--- title: Microsoft Graph API Connector slug: connectors/microsoft-graph-api-connector docTags: createdAt: 2026-10-12T09:27:28.111Z --- Microsoft Graph API provides a unified programmatic interface to access data and intelligence across Microsoft 365 services, enabling automation, management, and security operations at scale. Microsoft Graph API is a unified gateway to Microsoft 365 services, including security, identity, email, collaboration, and directory management. This connector enables Swimlane Turbine users to automate a wide range of Microsoft 365 tasks—such as managing users, groups, emails, incidents, alerts, authentication methods, and Teams communications—without writing code. By integrating Microsoft Graph API with Turbine, security and IT teams can orchestrate identity lifecycle management, automate incident response, streamline email and collaboration workflows, and enhance threat detection and remediation. This integration empowers organizations to break down silos between security, IT, and collaboration teams, accelerating response times and improving operational efficiency across the Microsoft ecosystem. ## Configuration ### Prerequisites Before using the Microsoft Graph API connector, ensure you have the following prerequisites in place: - OAuth 2.0 Client Credentials authentication: - URL: The base endpoint for your Microsoft Graph API instance. - Client ID: The application/client identifier registered in Azure AD. - Client Secret: The secret key associated with your Azure AD application. - Token URL: The OAuth 2.0 token endpoint for acquiring access tokens. - Scope: The permissions required for the intended Graph API operations. - OAuth 2.0 Refresh Token authentication: - URL: The base endpoint for your Microsoft Graph API instance. - Client ID: The application/client identifier registered in Azure AD. - Client Secret: The secret key associated with your Azure AD application. - Delegated Flow Authentication (on behalf of a user): - URL: The base endpoint for your Microsoft Graph API instance. - Tenant ID: The unique identifier of your Azure AD tenant. - Username: The username of the account to authenticate as. - Password: The password for the specified user account. *... and so on* ## Authentication Methods ### OAuth 2.0 client credentials authentication with these parameters: - url: Endpoint for Microsoft Graph API. - client\_id: Application (client) ID registered in Azure AD. - client\_secret: Client secret (key) generated for the application in Azure AD. - token\_url: URL to retrieve the OAuth token. - scope: Permissions the app requires. ### Password Grant (Delegated Authentication) for acting on behalf of a user: - url: Endpoint for Microsoft Graph API. - tenant\_id: Directory ID of the Azure AD tenant. - oauth\_un: User's username to authenticate. - oauth\_pwd: User's password to authenticate. - oauth\_cl\_id: Application (client) ID registered in Azure AD. - oauth\_cl\_secret: Client secret (key) generated for the application in Azure AD. - login\_url: Login URL. Default value is [https://login.microsoftonline.com](https://login.microsoftonline.com). (Optional). - scope: Permissions the app requires. Optional field. (Optional). - url: Endpoint for Microsoft Graph API. - client\_ID: Application (client) ID registered in Azure AD. - client\_Secret: Client secret (key) generated for the application in Azure AD. - tenant\_id: Directory ID of the Azure AD tenant. - scope: Permissions the app requires. - url: Endpoint for Microsoft Graph API. - client\_ID: Application (client) ID registered in Azure AD. - client\_Secret: Client secret (key) generated for the application in Azure AD. - refresh\_token: Refresh Token. - scope: Permissions the app requires. ## Capabilities The Microsoft Graph API connector gives the ability to get and update security alerts, and modify user licenses and sessions. - Add Group Member - Add Group Owner - Add Identity Directory Device Registered User - Add Identity Directory Role Member - Add Incident Comment - Add member to Directory Administrative Unit - Add Members - Assign and Remove License - Audit Logs Get SignIn - Audit Logs List SignIns - Cancel Security Action - Create Contact - Create Event - Create rejectedSender - Create Group *... and so on* ## Asset Setup ### Client Credential Flow Authentication Authentication uses Azure application OAuth2. You will need an admin account in Azure to create the application. Recommended Application Permissions (feel free use custom permissions if you only use certain actions): - User.ReadWrite.All - Calendars.ReadWrite - Directory.ReadWrite.All - Directory.AccessAsUser.All - SecurityEvents.Read.All - SecurityEvents.ReadWrite.All - Mail.ReadWrite - Mail.Send - Sites.ReadWrite.All - Files.ReadWrite.All - AuditLog.Read.All - Mail.ReadBasic.All - SecurityAnalyzedMessage.ReadWrite.All - SecurityAlert.ReadWrite.All - User.ManageIdentities.All, *... and so on* Sites.ReadWrite.All is needed by Sharepoint actions only. In order to set up the asset, you need the following: - Azure Application Client ID - Azure Application Client Secret - Azure Tenant ID Steps to create the Azure app: 1. Go to the [App Registration page](https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade) in the Azure portal. 2. Click `New Registration`. 3. Enter a name for your new application and choose `Accounts in this organizational directory only`, then click `Register` at the bottom. 4. Navigate to the `API permissions` tab on the left navigation menu. 5. Select `Add a permission`. 6. Select `Microsoft Graph`. 7. Select `Application permissions`, then mark all the permissions you need for the actions you are using (See suggested permissions at the top of the asset setup section). 8. Click the `Add permissions` button at the bottom of the page. 9. Select `Grant admin consent` for your organization, then your permissions should look as below. 10. Navigate to the `Certificates & secrets` tab and select `New client secret`. 11. Fill out the description and expiration, then click the `Add` button at the bottom. 12. The `Value` of the secret you just created is the `Client Secret` needed for the Swimlane asset. 13. Navigate to the `Overview` tab on the left menu. 14. The `Client ID` and `Tenant ID` needed in the asset are shown on this page. The `Client ID`, `Tenant ID`, and `Client Secret` described in the steps above are the credentials you need for the asset. ### Password Flow (Delegated Auth) - Use Delegated Permissions, instead of Application Permissions, and generate `Client ID`, `Tenant ID`, and `Client Secret` as described in the above Client Credential Flow Authentication. - We also need an `Username` and a `Password` for this authentication. ### Authentication flow for OAuth2 Refresh Token - Oauth 2.0 refresh token grant, which requires a `Refresh Token`,`Tenant ID`, `Client ID` and `Client Secret`. Use this auth with accounts which have MFA enabled. To generate a refresh token please follow the instructions below. - In step 3 of the above-mentioned setup instructions, please provide a `Redirect URI` and select the platform as 'Web', before clicking on `Register` at the the bottom. - Proceed with the remaining steps to generate 'Client ID', `Tenant ID` and `Client Secret`. - Add the permissions in **Delegated Permissions**. - The Swimlane team will provide a Python script and instructions on how to use the script to generate the Refresh Token. ### Limit Access to specific mailboxes Administrators who want to limit app access to specific mailboxes can create an application access policy by using the **New-ApplicationAccessPolicy** PowerShell cmdlet. For more information please see the article [Limiting application permissions to specific Exchange Online mailboxes](https://docs.microsoft.com/en-us/graph/auth-limit-mailbox-access). ## Action Setup ### OData filters Information on the filter input formatting can be found [here](https://docs.microsoft.com/en-us/graph/query-parameters#filter-parameter). Keep in mind that not specifying a folder as an input will result in the query affecting all possible folders. Example: If we want to ingest only unread emails, and we don't set the input "folder", we will ingest all unread emails from all folders, including "Deleted Items", "Junk", etc. ### Well Known Folders Well known folders can be used instead of Folder IDs for email actions. All well known folder names can be found [here](https://docs.microsoft.com/en-us/graph/api/resources/mailfolder?view=graph-rest-1.0). ### Sites Get Site All the Sites actions require the site ID to be executed. The site ID can be obtained using the action Sites Get Site, in order to run the action the `site_hostname` and `site_name` are needed. This two values can be found in a site URL: ```javascript https://{site_hostname}.sharepoint.com/sites/{site_name} ``` For example if our site URL is `https://swimlaneintegrations.sharepoint.com/sites/IntegrationsSite` we should use: - `site_hostname`: `swimlaneintegrations` - `site_name`: `IntegrationsSite` After the action execution you can find the Site ID on the `ID` output field. ### Sites Create List In order to create a list with its columns, use the input `Columns`. You can find all the possible values with its configuration on the following table. | Property name | Type | Description | | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- | | boolean | [booleanColumn](https://docs.microsoft.com/en-us/graph/api/resources/booleancolumn?view=graph-rest-1.0) | This column stores boolean values. | | calculated | [calculatedColumn](https://docs.microsoft.com/en-us/graph/api/resources/calculatedcolumn?view=graph-rest-1.0) | This column's data is calculated based on other columns. | | choice | [choiceColumn](https://docs.microsoft.com/en-us/graph/api/resources/choicecolumn?view=graph-rest-1.0) | This column stores data from a list of choices. | | currency | [currencyColumn](https://docs.microsoft.com/en-us/graph/api/resources/currencycolumn?view=graph-rest-1.0) | This column stores currency values. | | dateTime | [dateTimeColumn](https://docs.microsoft.com/en-us/graph/api/resources/datetimecolumn?view=graph-rest-1.0) | This column stores DateTime values. | | geolocation | [geolocationColumn](https://docs.microsoft.com/en-us/graph/api/resources/geolocationcolumn?view=graph-rest-1.0) | This column stores a geolocation. | | lookup | [lookupColumn](https://docs.microsoft.com/en-us/graph/api/resources/lookupcolumn?view=graph-rest-1.0) | This column's data is looked up from another source in the site. | | number | [numberColumn](https://docs.microsoft.com/en-us/graph/api/resources/numbercolumn?view=graph-rest-1.0) | This column stores number values. | | personOrGroup | [personOrGroupColumn](https://docs.microsoft.com/en-us/graph/api/resources/personorgroupcolumn?view=graph-rest-1.0) | This column stores Person or Group values. | | text | [textColumn](https://docs.microsoft.com/en-us/graph/api/resources/textcolumn?view=graph-rest-1.0) | This column stores text values. | | validation | [columnValidation](https://docs.microsoft.com/en-us/graph/api/resources/columnvalidation?view=graph-rest-1.0) | This column stores validation formula and message for the column. | | hyperlinkOrPicture | [hyperlinkOrPictureColumn](https://docs.microsoft.com/en-us/graph/api/resources/hyperlinkorpicturecolumn?view=graph-rest-1.0) | This column stores hyperlink or picture values. | | term | [termColumn](https://docs.microsoft.com/en-us/graph/api/resources/termcolumn?view=graph-rest-1.0) | This column stores taxonomy terms. | | thumbnail | [thumbnailColumn](https://docs.microsoft.com/en-us/graph/api/resources/thumbnailcolumn?view=graph-rest-1.0) | This column stores thumbnail values. | | contentApprovalStatus | [contentApprovalStatusColumn](https://docs.microsoft.com/en-us/graph/api/resources/contentapprovalstatuscolumn?view=graph-rest-1.0) | This column stores content approval status. | For a complete version of this table please see [the official column definition table.](https://docs.microsoft.com/en-us/graph/api/resources/columndefinition?view=graph-rest-1.0#properties) ### Create List Column Refer to the above table to get the `Type properties` and `Column type` input. The `Type properties` are documented within the links in the `Type` column. ### Get list items In order to use the filter input please refer to the [OData filters](docId\:RQleZQ7xFCNOd3QD22CmF) section. The column used to filter the output must be indexed, see the [Microsoft documentation](https://support.microsoft.com/en-us/office/add-an-index-to-a-list-or-library-column-f3f00554-b7dc-44d1-a2ed-d477eac463b0?ui=en-us\&rs=en-us\&ad=us) to add an index to a list. ### Send Email with Attachments Data This action works similarly to the standard "Send Email" operation but requires you to manually define each attachment's data. When sending attachments, include an array of attachment objects, where each object must specify the following fields: - **contentBytes**: The file's contents, provided either as a plain text string or a base64-encoded string. - **name**: The filename of the attachment. - **@odata.type**: The OData type of the attachment. The default value is `#microsoft.graph.fileAttachment`. - **contentType**: The MIME type of the attachment. The default value is `text/plain`. :::BlockQuote **Note:** All attachment fields must be entered explicitly for each attachment you include. ::: This approach provides flexibility for specifying the exact content, name, and type for each file you wish to attach to your outgoing email. ## Limitations When using `$filter` and `$orderby` in the same query to get messages, make sure to specify properties in the following ways: - Properties that appear in `$orderby` must also appear in $filter. - Properties that appear in `$orderby` are in the same order as in $filter. - Properties that are present in `$orderby` appear in `$filter` before any properties that aren't. Failing to do this results in the following error: - Error code: InefficientFilter - Error message: The restriction or sort order is too complex for this operation. The Assign/Remove User License requires either the disabled plans and accompanying SKU IDs to assign licenses or the SKU ID of the license you want to remove. The Get Security Alert has additional information it can return. There are a large number of fields that don't relate to many alerts, so they are not mapped; you can add them if desired. ## Notes - [An Introduction to Microsoft Graph API](https://social.technet.microsoft.com/wiki/contents/articles/33525.an-introduction-to-microsoft-graph-api.aspx) - [Microsoft Graph Security API Homepage](https://www.microsoft.com/en-us/security/intelligence-security-api) - [Microsoft Graph REST API v1.0 reference](https://docs.microsoft.com/en-us/graph/api/overview?view=graph-rest-1.0) - [Query Parameters Documentation - OData V4](https://docs.microsoft.com/en-us/graph/query-parameters) - [Microsoft Graph Security API v1.0 refrence](https://docs.microsoft.com/en-us/graph/api/resources/security-api-overview?view=graph-rest-beta) - [Azure AD OAuth2 flow](https://docs.microsoft.com/en-us/azure/active-directory/develop/v1-protocols-oauth-code) - [oauthlib Legacy Application client](https://requests-oauthlib.readthedocs.io/en/latest/oauth2_workflow.html#legacy-application-flow), this is sort of a hack to bypass manual login (typically required) - [Limiting application permissions to specific Exchange Online mailboxes](https://docs.microsoft.com/en-us/graph/auth-limit-mailbox-access) - [Microsoft Graph Reports Audit Logs API reference](https://learn.microsoft.com/en-us/graph/api/resources/azure-ad-auditlog-overview?view=graph-rest-1.0) # Configurations ## Microsoft Graph API Asset - Tenant ID Authenticates using Client Credentials and Tenant ID ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | -------------- | ----------------------------------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | tenant\_id | The Tenant ID. | string | Required | | client\_ID | The client ID | string | Required | | client\_Secret | The client secret. | string | Required | | scope | List of permission scopes for this action. | array | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | | ca\_cert | A Base64 encoded CA certificate to use for SSL verification | string | Optional | ## Password Grant (Delegated Authentication) Authenticates on behalf of a user using oauth 2.0 credentials ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ----------------- | ----------------------------------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | login\_url | | string | Optional | | tenant\_id | | string | Required | | oauth\_un | The username for authentication | string | Required | | oauth\_pwd | The password for authentication | string | Required | | oauth\_cl\_id | The client ID | string | Required | | oauth\_cl\_secret | The client secret. | string | Required | | scope | Permission scopes for this action. | array | Optional | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | | ca\_cert | A Base64 encoded CA certificate to use for SSL verification | string | Optional | ## Oauth 2.0 Client Credentials Authenticates using oauth 2.0 client credentials ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | token\_url | Must start with [https://login.microsoftonline.com/](https://login.microsoftonline.com/) and then continue with the tenant\_id, and then be prepended with /oauth2/v2.0/token | string | Required | | client\_id | The client ID | string | Required | | client\_secret | The client secret. | string | Required | | scope | List of permission scopes for this action. | array | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | | ca\_cert | A Base64 encoded CA certificate to use for SSL verification | string | Optional | ## MS Graph OpenID Connect Refresh Token Grant Authenticates using refresh token. