hasAttachments":true,"internetMessageId":"string","subject":"string","bodyPreview":"string","importance":"string","parentFolderId":"string"}

Update Incident

Modify an incident by specifying the incident ID and update its classification, determination, and custom tags using Microsoft Graph API.

Endpoint

URL: /v1.0/security/incidents/{{incidentId}}

Method: PATCH

Input

Argument Name	Type	Required	Description
path_parameters.incidentId	string	Required	ID of the Incident
classification	string	Optional	Parameter for Update Incident
determination	string	Optional	Parameter for Update Incident
customTags	array	Optional	Parameter for Update Incident
assignedTo	string	Optional	Owner of the incident, or null if no owner is assigned. Free editable text.
status	string	Optional	Status value

Input Example

{"json_body":{"classification":"TruePositive","determination":"MultiStagedAttack","customTags":["Demo"],"assignedTo":"John Smith","status":"unknown"},"path_parameters":{"incidentId":"2972395"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
@odata.type	string	Response data
id	string	Unique identifier
incidentWebUrl	string	URL endpoint for the request
redirectIncidentId	object	Unique identifier
displayName	string	Name of the resource
tenantId	string	Unique identifier
createdDateTime	string	Time value
lastUpdateDateTime	string	Time value
assignedTo	string	Output field: assignedTo
classification	string	Output field: classification
determination	string	Output field: determination
status	string	Status value
severity	string	Output field: severity
customTags	array	Output field: customTags
comments	array	Output field: comments
comments.comment	string	Output field: comments.comment
comments.createdBy	string	Output field: comments.createdBy
comments.createdTime	string	Time value

Output Example

Update Message

Update the properties of a specific email message in Microsoft Graph API using the provided userPrincipalName and message ID.

Endpoint

URL: /users/{{userPrincipalName}}/messages/{{id}}

Method: PATCH

Input

Argument Name	Type	Required	Description
path_parameters.userPrincipalName	string	Required	The email address of the user.
path_parameters.id	string	Required	The unique identifier of the message.
bccRecipients	array	Optional	The list of BCC recipient objects.
bccRecipients.emailAddress	object	Required	Parameter for Update Message
bccRecipients.emailAddress.address	string	Required	Parameter for Update Message
bccRecipients.emailAddress.name	string	Optional	Name of the resource
body	object	Optional	The body of the message. Updatable only if isDraft = true.
body.contentType	string	Required	Request body data
body.content	string	Required	Request body data
categories	array	Optional	The categories associated with the message.
ccRecipients	array	Optional	The Cc recipients for the message.
ccRecipients.emailAddress	object	Required	Parameter for Update Message
ccRecipients.emailAddress.address	string	Required	Parameter for Update Message
ccRecipients.emailAddress.name	string	Optional	Name of the resource
flag	object	Optional	The flag value that indicates the status, start date, due date, or completion date for the message.
flag.flagStatus	string	Optional	Status value
flag.startDateTime	object	Optional	Time value
flag.startDateTime.dateTime	string	Optional	Time value
flag.startDateTime.timeZone	string	Optional	Parameter for Update Message
flag.dueDateTime	object	Optional	Time value
flag.dueDateTime.dateTime	string	Optional	Time value
flag.dueDateTime.timeZone	string	Optional	Parameter for Update Message
flag.completedDateTime	object	Optional	Time value
flag.completedDateTime.dateTime	string	Optional	Time value
flag.completedDateTime.timeZone	string	Optional	Parameter for Update Message