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | -------------- | ----------------------------------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | cl\_id | The client ID. | string | Required | | cl\_secret | The client secret. | string | Required | | refresh\_token | Refresh Token. | string | Optional | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | | ca\_cert | A Base64 encoded CA certificate to use for SSL verification | string | Optional | # Actions ## Add Incident Comment Append a user-defined comment to an existing incident in Microsoft Graph API by specifying the incident ID and comment content. ### Endpoint - **URL:** `/v1.0/security/incidents/{{incidentId}}/comments` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ------------------------ | | `path_parameters.incidentId` | string | Required | ID of the Incident. | | `@odata.type` | string | Optional | Response data | | `comment` | string | Optional | The comment to be added. | ### Input Example `{"json_body":{"@odata.type":"microsoft.graph.security.alertComment","comment":"Demo for docs"},"path_parameters":{"incidentId":"545"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `value` | array | Value for the parameter | | `value.comment` | string | Value for the parameter | | `value.createdByDisplayName` | string | Name of the resource | | `value.createdDateTime` | string | Value for the parameter | ### Output Example `{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#security/incidents('545')/comments","value":[{"comment":"Demo for docs","createdByDisplayName":"API-App:Defender - Test - JHYap","createdDateTime":"2024-06-13T06:38:20.6536162Z"},{"comment":"Demo for docs","createdByDisplayName":"API-App:Defender - Test - JHYap","createdDateTime":"2024-06-13T06:51:40.9010261Z"},{"comment":"Demo for docs","createdByDisplayName":"Defender - Test - JHYap","createdDateTime":"2024-06-13T06:54:26.9428449Z"}...` ## Add Members Add a new member to a specified group in Microsoft Graph API using the group ID and the member's unique identifier. ### Endpoint - **URL:** `/v1.0/groups/{{group-id}}/members/$ref` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ------------------------------------------------------ | | `path_parameters.group-id` | string | Required | The ID of the group to which the member will be added. | | `@odata.id` | string | Optional | The ID of the directory object to add as a member. | ### Input Example `{"json_body":{"@odata.id":"https://graph.microsoft.com/v1.0/directoryObjects/{id}"},"path_parameters":{"group-id":"f0b2d6f5-097d-4177-91af-a24e530b53cc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{}` ## Audit Logs Get SignIn Retrieve detailed information for a specific sign-in event in Microsoft Entra using the unique tenant ID. ### Endpoint - **URL:** `/v1.0/auditLogs/signIns/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ----------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Audit Logs Get SignIn action | ### Input Example `{"path_parameters":{"id":"66ea54eb-6301-4ee5-be62-ff5a759b0100"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `value` | array | Value for the parameter | | `value.id` | string | Unique identifier | | `value.createdDateTime` | string | Value for the parameter | | `value.userDisplayName` | string | Name of the resource | | `value.userPrincipalName` | string | Name of the resource | | `value.userId` | string | Unique identifier | | `value.appId` | string | Unique identifier | | `value.appDisplayName` | string | Name of the resource | | `value.ipAddress` | string | Value for the parameter | | `value.clientAppUsed` | string | Value for the parameter | | `value.correlationId` | string | Unique identifier | | `value.conditionalAccessStatus` | string | Status value | | `value.isInteractive` | boolean | Value for the parameter | | `value.riskDetail` | string | Value for the parameter | | `value.riskLevelAggregated` | string | Value for the parameter | | `value.riskLevelDuringSignIn` | string | Value for the parameter | | `value.riskState` | string | Value for the parameter | | `value.riskEventTypes` | array | Type of the resource | | `value.riskEventTypes.file_name` | string | Name of the resource | | `value.riskEventTypes.file` | string | Type of the resource | | `value.resourceDisplayName` | string | Name of the resource | | `value.resourceId` | string | Unique identifier | ### Output Example `{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#auditLogs/signIns","value":[{"id":"66ea54eb-6301-4ee5-be62-ff5a759b0100","createdDateTime":"2023-12-01T16:03:24Z","userDisplayName":"Test Contoso","userPrincipalName":"testaccount1@contoso.com","userId":"26be570a-ae82-4189-b4e2-a37c6808512d","appId":"de8bc8b5-d9f9-48b1-a8ad-b748da725064","appDisplayName":"Graph explorer","ipAddress":"131.107.159.37","clientAppUsed":"Browser","correlationId":"d79f5bee-5860-4832-928f-3133e22ae912","cond...` ## Audit Logs List SignIns Retrieve user sign-in logs from Microsoft Entra to analyze access patterns and trends for a specified tenant. ### Endpoint - **URL:** `/v1.0/auditLogs/signIns` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ----------------------------------------------------------------------------- | | `parameters.$top` | number | Optional | Sets the page size of results. | | `parameters.$skiptoken` | string | Optional | Retrieves the next page of results from result sets that span multiple pages. | | `parameters.$filter` | string | Optional | Filters results (rows). | ### Input Example `{"parameters":{"$top":2,"$skiptoken":"9177f2e3532fcd4c4d225f68f7b9bdf7_1","$filter":"createdDateTime ge 2024-07-01T00:00:00Z and createdDateTime le 2024-07-14T23:59:59Z"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `@odata.nextLink` | string | Response data | | `value` | array | Value for the parameter | | `value.id` | string | Unique identifier | | `value.createdDateTime` | string | Value for the parameter | | `value.userDisplayName` | string | Name of the resource | | `value.userPrincipalName` | string | Name of the resource | | `value.userId` | string | Unique identifier | | `value.appId` | string | Unique identifier | | `value.appDisplayName` | string | Name of the resource | | `value.ipAddress` | string | Value for the parameter | | `value.clientAppUsed` | string | Value for the parameter | | `value.correlationId` | string | Unique identifier | | `value.conditionalAccessStatus` | string | Status value | | `value.isInteractive` | boolean | Value for the parameter | | `value.riskDetail` | string | Value for the parameter | | `value.riskLevelAggregated` | string | Value for the parameter | | `value.riskLevelDuringSignIn` | string | Value for the parameter | | `value.riskState` | string | Value for the parameter | | `value.riskEventTypes` | array | Type of the resource | | `value.riskEventTypes.file_name` | string | Name of the resource | | `value.riskEventTypes.file` | string | Type of the resource | | `value.resourceDisplayName` | string | Name of the resource | ### Output Example `{"@odata.context":"string","@odata.nextLink":"string","value":[{"id":"12345678-1234-1234-1234-123456789abc","createdDateTime":"string","userDisplayName":"Example Name","userPrincipalName":"Example Name","userId":"string","appId":"string","appDisplayName":"Example Name","ipAddress":"string","clientAppUsed":"string","correlationId":"string","conditionalAccessStatus":"active","isInteractive":true,"riskDetail":"string","riskLevelAggregated":"string","riskLevelDuringSignIn":"string"}]}` ## Create Contact Add a new contact to a specified folder in Microsoft Graph API using the provided folder ID and contact details. ### Endpoint - **URL:** `/v1.0/users/{{id}}/contacts` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ---------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Create Contact action | | `givenName` | string | Optional | The contact's given name. | | `surname` | string | Optional | The contact's surname. | | `emailAddresses` | array | Optional | The contact's email addresses. | | `emailAddresses.address` | string | Optional | The email address of the contact. | | `emailAddresses.name` | string | Optional | The display name of the contact. | | `businessPhones` | array | Optional | The contact's business phone numbers. | ### Input Example `{"json_body":{"givenName":"Pavel","surname":"Bansky","emailAddresses":[{"address":"pavelb@contoso.com","name":"Pavel Bansky"}],"businessPhones":["+1 732 555 0102"]},"path_parameters":{"id":"aaron.ooi_swimlane.com#EXT#@swimlaneintegrations.onmicrosoft.com"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `createdDateTime` | string | Time value | | `lastModifiedDateTime` | string | Time value | | `displayName` | string | Name of the resource | ### Output Example `{"id":"id-value","createdDateTime":"2015-11-09T02:14:32Z","lastModifiedDateTime":"2015-11-09T02:14:32Z","displayName":"Pavel Bansky"}` ## Create Event Create a new calendar event in a specified user's calendar using their email address through the Microsoft Graph API. ### Endpoint - **URL:** `/v1.0/users/{{email_address}}/events` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `path_parameters.email_address` | string | Required | Parameters for the Create Event action | | `headers` | object | Optional | HTTP headers for the request | | `headers.Prefer` | string | Optional | Specify the time zone for the start and end times in the response. | | `subject` | string | Optional | The text of the event's subject line. | | `body` | object | Optional | The body of the message associated with the event. It can be in HTML or text format. | | `body.contentType` | string | Optional | The content of the item. | | `body.content` | string | Optional | The type of the content. | | `start` | object | Optional | The start date, time, and time zone of the event. By default, the start time is in UTC. | | `start.dateTime` | string | Optional | A single point of time in a combined date and time representation (T; for example, 2017-08-29T04:00:00.0000000). | | `start.timeZone` | string | Optional | Represents a time zone, for example, "Pacific Standard Time". | | `end` | object | Optional | The date, time, and time zone that the event ends. By default, the end time is in UTC. | | `end.dateTime` | string | Optional | A single point of time in a combined date and time representation (T; for example, 2017-08-29T04:00:00.0000000). | | `end.timeZone` | string | Optional | Represents a time zone, for example, "Pacific Standard Time". | | `location` | object | Optional | The location of the event. | | `location.displayName` | string | Optional | The name associated with the location. | | `locations` | array | Optional | The locations where the event is held or attended from. The location and locations properties always correspond with each other. If you update the location property, any prior locations in the locations collection would be removed and replaced by the new location value. | | `locations.displayName` | string | Optional | The name associated with the location. | | `locations.locationType` | string | Optional | The type of location. | | `locations.uniqueIdType` | string | Optional | For internal use only. | | `locations.locationEmailAddress` | string | Optional | Optional email address of the location. | | `locations.locationUri` | string | Optional | Optional URI representing the location. | | `locations.uniqueId` | string | Optional | For internal use only. | | `locations.address` | object | Optional | The street address of the location. | | `locations.address.city` | string | Optional | The city. | | `locations.address.countryOrRegion` | string | Optional | The country or region. It's a free-format string value, for example, "United States". | ### Input Example `{"path_parameters":{"email_address":"integrations@swimlaneintegrations.onmicrosoft.com"},"headers":{"Prefer":"outlook.timezone=\"Pacific Standard Time\""}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | ---------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `@odata.etag` | string | Response data | | `id` | string | Unique identifier | | `createdDateTime` | string | Time value | | `lastModifiedDateTime` | string | Time value | | `changeKey` | string | Output field: changeKey | | `categories` | array | Output field: categories | | `transactionId` | object | Unique identifier | | `originalStartTimeZone` | string | Output field: originalStartTimeZone | | `originalEndTimeZone` | string | Output field: originalEndTimeZone | | `iCalUId` | string | Unique identifier | | `uid` | string | Unique identifier | | `reminderMinutesBeforeStart` | number | Output field: reminderMinutesBeforeStart | | `isReminderOn` | boolean | Output field: isReminderOn | | `hasAttachments` | boolean | Output field: hasAttachments | | `subject` | string | Output field: subject | | `bodyPreview` | string | Request body data | | `importance` | string | Output field: importance | | `sensitivity` | string | Output field: sensitivity | | `isAllDay` | boolean | Output field: isAllDay | | `isCancelled` | boolean | Output field: isCancelled | | `isOrganizer` | boolean | Output field: isOrganizer | | `responseRequested` | boolean | Output field: responseRequested | ### Output Example `{"@odata.context":"string","@odata.etag":"string","id":"12345678-1234-1234-1234-123456789abc","createdDateTime":"string","lastModifiedDateTime":"string","changeKey":"string","categories":["string"],"transactionId":{},"originalStartTimeZone":"string","originalEndTimeZone":"string","iCalUId":"string","uid":"string","reminderMinutesBeforeStart":123,"isReminderOn":true,"hasAttachments":true}` ## Create rejectedSender Add a user or group to the rejected sender list in Microsoft Graph API by specifying their unique ID and @odata.id. ### Endpoint - **URL:** `/v1.0/groups/{{id}}/rejectedSenders/$ref` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------ | | `path_parameters.id` | string | Required | The unique identifier for the group. | | `@odata.id` | string | Optional | The ID of a user or group object. | ### Input Example `{"json_body":{"@odata.id":"https://graph.microsoft.com/v1.0/users/alexd@contoso.com"},"path_parameters":{"id":"732227b1-1927-49d4-bba9-cc30e6baf602"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"response_text":"string"}` ## Delete Email Permanently remove an email from a specified mailbox using the provided email address and email ID through Microsoft Graph API. ### Endpoint - **URL:** `/v1.0/users/{{email_address}}/messages/{{email_id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ------------------------------------- | | `path_parameters.email_address` | string | Required | The account associated with the email | | `path_parameters.email_id` | string | Required | The ID of the email | ### Input Example `{"path_parameters":{"email_address":"string","email_id":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"response_text":"string"}` ## Delete Email Authentication Method Remove a user's specified email authentication method in Microsoft Graph API using their email address and method ID. ### Endpoint - **URL:** `/v1.0/users/{{email_address}}/authentication/emailMethods/{{emailMethods-id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `path_parameters.email_address` | string | Required | The account associated with the email. | | `path_parameters.emailMethods-id` | string | Required | The ID of the email authentication method, referenced by , is always 3ddfcfc8-9383-446f-83cc-3ab9be4be18f. Delete the email method from your own account. For a signed-in user to update their own authentication method, they must have satisfied a multi-factor authentication requirement during sign in. | ### Input Example `{"path_parameters":{"email_address":"integrations@swimlaneintegrations.onmicrosoft.com","emailMethods-id":"3ddfcfc8-9383-446f-83cc-3ab9be4be18f"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"response_text":"string"}` ## Delete FIDO2 Authentication Method Remove a user's FIDO2 security key authentication method in Microsoft Graph API using the specified email address and method ID. ### Endpoint - **URL:** `/v1.0/users/{{email_address}}/authentication/fido2Methods/{{id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ------------------------------------------------------- | | `path_parameters.email_address` | string | Required | The account associated with the email. | | `path_parameters.id` | string | Required | The ID of the FIDO2 Security Key authentication method. | ### Input Example `{"path_parameters":{"email_address":"integrations@swimlaneintegrations.onmicrosoft.com","id":"_jpuR-TGZtk6aQCLF3BQjA2"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"response_text":"string"}` ## Delete Microsoft Authenticator Auth Method Remove a user's specific Microsoft Authenticator authentication method using their email address and authenticator ID in Microsoft Graph API. ### Endpoint - **URL:** `/v1.0/users/{{email_address}}/authentication/microsoftAuthenticatorMethods/{{microsoftAuthenticatorAuthenticationMethodId}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------------------------------- | -------- | ------------ | ------------------------------------------------------------ | | `path_parameters.email_address` | string | Required | The account associated with the email. | | `path_parameters.microsoftAuthenticatorAuthenticationMethodId` | string | Required | The ID of the Microsoft Authenticator authentication method. | ### Input Example `{"path_parameters":{"email_address":"integrations@swimlaneintegrations.onmicrosoft.com","microsoftAuthenticatorAuthenticationMethodId":"_jpuR-TGZtk6aQCLF3BQjA2"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"response_text":"string"}` ## Delete Phone Authentication Method Remove a user's phone authentication method in Microsoft Graph API using the specified email address and unique phoneMethodId. ### Endpoint - **URL:** `/v1.0/users/{{email_address}}/authentication/phoneMethods/{{phoneMethodId}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.email_address` | string | Required | The account associated with the email. | | `path_parameters.phoneMethodId` | string | Required | The ID of the phone authentication method. The Phone Method ID values correspond to deleting specific phone types are b6332ec1-7057-4abe-9331-3d72feddfe41 for alternateMobile, e37fc753-ff3b-4958-9484-eaa9425c82bc for office, and 3179e48a-750b-4051-897c-87b9720928f7 for mobile. | ### Input Example `{"path_parameters":{"email_address":"integrations@swimlaneintegrations.onmicrosoft.com","phoneMethodId":"3179e48a-750b-4051-897c-87b9720928f7"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"response_text":"string"}` ## Delete Software OATH Authentication Method Remove a user's Software OATH token authentication method from Microsoft Graph API using the specified email address and authentication method ID. ### Endpoint - **URL:** `/v1.0/users/{{email_address}}/authentication/softwareOathMethods/{{id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | -------------------------------------------------------- | | `path_parameters.email_address` | string | Required | The account associated with the email. | | `path_parameters.id` | string | Required | The ID of the Software OATH token authentication method. | ### Input Example `{"path_parameters":{"email_address":"integrations@swimlaneintegrations.onmicrosoft.com","id":"b172893e-893e-b172-3e89-72b13e8972b1"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"response_text":"string"}` ## Delete Temporary Access Pass Auth Method Remove a user's Temporary Access Pass authentication method in Microsoft Graph API using the specified email address and authentication method ID. ### Endpoint - **URL:** `/v1.0/users/{{email_address}}/authentication/temporaryAccessPassMethods/{{id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ---------------------------------------------------------- | | `path_parameters.email_address` | string | Required | The account associated with the email. | | `path_parameters.id` | string | Required | The ID of the Temporary Access Pass authentication method. | ### Input Example `{"path_parameters":{"email_address":"integrations@swimlaneintegrations.onmicrosoft.com","id":"05267842-25b2-4b21-8abd-8e4982796f7f"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"response_text":"string"}` ## Delete Windows Hello For Business Auth Method Remove a Windows Hello For Business authentication method from a user account in Microsoft Graph API using the specified email address and authentication method ID. ### Endpoint - **URL:** `/v1.0/users/{{email_address}}/authentication/windowsHelloForBusinessMethods/{{windowsHelloForBusinessAuthenticationMethodId}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------------------------------------- | -------- | ------------ | --------------------------------------------------------------- | | `path_parameters.email_address` | string | Required | The account associated with the email. | | `path_parameters.windowsHelloForBusinessAuthenticationMethodId` | string | Required | The ID of the Windows Hello For Business authentication method. | ### Input Example `{"path_parameters":{"email_address":"integrations@swimlaneintegrations.onmicrosoft.com","windowsHelloForBusinessAuthenticationMethodId":"_jpuR-TGZtk6aQCLF3BQjA2"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"response_text":"string"}` ## Expand and Get Item Properties Attached to Message Retrieve detailed properties of a specific email attachment in Microsoft Graph API using the provided email address, email ID, and attachment ID. ### Endpoint - **URL:** `/v1.0/users/{{email_address}}/messages/{{email_id}}/attachments/{{attachment_id}}/` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ------------------------------------------------------------------------- | | `path_parameters.email_address` | string | Required | The account associated with the email. | | `path_parameters.email_id` | string | Required | The ID of the email to retrieve attachments from. | | `path_parameters.attachment_id` | string | Required | Attachment ID. | | `remove_content_bytes` | boolean | Optional | Remove Content Bytes from the response. | | `parameters.$expand` | string | Optional | To get the properties of an item attachment (contact, event, or message). | ### Input Example `{"parameters":{"$expand":"microsoft.graph.itemattachment/item"},"path_parameters":{"email_address":"integrations@.onmicrosoft.com","email_id":"AAMkADMxZmU3ZWQ4LTMzNGItNGY3ZC1iM2UxLWM3MDQzOGVjMzlkNwBGAAAAAAAHYPwuVwMWSrFeyLv6XHMzBwCBJRT9-oiDTLpLg45RvPkCAAAAAAEMAACBJRT9-oiDTLpLg45RvPkCAAQxsRLaAAA=","attachment_id":"AAMkADMxZmU3ZWQ4LTMzNGItNGY3ZC1iM2UxLWM3MDQzOGVjMzlkNwBGAAAAAAAHYPwuVwMWSrFeyLv6XHMzBwCBJRT9-oiDTLpLg45RvPkCAAAAAAEMAACBJRT9-oiDTLpLg45RvPkCAAQxsRLaAAABEgAQABYpe5LWcI5Cg91dH8N8e_s="},"remove_content_bytes":true}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | --------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `@odata.type` | string | Response data | | `id` | string | Unique identifier | | `lastModifiedDateTime` | string | Time value | | `name` | string | Name of the resource | | `contentType` | object | Type of the resource | | `size` | number | Output field: size | | `isInline` | boolean | Output field: isInline | | `item@odata.associationLink` | string | Response data | | `item@odata.navigationLink` | string | Response data | | `item` | object | Output field: item | | `item.@odata.type` | string | Response data | | `item.id` | string | Unique identifier | | `item.createdDateTime` | string | Time value | | `item.lastModifiedDateTime` | string | Time value | | `item.receivedDateTime` | string | Time value | | `item.sentDateTime` | string | Time value | | `item.hasAttachments` | boolean | Output field: item.hasAttachments | | `item.internetMessageId` | string | Unique identifier | | `item.subject` | string | Output field: item.subject | | `item.bodyPreview` | string | Request body data | | `item.importance` | string | Output field: item.importance | | `item.conversationId` | string | Unique identifier | ### Output Example `{"@odata.context":"string","@odata.type":"string","id":"12345678-1234-1234-1234-123456789abc","lastModifiedDateTime":"string","name":"Example Name","contentType":{},"size":123,"isInline":true,"item@odata.associationLink":"string","item@odata.navigationLink":"string","item":{"@odata.type":"string","id":"12345678-1234-1234-1234-123456789abc","createdDateTime":"string","lastModifiedDateTime":"string","receivedDateTime":"string","sentDateTime":"string","hasAttachments":true,"internetMessageId":"stri...` ## Export Email as EML Export a specific email as an EML file from Microsoft Graph API using the provided email ID and address. ### Endpoint - **URL:** `/v1.0/users/{{email_address}}/messages/{{id}}/$value` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | --------------------------------------------------- | | `path_parameters.email_address` | string | Required | Parameters for the Export Email as EML action | | `path_parameters.id` | string | Required | Parameters for the Export Email as EML action | | `filename` | string | Optional | Filename for the generated eml file. Default - .eml | ### Input Example `{"path_parameters":{"email_address":"travis.riley@swimlaneintegrations.onmicrosoft.com","id":"KH5kvS_JT3JBwCGdzOUGK1yRYre5W5mstJUAAAAAAEMAACGdzOUGK1yRYre5W5mstJUAAOQSnsJAAA="}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `file` | object | Attachments | | `file.file` | string | Output field: file.file | | `file.file_name` | string | Name of the resource | ### Output Example `{"file":{"file":"string","file_name":"Example Name"}}` ## Forward Email Forward an email from a specified address to selected recipients with an optional comment using Microsoft Graph API. ### Endpoint - **URL:** `/v1.0/users/{{email_address}}/messages/{{email_id}}/forward` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------- | -------- | ------------ | --------------------------------------------- | | `path_parameters.email_address` | string | Required | The account associated with the email | | `path_parameters.email_id` | string | Required | The ID of the email | | `comment` | string | Optional | A comment to include. Can be an empty string. | | `toRecipients` | array | Optional | The list of direct recipient objects. | | `toRecipients.emailAddress` | object | Required | Parameter for Forward Email | | `toRecipients.emailAddress.address` | string | Required | Parameter for Forward Email | | `toRecipients.emailAddress.name` | string | Optional | Name of the resource | ### Input Example `{"path_parameters":{"email_address":"string","email_id":"string"},"comment":"string","toRecipients":[{"emailAddress":{"address":"string","name":"Example Name"}}]}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"response_text":"string"}` ## Get a User Retrieve a user account from Microsoft Graph API using the sign-in name to access detailed user information. ### Endpoint - **URL:** `/v1.0/users` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | ------------------------------- | | `parameters.$select` | string | Optional | Select results. | | `parameters.$filter` | string | Optional | Filters results (rows). | | `parameters.$count` | boolean | Optional | Include count of items. | | `parameters.$expand` | string | Optional | Expand related entities. | | `parameters.$orderby` | string | Optional | Order items by property values. | | `parameters.$search` | string | Optional | Search items by search phrases. | | `parameters.$top` | integer | Optional | Show only the first n items. | ### Input Example `{"parameters":{"$select":"string","$filter":"string","$count":true,"$expand":"string","$orderby":"string","$search":"string","$top":123}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `value` | array | Value for the parameter | | `value.businessPhones` | array | Value for the parameter | | `value.businessPhones.file_name` | string | Name of the resource | | `value.businessPhones.file` | string | Value for the parameter | | `value.displayName` | string | Name of the resource | | `value.givenName` | object | Name of the resource | | `value.jobTitle` | object | Value for the parameter | | `value.mail` | object | Value for the parameter | | `value.mobilePhone` | object | Value for the parameter | | `value.officeLocation` | object | Value for the parameter | | `value.preferredLanguage` | object | Value for the parameter | | `value.surname` | object | Name of the resource | | `value.userPrincipalName` | string | Name of the resource | | `value.id` | string | Unique identifier | ### Output Example `{"@odata.context":"string","value":[{"businessPhones":[],"displayName":"Example Name","givenName":{},"jobTitle":{},"mail":{},"mobilePhone":{},"officeLocation":{},"preferredLanguage":{},"surname":{},"userPrincipalName":"Example Name","id":"12345678-1234-1234-1234-123456789abc"}]}` ## Get Email Attachments Retrieve all attachments from a specific email by providing the email address and email ID using Microsoft Graph API. ### Endpoint - **URL:** `/v1.0/users/{{email_address}}/messages/{{email_id}}/attachments` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ------------------------------------------------------------------------- | | `path_parameters.email_address` | string | Required | The account associated with the email | | `path_parameters.email_id` | string | Required | The ID of the email to retrieve attachments from | | `parameters.$expand` | string | Optional | To get the properties of an item attachment (contact, event, or message). | | `remove_content_bytes` | boolean | Optional | The account associated with the email | ### Input Example `{"parameters":{"$expand":"microsoft.graph.itemattachment/item"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `attachments` | array | Output field: attachments | | `attachments.0` | object | Output field: attachments.0 | | `attachments.0.file_name` | string | Name of the resource | | `attachments.0.file` | string | Output field: attachments.0.file | | `@odata.context` | string | Response data | | `value` | array | Value for the parameter | | `value.@odata.type` | string | Response data | | `value.@odata.mediaContentType` | string | Response data | | `value.id` | string | Unique identifier | | `value.lastModifiedDateTime` | string | Value for the parameter | | `value.name` | string | Name of the resource | | `value.contentType` | string | Type of the resource | | `value.size` | number | Value for the parameter | | `value.isInline` | boolean | Value for the parameter | | `value.contentId` | object | Unique identifier | | `value.contentLocation` | object | Value for the parameter | ### Output Example `{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#users('integrations%40swimlaneintegra...","value":[{"@odata.type":"#microsoft.graph.fileAttachment","@odata.mediaContentType":"image/png","id":"AAMkADMxZmU3ZWQ4LTMzNGItNGY3ZC1iM2UxLWM3MDQzOGVjMzlkNwBGAAAAAAAHYPwuVwMWSrFeyLv6...","lastModifiedDateTime":"2022-05-11T04:55:25Z","name":"test_file.png","contentType":"image/png","size":1569,"isInline":false,"contentId":null,"contentLocation":null}]}` ## Get Emails Fetch a list of emails from a specified email address using Microsoft Graph API by providing the email address as a path parameter. ### Endpoint - **URL:** `/v1.0/users/{{email_address}}/messages` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.email_address` | string | Required | The account associated with the email | | `parameters.count` | string | Optional | Include a count of the total number of items in a collection alongside the page of data values returned from Microsoft Graph | | `parameters.filter` | string | Optional | Use the $filter query parameter to retrieve just a subset of a collection. For guidance on using $filter, see [https://learn.microsoft.com/en-us/graph/filter-query-parameter](https://learn.microsoft.com/en-us/graph/filter-query-parameter) | | `parameters.orderby` | string | Optional | To sort the results in ascending or descending order, append either asc or desc to the field name, separated by a space. | | `parameters.top` | number | Optional | Sets the page size of results | | `headers` | object | Optional | HTTP headers for the request | | `headers.Prefer` | string | Optional | The format of the body and uniqueBody properties to be returned in. Values can be "text" or "html". A Preference-Applied header is returned as confirmation if this Prefer header is specified. If the header is not specified, the body and uniqueBody properties are returned in HTML format. | ### Input Example `{"headers":{"Prefer":"outlook.body-content-type='text'"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `@odata.count` | number | Response data | | `value` | array | Value for the parameter | | `value.@odata.etag` | string | Response data | | `value.id` | string | Unique identifier | | `value.createdDateTime` | string | Value for the parameter | | `value.lastModifiedDateTime` | string | Value for the parameter | | `value.changeKey` | string | Value for the parameter | | `value.categories` | array | Value for the parameter | | `value.categories.file_name` | string | Name of the resource | | `value.categories.file` | string | Value for the parameter | | `value.receivedDateTime` | string | Value for the parameter | | `value.sentDateTime` | string | Value for the parameter | | `value.hasAttachments` | boolean | Value for the parameter | | `value.internetMessageId` | string | Unique identifier | | `value.subject` | string | Value for the parameter | | `value.bodyPreview` | string | Request body data | | `value.importance` | string | Value for the parameter | | `value.parentFolderId` | string | Unique identifier | | `value.conversationId` | string | Unique identifier | | `value.conversationIndex` | string | Value for the parameter | | `value.isDeliveryReceiptRequested` | object | Value for the parameter | | `value.isReadReceiptRequested` | boolean | Value for the parameter | ### Output Example `{"@odata.context":"string","@odata.count":123,"value":[{"@odata.etag":"string","id":"12345678-1234-1234-1234-123456789abc","createdDateTime":"string","lastModifiedDateTime":"string","changeKey":"string","categories":[],"receivedDateTime":"string","sentDateTime":"string","hasAttachments":true,"internetMessageId":"string","subject":"string","bodyPreview":"string","importance":"string","parentFolderId":"string","conversationId":"string"}],"@odata.nextLink":"string"}` ## Get Emails from a Folder Fetch emails from a specified folder in a user's mailbox using the provided email address and folder ID via Microsoft Graph API. ### Endpoint - **URL:** `/v1.0/users/{{email_address}}/mailFolders/{{folder_id}}/messages` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.email_address` | string | Required | The account associated with the email | | `path_parameters.folder_id` | string | Required | The Folder to get emails from | | `parameters.count` | string | Optional | Include a count of the total number of items in a collection alongside the page of data values returned from Microsoft Graph | | `parameters.filter` | string | Optional | Use the $filter query parameter to retrieve just a subset of a collection. For guidance on using $filter, see [https://learn.microsoft.com/en-us/graph/filter-query-parameter](https://learn.microsoft.com/en-us/graph/filter-query-parameter) | | `parameters.orderby` | string | Optional | To sort the results in ascending or descending order, append either asc or desc to the field name, separated by a space. | | `parameters.top` | number | Optional | Sets the page size of results | | `headers` | object | Optional | HTTP headers for the request | | `headers.Prefer` | string | Optional | The format of the body and uniqueBody properties to be returned in. Values can be "text" or "html". A Preference-Applied header is returned as confirmation if this Prefer header is specified. If the header is not specified, the body and uniqueBody properties are returned in HTML format. | ### Input Example `{"headers":{"Prefer":"outlook.body-content-type='text'"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `@odata.count` | number | Response data | | `value` | array | Value for the parameter | | `value.