Input Example

{"path_parameters":{"userPrincipalName":"Example Name","id":"12345678-1234-1234-1234-123456789abc"},"bccRecipients":[{"emailAddress":{"address":"string","name":"Example Name"}}],"body":{"contentType":"string","content":"string"},"categories":["string"],"ccRecipients":[{"emailAddress":{"address":"string","name":"Example Name"}}],"flag":{"flagStatus":"active","startDateTime":{"dateTime":"string","timeZone":"string"},"dueDateTime":{"dateTime":"string","timeZone":"string"},"completedDateTime":{"dateTime":"string","timeZone":"string"}},"from":{"emailAddress":{"address":"string","name":"Example Name"}},"importance":"string","inferenceClassification":"string","internetMessageId":"string","isDeliveryReceiptRequested":true,"isRead":true,"isReadReceiptRequested":true,"multiValueExtendedProperties":[{"id":"12345678-1234-1234-1234-123456789abc","value":["string"]}],"replyTo":[{"emailAddress":{"address":"string","name":"Example Name"}}],"sender":{"emailAddress":{"address":"string","name":"Example Name"}},"singleValueExtendedProperties":[{"id":"12345678-1234-1234-1234-123456789abc","value":"string"}],"subject":"string","toRecipients":[{"emailAddress":{"address":"string","name":"Example Name"}}]}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
receivedDateTime	string	Time value
sentDateTime	string	Time value
hasAttachments	boolean	Output field: hasAttachments
subject	string	Output field: subject
body	object	Request body data
body.contentType	string	Request body data
body.content	string	Request body data
bodyPreview	string	Request body data
inferenceClassification	string	Output field: inferenceClassification

Output Example

{"receivedDateTime":"datetime-value","sentDateTime":"datetime-value","hasAttachments":true,"subject":"subject-value","body":{"contentType":"","content":"content-value"},"bodyPreview":"bodyPreview-value","inferenceClassification":"other"}

Update User

Modify user properties in Microsoft Graph API by specifying the user ID and providing updated information in the request body.

Endpoint

URL: /v1.0/users/{{user_id}}

Method: PATCH

Input

Argument Name	Type	Required	Description
path_parameters.user_id	string	Required	Parameters for the Update User action
aboutMe	string	Optional	A freeform text entry field for the user to describe themselves.
accountEnabled	boolean	Optional	True if the account is enabled; otherwise, false.
ageGroup	string	Optional	Sets the age group of the user.
birthday	string	Optional	The birthday of the user.
businessPhones	array	Optional	The telephone numbers for the user.
city	string	Optional	The city in which the user is located.
companyName	string	Optional	The name of the company that the user is associated.
consentProvidedForMinor	string	Optional	Sets whether consent has been obtained for minors.
country	string	Optional	The country/region in which the user is located.
customSecurityAttributes	object	Optional	An open complex type that holds the value of a custom security attribute that is assigned to a directory object.
[email protected]	string	Optional	Response data
department	string	Optional	The name for the department in which the user works.
displayName	string	Optional	The name displayed in the address book for the user.
employeeId	string	Optional	The employee identifier assigned to the user by the organization.
employeeType	string	Optional	Captures enterprise worker type.
givenName	string	Optional	The given name (first name) of the user.
employeeHireDate	string	Optional	The hire date of the user. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time.
employeeLeaveDateTime	string	Optional	The date and time when the user left or will leave the organization. The timestamp type represents date and time information using ISO 8601 format and is always in UTC time.
employeeOrgData	object	Optional	Represents organization data (for example, division and costCenter) associated with a user.
employeeOrgData.costCenter	string	Optional	The cost center associated with the user.
employeeOrgData.division	string	Optional	The name of the division in which the user works.
interests	array	Optional	A list for the user to describe their interests.
jobTitle	string	Optional	The user's job title.
mail	string	Optional	The SMTP address for the user,