@odata.etag` | string | Response data | | `value.id` | string | Unique identifier | | `value.createdDateTime` | string | Value for the parameter | | `value.lastModifiedDateTime` | string | Value for the parameter | | `value.changeKey` | string | Value for the parameter | | `value.categories` | array | Value for the parameter | | `value.categories.file_name` | string | Name of the resource | | `value.categories.file` | string | Value for the parameter | | `value.receivedDateTime` | string | Value for the parameter | | `value.sentDateTime` | string | Value for the parameter | | `value.hasAttachments` | boolean | Value for the parameter | | `value.internetMessageId` | string | Unique identifier | | `value.subject` | string | Value for the parameter | | `value.bodyPreview` | string | Request body data | | `value.importance` | string | Value for the parameter | | `value.parentFolderId` | string | Unique identifier | | `value.conversationId` | string | Unique identifier | | `value.conversationIndex` | string | Value for the parameter | | `value.isDeliveryReceiptRequested` | object | Value for the parameter | | `value.isReadReceiptRequested` | boolean | Value for the parameter | ### Output Example `{"@odata.context":"string","@odata.count":123,"value":[{"@odata.etag":"string","id":"12345678-1234-1234-1234-123456789abc","createdDateTime":"string","lastModifiedDateTime":"string","changeKey":"string","categories":[],"receivedDateTime":"string","sentDateTime":"string","hasAttachments":true,"internetMessageId":"string","subject":"string","bodyPreview":"string","importance":"string","parentFolderId":"string","conversationId":"string"}],"@odata.nextLink":"string"}` ## Get Emails From Folder Fetch emails from a specified folder in a user's Microsoft Graph API account using the provided email address and folder ID. ### Endpoint - **URL:** `/v1.0/users/{{email_address}}/mailFolders/{{folder_id}}/messages` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.email_address` | string | Required | The account associated with the email | | `path_parameters.folder_id` | string | Required | The folder ID, or a well-known folder name. For a list of supported well-known folder names, see [https://learn.microsoft.com/en-us/graph/api/resources/mailfolder?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/resources/mailfolder?view=graph-rest-1.0) | | `parameters.count` | string | Optional | Include a count of the total number of items in a collection alongside the page of data values returned from Microsoft Graph | | `parameters.filter` | string | Optional | Use the $filter query parameter to retrieve just a subset of a collection. For guidance on using $filter, see [https://learn.microsoft.com/en-us/graph/filter-query-parameter](https://learn.microsoft.com/en-us/graph/filter-query-parameter) | | `parameters.orderby` | string | Optional | To sort the results in ascending or descending order, append either asc or desc to the field name, separated by a space. | | `parameters.top` | number | Optional | Sets the page size of results | ### Input Example `{"path_parameters":{"email_address":"string","folder_id":"string"},"parameters":{"count":"false","filter":"string","orderby":"string","top":123}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `@odata.count` | number | Response data | | `value` | array | Value for the parameter | | `value.@odata.etag` | string | Response data | | `value.id` | string | Unique identifier | | `value.createdDateTime` | string | Value for the parameter | | `value.lastModifiedDateTime` | string | Value for the parameter | | `value.changeKey` | string | Value for the parameter | | `value.categories` | array | Value for the parameter | | `value.categories.file_name` | string | Name of the resource | | `value.categories.file` | string | Value for the parameter | | `value.receivedDateTime` | string | Value for the parameter | | `value.sentDateTime` | string | Value for the parameter | | `value.hasAttachments` | boolean | Value for the parameter | | `value.internetMessageId` | string | Unique identifier | | `value.subject` | string | Value for the parameter | | `value.bodyPreview` | string | Request body data | | `value.importance` | string | Value for the parameter | | `value.parentFolderId` | string | Unique identifier | | `value.conversationId` | string | Unique identifier | | `value.conversationIndex` | string | Value for the parameter | | `value.isDeliveryReceiptRequested` | boolean | Value for the parameter | | `value.isReadReceiptRequested` | boolean | Value for the parameter | ### Output Example `{"@odata.context":"string","@odata.count":123,"value":[{"@odata.etag":"string","id":"12345678-1234-1234-1234-123456789abc","createdDateTime":"string","lastModifiedDateTime":"string","changeKey":"string","categories":[],"receivedDateTime":"string","sentDateTime":"string","hasAttachments":true,"internetMessageId":"string","subject":"string","bodyPreview":"string","importance":"string","parentFolderId":"string","conversationId":"string"}],"@odata.nextLink":"string"}` ## Get Folders Retrieve all email folders for a specified email address to enable organized access and management of mailbox folder data using Microsoft Graph API. ### Endpoint - **URL:** `v1.0/users/{{email_address}}/mailFolders` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------- | -------- | ------------ | ------------------------------------- | | `path_parameters.email_address` | string | Required | The account associated with the email | | `parameters.include_hidden_folders` | boolean | Optional | Include hidden folders in the results | ### Input Example `{"path_parameters":{"email_address":"string"},"parameters":{"include_hidden_folders":true}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `value` | array | Value for the parameter | | `value.id` | string | Unique identifier | | `value.displayName` | string | Name of the resource | | `value.parentFolderId` | string | Unique identifier | | `value.childFolderCount` | number | Value for the parameter | | `value.unreadItemCount` | number | Value for the parameter | | `value.totalItemCount` | number | Value for the parameter | | `value.sizeInBytes` | number | Value for the parameter | | `value.isHidden` | boolean | Unique identifier | | `@odata.nextLink` | string | Response data | ### Output Example `{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#users('integrations%40swimlaneintegra...","value":[{"id":"AQMkADMxZmU3ZWQ4LTMzADRiLTRmN2QtYjNlMS1jNzA0MzhlYzM5ZDcALgAAAwdg-C5XAxZKsV7Iu-pcczMBAIElFP3_iINMukuDjlG8_QIAAAIBOwAAAA==","displayName":"Archive","parentFolderId":"AQMkADMxZmU3ZWQ4LTMzADRiLTRmN2QtYjNlMS1jNzA0MzhlYzM5ZDcALgAAAwdg-C5XAxZKsV7Iu-pcczMBAIElFP3_iINMukuDjlG8_QIAAAIBCAAAAA==","childFolderCount":0,"unreadItemCount":1,"totalItemCount":7,"sizeInBytes":777420,"isHidden":fa...` ## Get Group Fetch the properties and relationships of a Microsoft Graph group using its ID, unique name, or exact display name. ### Endpoint - **URL:** `/v1.0/groups/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.id` | string | Required | The group ID, uniqueName alternate key, or exact display name used to look up the group. Display name lookup fails if zero or multiple groups match. | | `parameters.$select` | string | Optional | Comma-separated list of properties to return. | | `parameters.$expand` | string | Optional | Comma-separated list of relationships to include. | ### Input Example `{"parameters":{"$select":"id,displayName,description,mail"},"path_parameters":{"id":"f0b2d6f5-097d-4177-91af-a24e530b53cc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | ------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `id` | string | Unique identifier | | `displayName` | string | Name of the resource | | `description` | string | Output field: description | | `mail` | string | Output field: mail | | `mailEnabled` | boolean | Output field: mailEnabled | | `mailNickname` | string | Name of the resource | | `securityEnabled` | boolean | Output field: securityEnabled | | `securityIdentifier` | string | Unique identifier | | `visibility` | string | Output field: visibility | | `groupTypes` | array | Type of the resource | | `proxyAddresses` | array | Output field: proxyAddresses | | `membershipRule` | string | Output field: membershipRule | | `membershipRuleProcessingState` | string | Output field: membershipRuleProcessingState | | `createdDateTime` | string | Time value | | `renewedDateTime` | string | Time value | ### Output Example `{"@odata.context":"string","id":"12345678-1234-1234-1234-123456789abc","displayName":"Example Name","description":"string","mail":"string","mailEnabled":true,"mailNickname":"Example Name","securityEnabled":true,"securityIdentifier":"string","visibility":"string","groupTypes":["string"],"proxyAddresses":["string"],"membershipRule":"string","membershipRuleProcessingState":"string","createdDateTime":"string"}` ## Get List of Child Folders Retrieve all child folders within a specified parent folder using the provided email address and folder ID from Microsoft Graph API. ### Endpoint - **URL:** `/v1.0/users/{{email_address}}/mailFolders/{{folder_id}}/childFolders` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------- | -------- | ------------ | ------------------------------------------------ | | `path_parameters.email_address` | string | Required | The account associated with the email. | | `path_parameters.folder_id` | string | Required | The mailFolder's unique identifier. | | `parameters.includeHiddenFolders` | boolean | Optional | To include hidden child folders in the response. | ### Input Example `{"parameters":{"includeHiddenFolders":true},"path_parameters":{"email_address":"saikumarbadri845@gmail.com","folder_id":"AQMkADAwATNiZmYAZC1jODNkLTI5MjUtMDACLTAwCgAuAAAD4NNqHYKaBkOb7N4GZr"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `value` | array | Value for the parameter | | `value.id` | string | Unique identifier | | `value.displayName` | string | Name of the resource | | `value.parentFolderId` | string | Unique identifier | | `value.childFolderCount` | number | Value for the parameter | | `value.unreadItemCount` | number | Value for the parameter | | `value.totalItemCount` | number | Value for the parameter | | `value.sizeInBytes` | number | Value for the parameter | | `value.isHidden` | boolean | Unique identifier | ### Output Example `{"@odata.context":"string","value":[{"id":"12345678-1234-1234-1234-123456789abc","displayName":"Example Name","parentFolderId":"string","childFolderCount":123,"unreadItemCount":123,"totalItemCount":123,"sizeInBytes":123,"isHidden":true}]}` ## Get Manager Root Level Retrieve the root-level details of a user's direct manager in Microsoft Graph API using the user's ID or userPrincipalName. ### Endpoint - **URL:** `v1.0/users/{{id|userPrincipalName}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | | -------------------------- | ------------------- | ------------ | ------------------------------------------------------------------------------------------ | ---------------------------------- | | \`path\_parameters.id | userPrincipalName\` | string | Required | The user's ID or UserPrincipalName | | `headers` | object | Optional | HTTP headers for the request | | | `headers.ConsistencyLevel` | string | Optional | Required when the request includes the $levels=n in the $expand query parameter. | | | `parameters.$levels` | string | Optional | The n value of $levels can be max (to return all managers) or a number between 1 and 1000. | | | `parameters.$select` | string | Optional | To select the individual Manager's properties. | | | `parameters.$expand` | string | Optional | To retrieve the Manager's Information for specified Levels, Selected ID and DisplayName. | | ### Input Example `{"parameters":{"$levels":"max","$select":"id","$expand":"manager($levels=max;$select=id,displayName)"},"path_parameters":{"id|userPrincipalName":"357b1656-cfad-4b3f-a4c4-4a03bdcd6468"},"headers":{"ConsistencyLevel":"eventual"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------- | -------- | --------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `businessPhones` | array | Output field: businessPhones | | `businessPhones.file_name` | string | Name of the resource | | `businessPhones.file` | string | Output field: businessPhones.file | | `displayName` | string | Name of the resource | | `givenName` | object | Name of the resource | | `jobTitle` | object | Output field: jobTitle | | `mail` | string | Output field: mail | | `mobilePhone` | object | Output field: mobilePhone | | `officeLocation` | object | Output field: officeLocation | | `preferredLanguage` | object | Output field: preferredLanguage | | `surname` | object | Name of the resource | | `userPrincipalName` | string | Name of the resource | | `id` | string | Unique identifier | ### Output Example `{"@odata.context":"string","businessPhones":[{"file_name":"Example Name","file":"string"}],"displayName":"Example Name","givenName":{},"jobTitle":{},"mail":"string","mobilePhone":{},"officeLocation":{},"preferredLanguage":{},"surname":{},"userPrincipalName":"Example Name","id":"12345678-1234-1234-1234-123456789abc"}` ## Get Presence Retrieve the current presence status of a user from Microsoft Graph API using their unique ID as a path parameter. ### Endpoint - **URL:** `/users/{{id}}/presence` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ---------------------------------- | | `path_parameters.id` | string | Required | The unique identifier of the user. | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | ----------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `availability` | string | Output field: availability | | `activity` | string | Output field: activity | | `outOfOfficeSettings` | object | Output field: outOfOfficeSettings | | `outOfOfficeSettings.message` | object | Response message | | `outOfOfficeSettings.isOutOfOffice` | boolean | Output field: outOfOfficeSettings.isOutOfOffice | | `sequenceNumber` | string | Output field: sequenceNumber | ### Output Example `{"id":"66825e03-7ef5-42da-9069-724602c31f6b","availability":"DoNotDisturb","activity":"Presenting","outOfOfficeSettings":{"message":null,"isOutOfOffice":false},"sequenceNumber":"A0129311063"}` ## Get User by ID Retrieve detailed information for a specific user in Microsoft Graph API using the user's unique ID as a path parameter. ### Endpoint - **URL:** `v1.0/users/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ---------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Get User by ID action | | `parameters.$select` | string | Optional | Parameters for the Get User by ID action | ### Input Example `{"parameters":{"$select":"displayName,givenName,postalCode"},"path_parameters":{"id":"87d349ed-44d7-43e1-9a83-5f2406dee5bd"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `businessPhones` | array | Output field: businessPhones | | `displayName` | string | Name of the resource | | `givenName` | string | Name of the resource | | `jobTitle` | string | Output field: jobTitle | | `mail` | string | Output field: mail | | `mobilePhone` | string | Output field: mobilePhone | | `officeLocation` | string | Output field: officeLocation | | `preferredLanguage` | string | Output field: preferredLanguage | | `surname` | string | Name of the resource | | `userPrincipalName` | string | Name of the resource | | `id` | string | Unique identifier | ### Output Example `{"businessPhones":["string"],"displayName":"Example Name","givenName":"Example Name","jobTitle":"string","mail":"string","mobilePhone":"string","officeLocation":"string","preferredLanguage":"string","surname":"Example Name","userPrincipalName":"Example Name","id":"12345678-1234-1234-1234-123456789abc"}` ## List a Users Direct Membership Retrieve direct group memberships, directory roles, and administrative units for a user in Microsoft Graph API using their email address. ### Endpoint - **URL:** `/v1.0/users/{{email_address}}/memberOf` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | -------------------------------------- | | `path_parameters.email_address` | string | Required | The account associated with the email. | | `parameters.$filter` | string | Optional | Filters results (rows). | | `parameters.$count` | string | Optional | Include count of items. | | `parameters.$search` | string | Optional | Search items by search phrases. | ### Input Example `{"parameters":{"$search":"search","$count":"count","$filter":"filter"},"path_parameters":{"email_address":"integrations@swimlaneintegrations.onmicrosoft.com"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `value` | array | Value for the parameter | | `value.@odata.type` | string | Response data | | `value.id` | string | Unique identifier | | `value.deletedDateTime` | object | Value for the parameter | | `value.description` | string | Value for the parameter | | `value.displayName` | string | Name of the resource | | `value.roleTemplateId` | string | Unique identifier | | `value.isMemberManagementRestricted` | boolean | Value for the parameter | | `value.membershipRule` | object | Value for the parameter | | `value.membershipType` | object | Type of the resource | | `value.membershipRuleProcessingState` | object | Value for the parameter | | `value.visibility` | object | Value for the parameter | ### Output Example `{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#directoryObjects","value":[{"@odata.type":"#microsoft.graph.directoryRole","id":"4c04548e-9bc4-45fb-8738-168610ddbe0c","deletedDateTime":null,"description":"Can manage all aspects of Azure AD and Microsoft services that use Azure AD identities.","displayName":"Global Administrator","roleTemplateId":"62e90394-69f5-4237-9190-012177145e10"},{"@odata.type":"#microsoft.graph.directoryRole","id":"417c2fd9-6d31-4d37-927f-a6e54d37a4a4","delet...` ## List Analyzed Emails Retrieve a comprehensive list of analyzed email objects and their properties from Microsoft Graph API. ### Endpoint - **URL:** `/beta/security/collaboration/analyzedEmails` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.$count` | boolean | Optional | Retrieves the total count of matching resources. | | `parameters.$filter` | string | Optional | Use the `filter` query parameter to retrieve just a subset of a collection. For guidance on using `filter`, see [https://learn.microsoft.com/en-us/graph/filter-query-parameter](https://learn.microsoft.com/en-us/graph/filter-query-parameter). | | `parameters.$top` | number | Optional | Sets the page size of results. | | `parameters.$skiptoken` | string | Optional | Retrieves the next page of results from result sets that span multiple pages. (Some APIs use $skip instead.) | | `parameters.startTime` | string | Optional | The start time of the email search. | | `parameters.endTime` | string | Optional | The end time of the email search. | ### Input Example `{"parameters":{"$count":true,"$filter":"startswith(givenName, 'J')","$top":10,"$skiptoken":"X%274453707402000100000017"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `value` | array | Value for the parameter | | `value.@odata.type` | string | Response data | | `value.id` | string | Unique identifier | | `value.loggedDateTime` | string | Value for the parameter | | `value.networkMessageId` | string | Unique identifier | | `value.internetMessageId` | string | Unique identifier | | `value.senderDetail` | object | Value for the parameter | | `value.senderDetail.@odata.type` | string | Response data | | `value.recipientEmailAddress` | string | Value for the parameter | | `value.distributionList` | string | Value for the parameter | | `value.subject` | string | Value for the parameter | | `value.returnPath` | string | Value for the parameter | | `value.directionality` | string | Value for the parameter | | `value.originalDelivery` | object | Value for the parameter | | `value.originalDelivery.@odata.type` | string | Response data | | `value.latestDelivery` | object | Value for the parameter | | `value.latestDelivery.@odata.type` | string | Response data | | `value.attachmentsCount` | string | Value for the parameter | | `value.urlsCount` | string | URL endpoint for the request | | `value.language` | string | Value for the parameter | | `value.sizeInBytes` | string | Value for the parameter | | `value.alertIds` | array | Unique identifier | | `value.exchangeTransportRules` | array | Value for the parameter | ### Output Example `{"value":[{"@odata.type":"string","id":"12345678-1234-1234-1234-123456789abc","loggedDateTime":"string","networkMessageId":"string","internetMessageId":"string","senderDetail":{},"recipientEmailAddress":"string","distributionList":"string","subject":"string","returnPath":"string","directionality":"string","originalDelivery":{},"latestDelivery":{},"attachmentsCount":"string","urlsCount":"string"}]}` ## List Group Members Retrieve the direct members of a specified group in Microsoft Graph by providing the group ID. ### Endpoint - **URL:** `/v1.0/groups/{{group-id}}/members` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ---------------------------------------------------------------- | | `path_parameters.group-id` | string | Required | The unique identifier of the group whose members will be listed. | | `parameters.$top` | number | Optional | Sets the page size of results. | | `parameters.$skiptoken` | string | Optional | Retrieves the next page of results from a paginated response. | | `parameters.$select` | string | Optional | Comma-separated list of member properties to return. | ### Input Example `{"parameters":{"$top":100,"$select":"id,displayName,userPrincipalName"},"path_parameters":{"group-id":"f0b2d6f5-097d-4177-91af-a24e530b53cc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `@odata.nextLink` | string | Response data | | `value` | array | Value for the parameter | | `value.@odata.type` | string | Response data | | `value.id` | string | Unique identifier | | `value.displayName` | string | Name of the resource | | `value.userPrincipalName` | string | Name of the resource | | `value.mail` | string | Value for the parameter | | `value.mailEnabled` | boolean | Value for the parameter | | `value.securityEnabled` | boolean | Value for the parameter | | `value.appId` | string | Unique identifier | ### Output Example `{"@odata.context":"string","@odata.nextLink":"string","value":[{"@odata.type":"string","id":"12345678-1234-1234-1234-123456789abc","displayName":"Example Name","userPrincipalName":"Example Name","mail":"string","mailEnabled":true,"securityEnabled":true,"appId":"string"}]}` ## List Risk Detections Retrieve Microsoft Entra ID Protection risk detection events with details such as event type, affected user, IP address, location, and timestamps for enhanced security analysis. ### Endpoint - **URL:** `/v1.0/identityProtection/riskDetections` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------- | | `parameters.$filter` | string | Optional | OData filter for detections, such as a user ID, user principal name, risk event type, risk level, or detection timestamp. | | `parameters.$select` | string | Optional | Comma-separated detection properties to return. | | `parameters.$top` | number | Optional | Number of detections to return per page, from 1 through 500. | ### Input Example `{"parameters":{"$filter":"string","$select":"string","$top":123}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------- | -------- | ------------------------------------------------------------------------------------------------------- | | `status_code` | number | HTTP status code returned by Microsoft Graph. | | `reason` | string | HTTP reason phrase returned by Microsoft Graph. | | `@odata.context` | string | Response data | | `@odata.nextLink` | string | URL for the next page when more detections are available. | | `value` | array | Individual Microsoft Entra ID Protection risk detections. | | `value.id` | string | Unique identifier | | `value.requestId` | string | Unique identifier | | `value.correlationId` | string | Unique identifier | | `value.riskEventType` | string | Detection type, such as impossibleTravel, unfamiliarFeatures, leakedCredentials, or maliciousIPAddress. | | `value.riskState` | string | Value for the parameter | | `value.riskLevel` | string | Value for the parameter | | `value.riskDetail` | string | Value for the parameter | | `value.source` | string | Value for the parameter | | `value.detectionTimingType` | string | Type of the resource | | `value.activity` | string | Value for the parameter | | `value.tokenIssuerType` | string | Type of the resource | | `value.ipAddress` | string | Value for the parameter | | `value.location` | object | Value for the parameter | | `value.location.city` | string | Value for the parameter | | `value.location.state` | string | Value for the parameter | | `value.location.countryOrRegion` | string | Value for the parameter | | `value.location.geoCoordinates` | object | Value for the parameter | | `value.location.geoCoordinates.latitude` | number | Value for the parameter | | `value.location.geoCoordinates.longitude` | number | Value for the parameter | | `value.location.geoCoordinates.altitude` | number | Value for the parameter | ### Output Example `{"@odata.context":"string","@odata.nextLink":"string","value":[{"id":"12345678-1234-1234-1234-123456789abc","requestId":"string","correlationId":"string","riskEventType":"string","riskState":"string","riskLevel":"string","riskDetail":"string","source":"string","detectionTimingType":"string","activity":"string","tokenIssuerType":"string","ipAddress":"string","location":{},"activityDateTime":"string","detectedDateTime":"string"}]}` ## List riskyUsers Retrieve a list of riskyUser objects from Microsoft Graph API to identify potential security risks without requiring additional inputs. ### Endpoint - **URL:** `/v1.0/identityProtection/riskyUsers` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ----------------------------------------------------------------------------- | | `parameters.$filter` | string | Optional | Filters results (rows). | | `parameters.$select` | string | Optional | Filters properties (columns). | | `parameters.$top` | number | Optional | Sets the page size of results. The maximum page size with top is 500 objects. | ### Input Example `{"parameters":{"$filter":"riskLevel eq 'high' ","$select":"givenName,surname","$top":10}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `value` | array | Value for the parameter | | `value.@odata.type` | string | Response data | | `value.id` | string | Unique identifier | | `value.isDeleted` | boolean | Value for the parameter | | `value.isProcessing` | boolean | Value for the parameter | | `value.riskLastUpdatedDateTime` | string | Value for the parameter | | `value.riskLevel` | string | Value for the parameter | | `value.riskState` | string | Value for the parameter | | `value.riskDetail` | string | Value for the parameter | | `value.userDisplayName` | string | Name of the resource | | `value.userPrincipalName` | string | Name of the resource | ### Output Example `{"value":[{"@odata.type":"#microsoft.graph.riskyUser","id":"d1d4a5d4-a5d4-d1d4-d4a5-d4d1d4a5d4d1","isDeleted":true,"isProcessing":true,"riskLastUpdatedDateTime":"2025-06-05T05:18:27Z","riskLevel":"High","riskState":"Active","riskDetail":"Suspicious activity detected","userDisplayName":"John Doe","userPrincipalName":"johndoe@example.com"}]}` ## List Password Methods Retrieve all registered password authentication methods for a user in Microsoft Graph API by specifying the user's ID. ### Endpoint - **URL:** `/v1.0/users/{{id}}/authentication/passwordMethods` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------- | | `path_parameters.id` | string | Required | User ID | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `value` | array | Value for the parameter | | `value.id` | string | Unique identifier | | `value.password` | object | Value for the parameter | | `value.creationDateTime` | object | Value for the parameter | | `value.createdDateTime` | object | Value for the parameter | ### Output Example `{"@odata.context":"string","value":[{"id":"12345678-1234-1234-1234-123456789abc","password":{},"creationDateTime":{},"createdDateTime":{}}]}` ## Reset Password Initiate a password reset for a specified user by providing their ID and authentication method ID using the Microsoft Graph API. ### Endpoint - **URL:** `/v1.0/users/{{id}}/authentication/methods/{{methodId}}/resetPassword` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `path_parameters.id` | string | Required | User ID | | `path_parameters.methodId` | string | Required | Password Method ID | | `newPassword` | string | Optional | The new password. Required for tenants with hybrid password scenarios. If omitted for a cloud-only password, the system returns a system-generated password. | | `include_uppercase` | boolean | Optional | Include Atleast One Uppercase Letter. | | `include_lowercase` | boolean | Optional | Include Atleast One Lowercase Letter. | | `include_digit` | boolean | Optional | Include Atleast One One Digit. | | `include_special` | boolean | Optional | Include Atleast One Special Character. | | `length` | number | Optional | Password length with minimum 20. | | `auto_generate` | boolean | Optional | Auto Generate Random password. | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc","methodId":"string"},"newPassword":"string","include_uppercase":true,"include_lowercase":true,"include_digit":true,"include_special":true,"length":20,"auto_generate":true}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `newPassword` | string | Output field: newPassword | ### Output Example `{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#microsoft.graph.passwordResetResponse","newPassword":"Cuyo5459"}` ## Get Identity Directory Device Registered User List Retrieve a list of users registered to a specific device in Microsoft Graph API by providing the device's unique ID. ### Endpoint - **URL:** `/v1.0/devices/{{id}}/registeredUsers` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `path_parameters.id` | string | Required | Device ID | | `parameters.filter` | string | Optional | Use the `filter` query parameter to retrieve just a subset of a collection. For guidance on using `filter`, see [https://learn.microsoft.com/en-us/graph/filter-query-parameter](https://learn.microsoft.com/en-us/graph/filter-query-parameter) | | `parameters.orderBy` | string | Optional | Use the `orderby` query parameter to specify the sort order of the items returned from Microsoft Graph. | | `parameters.top` | number | Optional | Sets the page size of results. | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"parameters":{"filter":"string","orderBy":"string","top":123}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `value` | array | Value for the parameter | | `value.@odata.type` | string | Response data | | `value.id` | string | Unique identifier | | `value.businessPhones` | array | Value for the parameter | | `value.displayName` | string | Name of the resource | | `value.givenName` | string | Name of the resource | | `value.jobTitle` | object | Value for the parameter | | `value.mail` | object | Value for the parameter | | `value.mobilePhone` | object | Value for the parameter | | `value.officeLocation` | object | Value for the parameter | | `value.preferredLanguage` | string | Value for the parameter | | `value.surname` | string | Name of the resource | | `value.userPrincipalName` | string | Name of the resource | ### Output Example `{"@odata.context":"string","value":[{"@odata.type":"string","id":"12345678-1234-1234-1234-123456789abc","businessPhones":[],"displayName":"Example Name","givenName":"Example Name","jobTitle":{},"mail":{},"mobilePhone":{},"officeLocation":{},"preferredLanguage":"string","surname":"Example Name","userPrincipalName":"Example Name"}]}` ## Get Identity Directory Objects by IDs List Retrieve specific users or groups from Microsoft Graph API by providing their IDs and types for precise directory data access. ### Endpoint - **URL:** `/v1.0/directoryObjects/getByIds` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------- | | `ids` | array | Optional | A collection of IDs for which to return objects. The IDs are GUIDs, represented as strings. You can specify up to 1000 IDs | | `types` | array | Optional | A collection of resource types that specifies the set of resource collections to search, for example `user`, `group`, and device objects | ### Input Example `{"ids":["string"],"types":["string"]}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `value` | array | Value for the parameter | | `value.