Input Example

{"json_body":{"aboutMe":"Name","accountEnabled":true,"ageGroup":"Adult","birthday":"2014-01-01T00:00:00Z","businessPhones":["+44 20 7946 0958","+91-9876543210"],"city":"London","companyName":"Global Enterprises","consentProvidedForMinor":"Granted","country":"US","customSecurityAttributes":{"@odata.type":"#microsoft.graph.customSecurityAttributeValue"},"department":"Engineering","displayName":"ane M. Smith","employeeId":"EMP123456789","employeeType":"Contractor","givenName":"Sana","employeeHireDate":"2024-05-27T00:00:00Z","employeeLeaveDateTime":"2014-01-01T00:00:00Z.","employeeOrgData":{"costCenter":"string","division":"string"},"interests":["Cooking","Playing"],"jobTitle":"Software Engineer","mail":"[email protected]","mailNickname":"john","mobilePhone":"+1234567890","mySite":"https://www.example.com/johndoe","officeLocation":"Hyderabad","onPremisesExtensionAttributes":{"extensionAttribute1":"string","extensionAttribute2":"string","extensionAttribute3":"string","extensionAttribute4":"string","extensionAttribute5":"string","extensionAttribute6":"string","extensionAttribute7":"string","extensionAttribute8":"string","extensionAttribute9":"string","extensionAttribute10":"string","extensionAttribute11":"string","extensionAttribute12":"string","extensionAttribute13":"string","extensionAttribute14":"string","extensionAttribute15":"string"},"onPremisesImmutableId":"01234567-89ab-cdef-0123-456789abcdef","otherMails":["[email protected]","[email protected]"],"passwordPolicies":"DisableStrongPassword","passwordProfile":{"forceChangePasswordNextSignIn":true,"forceChangePasswordNextSignInWithMfa":false,"password":"string"},"pastProjects":["Project Alpha","Project Gama"],"postalCode":"12345","preferredLanguage":"en-US","responsibilities":["Managing client relationships","Project management"],"schools":["High School ABC","High School XYZ"],"skills":["Data Analysis","Data Science"],"state":"AP","streetAddress":"Sreeram nagar","surname":"Sana","usageLocation":"US","userPrincipalName":"[email protected]","userType":"Guest"},"path_parameters":{"user_id":"678f80e5-e506-4f10-895d-bf664699475d"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"response_text":"string"}

Response Headers

Header	Description	Example
Cache-Control	Directives for caching mechanisms	private
client-request-id	HTTP response header: client-request-id	3763884a-1de2-4f55-a7cd-53a5fda6a36d
Content-Encoding	HTTP response header: Content-Encoding	gzip
content-length	The length of the response body in bytes	140
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Tue, 20 Dec 2022 19:24:30 GMT
Deprecation	HTTP response header: Deprecation
Link	HTTP response header: Link
Location	The URL to redirect a page to	https://graph.microsoft.com
OData-Version	HTTP response header: OData-Version	4.0
request-id	HTTP response header: request-id	bc1b10c5-b74d-4492-8c94-7c9165c883af
Strict-Transport-Security	HTTP response header: Strict-Transport-Security	max-age=31536000
Sunset	HTTP response header: Sunset
Transfer-Encoding	HTTP response header: Transfer-Encoding	chunked
Vary	HTTP response header: Vary	Accept-Encoding
x-ms-ags-diagnostic	HTTP response header: x-ms-ags-diagnostic	{"ServerInfo":{"DataCenter":"Central US","Slice":"E","Ring":"2","ScaleUnit":"001","RoleInstance":"DS2PEPF00001339"}}
x-ms-resource-unit	HTTP response header: x-ms-resource-unit	3

Microsoft Graph API Connector

Configuration

Prerequisites

Authentication Methods

OAuth 2.0 client credentials authentication with these parameters:

Password Grant (Delegated Authentication) for acting on behalf of a user:

Capabilities

Asset Setup

Client Credential Flow Authentication

Password Flow (Delegated Auth)

Authentication flow for OAuth2 Refresh Token

Limit Access to specific mailboxes

Action Setup

OData filters

Well Known Folders

Sites Get Site

Sites Create List

Create List Column

Get list items

Send Email with Attachments Data

Limitations

Notes

Configurations

Microsoft Graph API Asset - Tenant ID

Configuration Parameters

Password Grant (Delegated Authentication)

Configuration Parameters

Oauth 2.0 Client Credentials

Configuration Parameters

MS Graph OpenID Connect Refresh Token Grant

Configuration Parameters

Actions

Add Incident Comment

Endpoint

Input

Input Example

Output

Output Example

Add Members

Endpoint

Input

Input Example

Output

Output Example

Audit Logs Get SignIn

Endpoint

Input

Input Example

Output

Output Example

Audit Logs List SignIns

Endpoint

Input

Input Example

Output

Output Example

Create Contact

Endpoint

Input

Input Example

Output

Output Example

Create Event

Endpoint

Input

Input Example

Output

Output Example

Create rejectedSender

Endpoint

Input

Input Example

Output

Output Example

Delete Email

Endpoint

Input

Input Example

Output

Output Example