@odata.type` | string | Response data | | `value.id` | string | Unique identifier | | `value.deletedDateTime` | object | Value for the parameter | | `value.classification` | object | Value for the parameter | | `value.createdDateTime` | string | Value for the parameter | | `value.creationOptions` | array | Value for the parameter | | `value.description` | string | Value for the parameter | | `value.displayName` | string | Name of the resource | | `value.expirationDateTime` | object | Value for the parameter | | `value.groupTypes` | array | Type of the resource | | `value.isAssignableToRole` | object | Value for the parameter | | `value.mail` | string | Value for the parameter | | `value.mailEnabled` | boolean | Value for the parameter | | `value.mailNickname` | string | Name of the resource | | `value.membershipRule` | object | Value for the parameter | | `value.membershipRuleProcessingState` | object | Value for the parameter | | `value.onPremisesDomainName` | object | Name of the resource | | `value.onPremisesLastSyncDateTime` | object | Value for the parameter | | `value.onPremisesNetBiosName` | object | Name of the resource | | `value.onPremisesSamAccountName` | object | Name of the resource | | `value.onPremisesSecurityIdentifier` | object | Unique identifier | ### Output Example `{"@odata.context":"string","value":[{"@odata.type":"string","id":"12345678-1234-1234-1234-123456789abc","deletedDateTime":{},"classification":{},"createdDateTime":"string","creationOptions":[],"description":"string","displayName":"Example Name","expirationDateTime":{},"groupTypes":[],"isAssignableToRole":{},"mail":"string","mailEnabled":true,"mailNickname":"Example Name","membershipRule":{}}]}` ## Delete Identity Directory Device Registered User Remove a registered user from a device in the Microsoft Graph API directory using the specified device ID and user ID. ### Endpoint - **URL:** `/v1.0/devices/{{id}}/registeredUsers/{{userId}}/$ref` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | --------------- | | `path_parameters.id` | string | Required | Device ID | | `path_parameters.userId` | string | Required | User ID | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc","userId":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `error` | object | Error message if any | | `error.code` | string | Error message if any | | `error.message` | string | Response message | | `error.innerError` | object | Error message if any | | `error.innerError.date` | string | Error message if any | | `error.innerError.request-id` | string | Unique identifier | | `error.innerError.client-request-id` | string | Unique identifier | ### Output Example `{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}` ## Delete Identity Directory Device Remove a specific device from the Microsoft Graph Identity Directory by providing its unique device ID as a path parameter. ### Endpoint - **URL:** `/v1.0/devices/{{id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------- | | `path_parameters.id` | string | Required | Device ID | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `error` | object | Error message if any | | `error.code` | string | Error message if any | | `error.message` | string | Response message | | `error.innerError` | object | Error message if any | | `error.innerError.date` | string | Error message if any | | `error.innerError.request-id` | string | Unique identifier | | `error.innerError.client-request-id` | string | Unique identifier | ### Output Example `{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}` ## Get Identity Directory Device Retrieve detailed information for a specific device in Microsoft Graph Identity Directory using the unique device ID. ### Endpoint - **URL:** `/v1.0/devices/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `parameters.filter` | string | Optional | Use the `filter` query parameter to retrieve just a subset of a collection. For guidance on using `filter`, see [https://learn.microsoft.com/en-us/graph/filter-query-parameter](https://learn.microsoft.com/en-us/graph/filter-query-parameter) | | `parameters.orderBy` | string | Optional | Use the `orderby` query parameter to specify the sort order of the items returned from Microsoft Graph. | | `parameters.top` | number | Optional | Sets the page size of results. | | `path_parameters.id` | string | Required | Device ID | ### Input Example `{"parameters":{"filter":"string","orderBy":"string","top":123},"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `id` | string | Unique identifier | | `deletedDateTime` | object | Time value | | `accountEnabled` | boolean | Output field: accountEnabled | | `approximateLastSignInDateTime` | string | Time value | | `complianceExpirationDateTime` | object | Time value | | `createdDateTime` | string | Time value | | `deviceCategory` | object | Output field: deviceCategory | | `deviceId` | string | Unique identifier | | `deviceMetadata` | object | Response data | | `deviceOwnership` | string | Output field: deviceOwnership | | `deviceVersion` | number | Output field: deviceVersion | | `displayName` | string | Name of the resource | | `domainName` | object | Name of the resource | | `enrollmentProfileName` | object | Name of the resource | | `enrollmentType` | string | Type of the resource | | `externalSourceName` | object | Name of the resource | | `isCompliant` | boolean | Output field: isCompliant | | `isManaged` | boolean | Output field: isManaged | | `isRooted` | boolean | Output field: isRooted | | `managementType` | string | Type of the resource | | `manufacturer` | string | Output field: manufacturer | | `mdmAppId` | string | Unique identifier | ### Output Example `{"@odata.context":"string","id":"12345678-1234-1234-1234-123456789abc","deletedDateTime":{},"accountEnabled":true,"approximateLastSignInDateTime":"string","complianceExpirationDateTime":{},"createdDateTime":"string","deviceCategory":{},"deviceId":"string","deviceMetadata":{},"deviceOwnership":"string","deviceVersion":123,"displayName":"Example Name","domainName":{},"enrollmentProfileName":{}}` ## Create Identity Directory Device Register a new device in Microsoft Graph by providing account status, display name, operating system, OS version, and device ID. ### Endpoint - **URL:** `/v1.0/devices` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------------ | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `accountEnabled` | boolean | Optional | true if the account is enabled; otherwise, false. Required. Default is true | | `alternativeSecurityIds` | array | Optional | Alternative Security IDs | | `alternativeSecurityIds.type` | number | Optional | Unique identifier | | `alternativeSecurityIds.identityProvider` | string | Optional | Unique identifier | | `alternativeSecurityIds.key` | string | Optional | Unique identifier | | `displayName` | string | Optional | The display name for the device | | `operatingSystem` | string | Optional | The type of operating system on the device | | `operatingSystemVersion` | string | Optional | The version of the operating system on the device | | `approximateLastSignInDateTime` | string | Optional | The timestamp type represents date and time information using ISO 8601 format and is always in UTC time | | `complianceExpirationDateTime` | string | Optional | The timestamp type represents date and time information using ISO 8601 format and is always in UTC time | | `deviceId` | string | Optional | Unique identifier | | `extensionAttributes` | object | Optional | Contains extension attributes 1-15 for the device. The individual extension attributes are not selectable. These properties are mastered in cloud and can be set during creation or update of a device object in Azure AD | | `extensionAttributes.extensionAttribute1` | string | Optional | Parameter for Create Identity Directory Device | | `extensionAttributes.extensionAttribute2` | string | Optional | Parameter for Create Identity Directory Device | | `extensionAttributes.extensionAttribute3` | string | Optional | Parameter for Create Identity Directory Device | | `extensionAttributes.extensionAttribute4` | string | Optional | Parameter for Create Identity Directory Device | | `extensionAttributes.extensionAttribute5` | string | Optional | Parameter for Create Identity Directory Device | | `extensionAttributes.extensionAttribute6` | string | Optional | Parameter for Create Identity Directory Device | | `extensionAttributes.extensionAttribute7` | string | Optional | Parameter for Create Identity Directory Device | | `extensionAttributes.extensionAttribute8` | string | Optional | Parameter for Create Identity Directory Device | | `extensionAttributes.extensionAttribute9` | string | Optional | Parameter for Create Identity Directory Device | | `extensionAttributes.extensionAttribute10` | string | Optional | Parameter for Create Identity Directory Device | | `extensionAttributes.extensionAttribute11` | string | Optional | Parameter for Create Identity Directory Device | | `extensionAttributes.extensionAttribute12` | string | Optional | Parameter for Create Identity Directory Device | | `extensionAttributes.extensionAttribute13` | string | Optional | Parameter for Create Identity Directory Device | ### Input Example `{"accountEnabled":true,"alternativeSecurityIds":[{"type":123,"identityProvider":"string","key":"string"}],"displayName":"Example Name","operatingSystem":"string","operatingSystemVersion":"string","approximateLastSignInDateTime":"string","complianceExpirationDateTime":"string","deviceId":"string","extensionAttributes":{"extensionAttribute1":"string","extensionAttribute2":"string","extensionAttribute3":"string","extensionAttribute4":"string","extensionAttribute5":"string","extensionAttribute6":"string","extensionAttribute7":"string","extensionAttribute8":"string","extensionAttribute9":"string","extensionAttribute10":"string","extensionAttribute11":"string","extensionAttribute12":"string","extensionAttribute13":"string","extensionAttribute14":"string","extensionAttribute15":"string"},"isCompliant":true,"isManaged":true,"onPremisesLastSyncDateTime":"string","onPremisesSyncEnabled":true,"profileType":"RegisteredDevice","systemLabels":["string"]}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `error` | object | Error message if any | | `error.code` | string | Error message if any | | `error.message` | string | Response message | | `error.innerError` | object | Error message if any | | `error.innerError.date` | string | Error message if any | | `error.innerError.request-id` | string | Unique identifier | | `error.innerError.client-request-id` | string | Unique identifier | ### Output Example `{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}` ## Add Identity Directory Device Reg User Register a new user to a directory device in Microsoft Graph API using the device ID and the user's @odata.id. ### Endpoint - **URL:** `/v1.0/devices/{{id}}/registeredUsers/$ref` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------ | | `path_parameters.id` | string | Required | Device ID | | `@odata.id` | string | Optional | Odata ID Type User | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"@odata.id":"string"}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `error` | object | Error message if any | | `error.code` | string | Error message if any | | `error.message` | string | Response message | | `error.innerError` | object | Error message if any | | `error.innerError.date` | string | Error message if any | | `error.innerError.request-id` | string | Unique identifier | | `error.innerError.client-request-id` | string | Unique identifier | ### Output Example `{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}` ## Get Identity Directory Device Groups List Retrieve all groups linked to a specific device by providing its directory ID using Microsoft Graph API. ### Endpoint - **URL:** `/v1.0/devices/{{id}}/memberOf` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `path_parameters.id` | string | Required | Device ID | | `parameters.filter` | string | Optional | Use the `filter` query parameter to retrieve just a subset of a collection. For guidance on using `filter`, see [https://learn.microsoft.com/en-us/graph/filter-query-parameter](https://learn.microsoft.com/en-us/graph/filter-query-parameter) | | `parameters.orderBy` | string | Optional | Use the `orderby` query parameter to specify the sort order of the items returned from Microsoft Graph. | | `parameters.top` | number | Optional | Sets the page size of results. | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"parameters":{"filter":"string","orderBy":"string","top":123}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `value` | array | Value for the parameter | | `value.file_name` | string | Name of the resource | | `value.file` | string | Value for the parameter | ### Output Example `{"@odata.context":"string","value":[{"file_name":"Example Name","file":"string"}]}` ## Get Identity Directory Device List Retrieve details of registered devices, including identifiers and display names, from the Microsoft Graph Identity Directory. ### Endpoint - **URL:** `/v1.0/devices` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `parameters.$filter` | string | Optional | Use the `filter` query parameter to retrieve just a subset of a collection. For guidance on using `filter`, see [https://learn.microsoft.com/en-us/graph/filter-query-parameter](https://learn.microsoft.com/en-us/graph/filter-query-parameter) | | `parameters.$orderBy` | string | Optional | Use the `orderby` query parameter to specify the sort order of the items returned from Microsoft Graph. | | `parameters.$top` | number | Optional | Sets the page size of results. | ### Input Example `{"parameters":{"$filter":"string","$orderBy":"string","$top":123}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `@odata.nextLink` | string | Response data | | `value` | array | Value for the parameter | | `value.id` | string | Unique identifier | | `value.deletedDateTime` | object | Value for the parameter | | `value.accountEnabled` | boolean | Value for the parameter | | `value.approximateLastSignInDateTime` | string | Value for the parameter | | `value.complianceExpirationDateTime` | object | Value for the parameter | | `value.createdDateTime` | string | Value for the parameter | | `value.deviceCategory` | object | Value for the parameter | | `value.deviceId` | string | Unique identifier | | `value.deviceMetadata` | object | Response data | | `value.deviceOwnership` | string | Value for the parameter | | `value.deviceVersion` | number | Value for the parameter | | `value.displayName` | string | Name of the resource | | `value.domainName` | object | Name of the resource | | `value.enrollmentProfileName` | object | Name of the resource | | `value.enrollmentType` | string | Type of the resource | | `value.externalSourceName` | object | Name of the resource | | `value.isCompliant` | boolean | Value for the parameter | | `value.isManaged` | boolean | Value for the parameter | | `value.isRooted` | boolean | Value for the parameter | | `value.managementType` | string | Type of the resource | ### Output Example `{"@odata.context":"string","@odata.nextLink":"string","value":[{"id":"12345678-1234-1234-1234-123456789abc","deletedDateTime":{},"accountEnabled":true,"approximateLastSignInDateTime":"string","complianceExpirationDateTime":{},"createdDateTime":"string","deviceCategory":{},"deviceId":"string","deviceMetadata":{},"deviceOwnership":"string","deviceVersion":123,"displayName":"Example Name","domainName":{},"enrollmentProfileName":{},"enrollmentType":"string"}]}` ## Create Identity Directory Role Member Add a new member to a directory role in Microsoft Graph API by providing the role's unique ID and the member's @odata.id. ### Endpoint - **URL:** `/v1.0/directoryRoles/{{id}}/members/$ref` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------ | | `path_parameters.id` | string | Required | Directory Role ID | | `@odata.id` | string | Optional | OData ID Type User | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"@odata.id":"string"}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"response_text":"string"}` ## Delete Identity Directory Role Assignment Remove a directory role assignment in Microsoft Graph API by specifying the unique role ID. ### Endpoint - **URL:** `/v1.0/roleManagement/directory/roleAssignments/{{id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------ | | `path_parameters.id` | string | Required | Role Assignment ID | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `error` | object | Error message if any | | `error.code` | string | Error message if any | | `error.message` | string | Response message | | `error.innerError` | object | Error message if any | | `error.innerError.date` | string | Error message if any | | `error.innerError.request-id` | string | Unique identifier | | `error.innerError.client-request-id` | string | Unique identifier | ### Output Example `{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}` ## Create Identity Directory Role Management Create a new directory role in Microsoft Graph API by specifying the display name, enabled status, and role permissions. ### Endpoint - **URL:** `/v1.0/roleManagement/directory/roleDefinitions` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `displayName` | string | Optional | The display name for the role definition | | `isEnabled` | boolean | Optional | Flag indicating if the role is enabled for assignment. If `false`, the role is not available for assignment | | `rolePermissions` | array | Optional | List of permissions included in the role | | `rolePermissions.allowedResourceActions` | array | Optional | Set of tasks that can be performed on a resource | | `rolePermissions.condition` | string | Optional | Optional constraints that must be met for the permission to be effective | | `rolePermissions.excludedResourceActions` | array | Optional | Set of tasks that may not be performed on a resource | | `description` | string | Optional | The description for the unifiedRoleDefinition | | `id` | string | Optional | The unique identifier for the role definition. Key, not nullable, Read-only. Inherited from entity | | `isBuiltIn` | boolean | Optional | Flag indicating whether the role definition is part of the default set included in Azure Active Directory (Azure AD) or a custom definition | | `resourceScopes` | array | Optional | List of the scopes or permissions the role definition applies to | | `templateId` | string | Optional | Custom template identifier that can be set when isBuiltIn is false but is read-only when isBuiltIn is true. This identifier is typically used if one needs an identifier to be the same across different directories | | `version` | string | Optional | Indicates version of the role definition | ### Input Example `{"displayName":"Example Name","isEnabled":true,"rolePermissions":[{"allowedResourceActions":["string"],"condition":"string","excludedResourceActions":["string"]}],"description":"string","id":"12345678-1234-1234-1234-123456789abc","isBuiltIn":true,"resourceScopes":["string"],"templateId":"string","version":"string"}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `error` | object | Error message if any | | `error.code` | string | Error message if any | | `error.message` | string | Response message | | `error.innerError` | object | Error message if any | | `error.innerError.date` | string | Error message if any | | `error.innerError.request-id` | string | Unique identifier | | `error.innerError.client-request-id` | string | Unique identifier | ### Output Example `{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}` ## Add Directory Administrative Unit Member Add a member to a specific Directory Administrative Unit in Microsoft Graph API by providing the unit ID and the member's @odata.id. ### Endpoint - **URL:** `/v1.0/directory/administrativeUnits/{{id}}/members/$ref` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------------------------------------------------- | | `path_parameters.id` | string | Required | Unit ID | | `@odata.id` | string | Optional | The OData id of the user, group or DirectoryObject to add | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"@odata.id":"string"}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"response_text":"string"}` ## Delete Directory Administrative Unit Member Remove a specified member from a Directory Administrative Unit in Microsoft Graph API using the provided unit and member IDs. ### Endpoint - **URL:** `/v1.0/directory/administrativeUnits/{{id}}/members/{{memberId}}/$ref` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | --------------- | | `path_parameters.id` | string | Required | Unit ID | | `path_parameters.memberId` | string | Required | Member ID | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc","memberId":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"response_text":"string"}` ## Get Directory Administrative Unit List Retrieve a list of administrative units from Microsoft Graph API to support efficient directory segmentation and management. ### Endpoint - **URL:** `/v1.0/directory/administrativeUnits` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `parameters.filter` | string | Optional | Use the `filter` query parameter to retrieve just a subset of a collection. For guidance on using `filter`, see [https://learn.microsoft.com/en-us/graph/filter-query-parameter](https://learn.microsoft.com/en-us/graph/filter-query-parameter) | | `parameters.orderBy` | string | Optional | Use the `orderby` query parameter to specify the sort order of the items returned from Microsoft Graph. | | `parameters.top` | number | Optional | Sets the page size of results. | ### Input Example `{"parameters":{"filter":"string","orderBy":"string","top":123}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `value` | array | Value for the parameter | | `value.id` | string | Unique identifier | | `value.deletedDateTime` | object | Value for the parameter | | `value.displayName` | string | Name of the resource | | `value.description` | object | Value for the parameter | | `value.membershipRule` | object | Value for the parameter | | `value.membershipType` | object | Type of the resource | | `value.membershipRuleProcessingState` | object | Value for the parameter | | `value.visibility` | object | Value for the parameter | ### Output Example `{"@odata.context":"string","value":[{"id":"12345678-1234-1234-1234-123456789abc","deletedDateTime":{},"displayName":"Example Name","description":{},"membershipRule":{},"membershipType":{},"membershipRuleProcessingState":{},"visibility":{}}]}` ## Get Directory Administrative Unit Member Retrieve details of a specific member from a Directory Administrative Unit in Microsoft Graph API using the provided unit ID and member ID. ### Endpoint - **URL:** `/v1.0/directory/administrativeUnits/{{id}}/members/{{memberId}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | --------------- | | `path_parameters.id` | string | Required | ID | | `path_parameters.memberId` | string | Required | Member ID | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc","memberId":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------- | -------- | --------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `@odata.type` | string | Response data | | `id` | string | Unique identifier | | `businessPhones` | array | Output field: businessPhones | | `businessPhones.file_name` | string | Name of the resource | | `businessPhones.file` | string | Output field: businessPhones.file | | `displayName` | string | Name of the resource | | `givenName` | string | Name of the resource | | `jobTitle` | object | Output field: jobTitle | | `mail` | string | Output field: mail | | `mobilePhone` | object | Output field: mobilePhone | | `officeLocation` | object | Output field: officeLocation | | `preferredLanguage` | string | Output field: preferredLanguage | | `surname` | object | Name of the resource | | `userPrincipalName` | string | Name of the resource | ### Output Example `{"@odata.context":"string","@odata.type":"string","id":"12345678-1234-1234-1234-123456789abc","businessPhones":[{"file_name":"Example Name","file":"string"}],"displayName":"Example Name","givenName":"Example Name","jobTitle":{},"mail":"string","mobilePhone":{},"officeLocation":{},"preferredLanguage":"string","surname":{},"userPrincipalName":"Example Name"}` ## Get Directory Admin Unit Member List Retrieve a list of members for a specified Directory Administrative Unit in Microsoft Graph API using the unit's unique ID. ### Endpoint - **URL:** `/v1.0/directory/administrativeUnits/{{id}}/members` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------- | | `path_parameters.id` | string | Required | Unit ID | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `value` | array | Value for the parameter | | `value.@odata.type` | string | Response data | | `value.id` | string | Unique identifier | | `value.businessPhones` | array | Value for the parameter | | `value.businessPhones.file_name` | string | Name of the resource | | `value.businessPhones.file` | string | Value for the parameter | | `value.displayName` | string | Name of the resource | | `value.givenName` | string | Name of the resource | | `value.jobTitle` | object | Value for the parameter | | `value.mail` | string | Value for the parameter | | `value.mobilePhone` | object | Value for the parameter | | `value.officeLocation` | object | Value for the parameter | | `value.preferredLanguage` | string | Value for the parameter | | `value.surname` | object | Name of the resource | | `value.userPrincipalName` | string | Name of the resource | ### Output Example `{"@odata.context":"string","value":[{"@odata.type":"string","id":"12345678-1234-1234-1234-123456789abc","businessPhones":[],"displayName":"Example Name","givenName":"Example Name","jobTitle":{},"mail":"string","mobilePhone":{},"officeLocation":{},"preferredLanguage":"string","surname":{},"userPrincipalName":"Example Name"}]}` ## Get Directory Administrative Unit Retrieve detailed information about a specific Directory Administrative Unit in Microsoft Graph API using its unique ID. ### Endpoint - **URL:** `/v1.0/directory/administrativeUnits/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `path_parameters.id` | string | Required | Unit ID | | `parameters.filter` | string | Optional | Use the `filter` query parameter to retrieve just a subset of a collection. For guidance on using `filter`, see [https://learn.microsoft.com/en-us/graph/filter-query-parameter](https://learn.microsoft.com/en-us/graph/filter-query-parameter) | | `parameters.orderBy` | string | Optional | Use the `orderby` query parameter to specify the sort order of the items returned from Microsoft Graph. | | `parameters.top` | number | Optional | Sets the page size of results. | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"parameters":{"filter":"string","orderBy":"string","top":123}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | ------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `id` | string | Unique identifier | | `deletedDateTime` | object | Time value | | `displayName` | string | Name of the resource | | `description` | object | Output field: description | | `isMemberManagementRestricted` | boolean | Output field: isMemberManagementRestricted | | `visibility` | object | Output field: visibility | | `membershipRule` | object | Output field: membershipRule | | `membershipType` | object | Type of the resource | | `membershipRuleProcessingState` | object | Output field: membershipRuleProcessingState | ### Output Example `{"@odata.context":"string","id":"12345678-1234-1234-1234-123456789abc","deletedDateTime":{},"displayName":"Example Name","description":{},"isMemberManagementRestricted":true,"visibility":{},"membershipRule":{},"membershipType":{},"membershipRuleProcessingState":{}}` ## Delete Identity Directory Role Member Remove a user from a directory role in Microsoft Graph API by specifying the role ID and member ID. ### Endpoint - **URL:** `/v1.0/directoryRoles/{{id}}/members/{{memberId}}/$ref` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | --------------- | | `path_parameters.id` | string | Required | Role ID | | `path_parameters.memberId` | string | Required | Member ID | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc","memberId":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `error` | object | Error message if any | | `error.code` | string | Error message if any | | `error.message` | string | Response message | | `error.innerError` | object | Error message if any | | `error.innerError.date` | string | Error message if any | | `error.innerError.request-id` | string | Unique identifier | | `error.innerError.client-request-id` | string | Unique identifier | ### Output Example `{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}` ## Get Identity Directory Role Retrieve detailed information about a specific directory role in Microsoft Graph API using the unique role ID. ### Endpoint - **URL:** `/v1.0/directoryRoles/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.id` | string | Required | Directory Role ID | | `parameters.count` | string | Optional | Include a count of the total number of items in a collection alongside the page of data values returned from Microsoft Graph | | `parameters.filter` | string | Optional | Use the $filter query parameter to retrieve just a subset of a collection. For guidance on using $filter, see [https://learn.microsoft.com/en-us/graph/filter-query-parameter](https://learn.microsoft.com/en-us/graph/filter-query-parameter) | | `parameters.orderby` | string | Optional | To sort the results in ascending or descending order, append either asc or desc to the field name, separated by a space. | | `parameters.top` | number | Optional | Sets the page size of results | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"parameters":{"count":"false","filter":"string","orderby":"string","top":123}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `id` | string | Unique identifier | | `deletedDateTime` | object | Time value | | `description` | string | Output field: description | | `displayName` | string | Name of the resource | | `roleTemplateId` | string | Unique identifier | ### Output Example `{"@odata.context":"string","id":"12345678-1234-1234-1234-123456789abc","deletedDateTime":{},"description":"string","displayName":"Example Name","roleTemplateId":"string"}` ## Get Identity Directory Role Assignment Member Retrieve directory role assignment details for a specified identity in Microsoft Graph API using the unique identifier. ### Endpoint - **URL:** `/v1.0/roleManagement/directory/roleAssignments/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------ | | `path_parameters.id` | string | Required | Role Assignment ID | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `error` | object | Error message if any | | `error.code` | string | Error message if any | | `error.message` | string | Response message | | `error.innerError` | object | Error message if any | | `error.innerError.date` | string | Error message if any | | `error.innerError.request-id` | string | Unique identifier | | `error.innerError.client-request-id` | string | Unique identifier | ### Output Example `{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}` ## Delete Identity Directory Role Management Remove a specific directory role in Microsoft Graph API by providing the unique role ID as a path parameter. ### Endpoint - **URL:** `/v1.0/roleManagement/directory/roleDefinitions/{{id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------ | | `path_parameters.id` | string | Required | Role Management ID | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `error` | object | Error message if any | | `error.code` | string | Error message if any | | `error.message` | string | Response message | | `error.innerError` | object | Error message if any | | `error.innerError.date` | string | Error message if any | | `error.innerError.request-id` | string | Unique identifier | | `error.innerError.client-request-id` | string | Unique identifier | ### Output Example `{"error":{"code":"ResourceNotFound","message":"Invalid version: rolemanagement","innerError":{"date":"2022-12-20T20:37:28","request-id":"14c4462e-7088-48de-adf6-d6283055090d","client-request-id":"14c4462e-7088-48de-adf6-d6283055090d"}}}` ## Get Identity Directory Role Management List Retrieve a list of directory roles for identity and access management from Microsoft Graph API. ### Endpoint - **URL:** `/v1.0/roleManagement/directory/roleDefinitions` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `value` | array | Value for the parameter | | `value.id` | string | Unique identifier | | `value.description` | string | Value for the parameter | | `value.displayName` | string | Name of the resource | | `value.isBuiltIn` | boolean | Value for the parameter | | `value.isEnabled` | boolean | Value for the parameter | | `value.resourceScopes` | array | Value for the parameter | | `value.templateId` | string | Unique identifier | | `value.version` | string | Value for the parameter | | `value.rolePermissions` | array | Value for the parameter | | `value.rolePermissions.allowedResourceActions` | array | Value for the parameter | | `value.rolePermissions.condition` | object | Value for the parameter | | `value.inheritsPermissionsFrom@odata.context` | string | Response data | | `value.inheritsPermissionsFrom` | array | Value for the parameter | | `value.inheritsPermissionsFrom.file_name` | string | Name of the resource | | `value.inheritsPermissionsFrom.file` | string | Value for the parameter | ### Output Example `{"@odata.context":"string","value":[{"id":"12345678-1234-1234-1234-123456789abc","description":"string","displayName":"Example Name","isBuiltIn":true,"isEnabled":true,"resourceScopes":[],"templateId":"string","version":"string","rolePermissions":[],"inheritsPermissionsFrom@odata.context":"string","inheritsPermissionsFrom":[]}]}` ## Get Identity Directory Role Management Retrieve detailed information for a specific directory role in Microsoft Graph API using the unique role ID. ### Endpoint - **URL:** `/v1.0/roleManagement/directory/roleDefinitions/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------ | | `path_parameters.id` | string | Required | Role Management ID | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `error` | object | Error message if any | | `error.code` | string | Error message if any | | `error.message` | string | Response message | | `error.innerError` | object | Error message if any | | `error.innerError.date` | string | Error message if any | | `error.innerError.request-id` | string | Unique identifier | | `error.innerError.client-request-id` | string | Unique identifier | ### Output Example `{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}` ## Delete Identity Directory Domain Remove a specified domain from your Microsoft tenant by providing the unique domain ID as a path parameter. ### Endpoint - **URL:** `v1.0/domains/{{id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ---------------------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Delete Identity Directory Domain action | ### Input Example `{"path_parameters":{"id":"myradom.test.directory"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"response_text":"string"}` ## Get Identity Directory Domain Retrieve detailed information about a specific domain in Microsoft Graph API using the provided domain ID. ### Endpoint - **URL:** `v1.0/domains/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Get Identity Directory Domain action | ### Input Example `{"path_parameters":{"id":"myradom.test.directory"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | ---------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `authenticationType` | string | Type of the resource | | `availabilityStatus` | object | Status value | | `id` | string | Unique identifier | | `isAdminManaged` | boolean | Output field: isAdminManaged | | `isDefault` | boolean | Output field: isDefault | | `isInitial` | boolean | Output field: isInitial | | `isRoot` | boolean | Output field: isRoot | | `isVerified` | boolean | Output field: isVerified | | `supportedServices` | array | Output field: supportedServices | | `supportedServices.file_name` | string | Name of the resource | | `supportedServices.file` | string | Output field: supportedServices.file | | `passwordValidityPeriodInDays` | object | Unique identifier | | `passwordNotificationWindowInDays` | object | Output field: passwordNotificationWindowInDays | | `state` | object | Output field: state | ### Output Example `{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#domains/$entity","authenticationType":"Managed","availabilityStatus":null,"id":"myradom.test.directory","isAdminManaged":true,"isDefault":false,"isInitial":false,"isRoot":false,"isVerified":false,"supportedServices":[],"passwordValidityPeriodInDays":null,"passwordNotificationWindowInDays":null,"state":null}` ## Get Identity Directory Domain List Retrieve a list of all configured domains from Microsoft Graph API to support efficient identity and directory management. ### Endpoint - **URL:** `v1.0/domains` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.count` | string | Optional | Include a count of the total number of items in a collection alongside the page of data values returned from Microsoft Graph | | `parameters.filter` | string | Optional | Use the $filter query parameter to retrieve just a subset of a collection. For guidance on using $filter, see [https://learn.microsoft.com/en-us/graph/filter-query-parameter](https://learn.microsoft.com/en-us/graph/filter-query-parameter) | | `parameters.orderby` | string | Optional | To sort the results in ascending or descending order, append either asc or desc to the field name, separated by a space. | | `parameters.top` | number | Optional | Sets the page size of results | ### Input Example `{"parameters":{"count":"false","filter":"string","orderby":"string","top":123}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `value` | array | Value for the parameter | | `value.authenticationType` | string | Type of the resource | | `value.availabilityStatus` | object | Status value | | `value.id` | string | Unique identifier | | `value.isAdminManaged` | boolean | Value for the parameter | | `value.isDefault` | boolean | Value for the parameter | | `value.isInitial` | boolean | Value for the parameter | | `value.isRoot` | boolean | Value for the parameter | | `value.isVerified` | boolean | Value for the parameter | | `value.supportedServices` | array | Value for the parameter | | `value.passwordValidityPeriodInDays` | number | Unique identifier | | `value.passwordNotificationWindowInDays` | number | Value for the parameter | | `value.state` | object | Value for the parameter | ### Output Example `{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#domains","value":[{"authenticationType":"Managed","availabilityStatus":null,"id":"bestcompanyever.com","isAdminManaged":true,"isDefault":false,"isInitial":false,"isRoot":false,"isVerified":false,"supportedServices":[],"passwordValidityPeriodInDays":null,"passwordNotificationWindowInDays":null,"state":null},{"authenticationType":"Managed","availabilityStatus":null,"id":"swimlaneintegrations.onmicrosoft.com","isAdminManaged":true,"isDef...` ## Create Identity Directory Domain Add a new domain to your Microsoft Graph API tenant by providing the domain ID in the request body. ### Endpoint - **URL:** `v1.0/domains` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------- | -------- | ------------ | ---------------------------------------------- | | `authenticationType` | string | Optional | Type of the resource | | `availabilityStatus` | string | Optional | Status value | | `id` | string | Optional | Unique identifier | | `isAdminManaged` | boolean | Optional | Parameter for Create Identity Directory Domain | | `isDefault` | boolean | Optional | Parameter for Create Identity Directory Domain | | `isInitial` | boolean | Optional | Parameter for Create Identity Directory Domain | | `isRoot` | boolean | Optional | Parameter for Create Identity Directory Domain | | `isVerified` | boolean | Optional | Parameter for Create Identity Directory Domain | | `passwordNotificationWindowInDays` | number | Optional | Parameter for Create Identity Directory Domain | | `passwordValidityPeriodInDays` | number | Optional | Unique identifier | | `state` | object | Optional | Parameter for Create Identity Directory Domain | | `state.@odata.type` | string | Optional | Response data | | `supportedServices` | array | Optional | Parameter for Create Identity Directory Domain | ### Input Example `{"authenticationType":"string","availabilityStatus":"active","id":"12345678-1234-1234-1234-123456789abc","isAdminManaged":true,"isDefault":true,"isInitial":true,"isRoot":true,"isVerified":true,"passwordNotificationWindowInDays":123,"passwordValidityPeriodInDays":123,"state":{"@odata.type":"string"},"supportedServices":["string"]}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | ---------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `authenticationType` | string | Type of the resource | | `availabilityStatus` | object | Status value | | `id` | string | Unique identifier | | `isAdminManaged` | boolean | Output field: isAdminManaged | | `isDefault` | boolean | Output field: isDefault | | `isInitial` | boolean | Output field: isInitial | | `isRoot` | boolean | Output field: isRoot | | `isVerified` | boolean | Output field: isVerified | | `supportedServices` | array | Output field: supportedServices | | `supportedServices.file_name` | string | Name of the resource | | `supportedServices.file` | string | Output field: supportedServices.file | | `passwordValidityPeriodInDays` | object | Unique identifier | | `passwordNotificationWindowInDays` | object | Output field: passwordNotificationWindowInDays | | `state` | object | Output field: state | ### Output Example `{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#domains/$entity","authenticationType":"Managed","availabilityStatus":null,"id":"myradom.test.directory","isAdminManaged":true,"isDefault":false,"isInitial":false,"isRoot":false,"isVerified":false,"supportedServices":[],"passwordValidityPeriodInDays":null,"passwordNotificationWindowInDays":null,"state":null}` ## Get Identity Directory Object Retrieve a specific directory object from Microsoft Graph API using the unique object ID provided in the path parameters. ### Endpoint - **URL:** `/v1.0/directoryObjects/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------- | | `path_parameters.id` | string | Required | Directory Object ID | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | ------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `@odata.type` | string | Response data | | `id` | string | Unique identifier | | `deletedDateTime` | object | Time value | | `classification` | object | Output field: classification | | `createdDateTime` | string | Time value | | `creationOptions` | array | Output field: creationOptions | | `description` | string | Output field: description | | `displayName` | string | Name of the resource | | `expirationDateTime` | object | Time value | | `groupTypes` | array | Type of the resource | | `isAssignableToRole` | object | Output field: isAssignableToRole | | `mail` | string | Output field: mail | | `mailEnabled` | boolean | Output field: mailEnabled | | `mailNickname` | string | Name of the resource | | `membershipRule` | object | Output field: membershipRule | | `membershipRuleProcessingState` | object | Output field: membershipRuleProcessingState | | `onPremisesDomainName` | object | Name of the resource | | `onPremisesLastSyncDateTime` | object | Time value | | `onPremisesNetBiosName` | object | Name of the resource | | `onPremisesSamAccountName` | object | Name of the resource | | `onPremisesSecurityIdentifier` | object | Unique identifier | | `onPremisesSyncEnabled` | object | Output field: onPremisesSyncEnabled | ### Output Example `{"@odata.context":"string","@odata.type":"string","id":"12345678-1234-1234-1234-123456789abc","deletedDateTime":{},"classification":{},"createdDateTime":"string","creationOptions":["string"],"description":"string","displayName":"Example Name","expirationDateTime":{},"groupTypes":["string"],"isAssignableToRole":{},"mail":"string","mailEnabled":true,"mailNickname":"Example Name"}` ## Get Identity Directory Role Members List Retrieve users and groups assigned to a specified directory role in Microsoft Graph API using the provided role-id. ### Endpoint - **URL:** `v1.0/directoryRoles/{{role-id}}/members` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ------------------------------------------------------------------ | | `path_parameters.role-id` | string | Required | Parameters for the Get Identity Directory Role Members List action | ### Input Example `{"path_parameters":{"role-id":"b8d0b017-384c-40cb-b37b-99ee5d3f8a8f"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `value` | array | Value for the parameter | | `value.@odata.type` | string | Response data | | `value.id` | string | Unique identifier | | `value.businessPhones` | array | Value for the parameter | | `value.businessPhones.file_name` | string | Name of the resource | | `value.businessPhones.file` | string | Value for the parameter | | `value.displayName` | string | Name of the resource | | `value.givenName` | string | Name of the resource | | `value.jobTitle` | object | Value for the parameter | | `value.mail` | string | Value for the parameter | | `value.mobilePhone` | object | Value for the parameter | | `value.officeLocation` | object | Value for the parameter | | `value.preferredLanguage` | object | Value for the parameter | | `value.surname` | string | Name of the resource | | `value.userPrincipalName` | string | Name of the resource | ### Output Example `{"@odata.context":"string","value":[{"@odata.type":"string","id":"12345678-1234-1234-1234-123456789abc","businessPhones":[],"displayName":"Example Name","givenName":"Example Name","jobTitle":{},"mail":"string","mobilePhone":{},"officeLocation":{},"preferredLanguage":{},"surname":"Example Name","userPrincipalName":"Example Name"}]}` ## Cancel Security Action Cancel an ongoing security action in Microsoft Graph API by providing the required action\_id as a path parameter. ### Endpoint - **URL:** `/beta/security/securityActions/{{action_id}}/cancelSecurityAction` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | --------------- | | `path_parameters.action_id` | string | Required | Action ID | ### Input Example `{"path_parameters":{"action_id":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"response_text":"string"}` ## Create Security Action Initiate a new security action in Microsoft Graph API by providing the action name, reason, vendor details, and required parameters. ### Endpoint - **URL:** `/beta/security/securityActions` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------ | | `name` | string | Optional | Action Name | | `actionReason` | string | Optional | Action Reason | | `vendorInformation` | object | Optional | Vendor Information | | `vendorInformation.vendor` | string | Required | Vendor | | `vendorInformation.provider` | string | Required | Provider | | `parameters` | array | Optional | Collection of parameters (key-value pairs) necessary to invoke the action, for example, URL or fileHash to block). | | `parameters.name` | string | Required | Parameters for the Create Security Action action | | `parameters.value` | string | Required | Parameters for the Create Security Action action | ### Input Example `{"name":"Example Name","actionReason":"string","vendorInformation":{"vendor":"string","provider":"string"},"parameters":[{"name":"Example Name","value":"string"}]}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `error` | object | Error message if any | | `error.code` | string | Error message if any | | `error.message` | string | Response message | | `error.innerError` | object | Error message if any | | `error.innerError.date` | string | Error message if any | | `error.innerError.request-id` | string | Unique identifier | | `error.innerError.client-request-id` | string | Unique identifier | ### Output Example `{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}` ## Get Security Action Retrieve detailed information for a specific security action in Microsoft Graph API using the required action\_id path parameter. ### Endpoint - **URL:** `/beta/security/securityActions/{{action_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `path_parameters.action_id` | string | Required | Action ID | | `parameters.filter` | string | Optional | Use the `filter` query parameter to retrieve just a subset of a collection. For guidance on using `filter`, see [https://learn.microsoft.com/en-us/graph/filter-query-parameter](https://learn.microsoft.com/en-us/graph/filter-query-parameter) | | `parameters.orderBy` | string | Optional | Use the `orderby` query parameter to specify the sort order of the items returned from Microsoft Graph. | | `parameters.top` | number | Optional | Sets the page size of results. | ### Input Example `{"path_parameters":{"action_id":"string"},"parameters":{"filter":"string","orderBy":"string","top":123}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `error` | object | Error message if any | | `error.code` | string | Error message if any | | `error.message` | string | Response message | | `error.innerError` | object | Error message if any | | `error.innerError.date` | string | Error message if any | | `error.innerError.request-id` | string | Unique identifier | | `error.innerError.client-request-id` | string | Unique identifier | ### Output Example `{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}` ## Get Security Actions List Retrieve configurations and details of security actions from the Microsoft Graph Security API. ### Endpoint - **URL:** `/beta/security/securityActions` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `parameters.filter` | string | Optional | Use the `filter` query parameter to retrieve just a subset of a collection. For guidance on using `filter`, see [https://learn.microsoft.com/en-us/graph/filter-query-parameter](https://learn.microsoft.com/en-us/graph/filter-query-parameter) | | `parameters.orderBy` | string | Optional | Use the `orderby` query parameter to specify the sort order of the items returned from Microsoft Graph. | | `parameters.top` | number | Optional | Sets the page size of results. | ### Input Example `{"parameters":{"filter":"string","orderBy":"string","top":123}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `value` | array | Value for the parameter | | `value.file_name` | string | Name of the resource | | `value.file` | string | Value for the parameter | ### Output Example `{"@odata.context":"string","value":[{"file_name":"Example Name","file":"string"}]}` ## Get Alert Retrieve detailed information for a specific security alert by providing the alert\_id using the Microsoft Graph Security API. ### Endpoint - **URL:** `/v1.0/security/alerts_v2/{{alert_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ---------------- | | `path_parameters.alert_id` | string | Required | ID of the Alert. | ### Input Example `{"path_parameters":{"alert_id":"fabefb2117-8e9b-d555-b800-08dc0572c0de"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `id` | string | Unique identifier | | `providerAlertId` | string | Unique identifier | | `incidentId` | string | Unique identifier | | `status` | string | Status value | | `severity` | string | Output field: severity | | `classification` | string | Output field: classification | | `determination` | string | Output field: determination | | `serviceSource` | string | Output field: serviceSource | | `detectionSource` | string | Output field: detectionSource | | `productName` | string | Name of the resource | | `detectorId` | string | Unique identifier | | `tenantId` | string | Unique identifier | | `title` | string | Output field: title | | `description` | string | Output field: description | | `recommendedActions` | string | Output field: recommendedActions | | `category` | string | Output field: category | | `assignedTo` | string | Output field: assignedTo | | `alertWebUrl` | string | URL endpoint for the request | | `incidentWebUrl` | string | URL endpoint for the request | | `actorDisplayName` | object | Name of the resource | | `threatDisplayName` | object | Name of the resource | | `threatFamilyName` | object | Name of the resource | ### Output Example `{"@odata.context":"string","id":"12345678-1234-1234-1234-123456789abc","providerAlertId":"string","incidentId":"string","status":"active","severity":"string","classification":"string","determination":"string","serviceSource":"string","detectionSource":"string","productName":"Example Name","detectorId":"string","tenantId":"string","title":"string","description":"string"}` ## List Alerts Retrieve security alerts from the Microsoft Graph Security API to monitor potential threats and anomalies. ### Endpoint - **URL:** `/v1.0/security/alerts_v2` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.$count` | string | Optional | Retrieves the total count of matching resources. | | `parameters.$skip` | number | Optional | Indexes into a result set. Also used by some APIs to implement paging and can be used together with $top to manually page results. | | `parameters.$top` | number | Optional | Sets the page size of results. | | `parameters.$filter` | string | Optional | Use the `filter` query parameter to retrieve just a subset of a collection. For guidance on using `filter`, see [https://learn.microsoft.com/en-us/graph/filter-query-parameter](https://learn.microsoft.com/en-us/graph/filter-query-parameter). | | `parameters.return_as_turbine_schema` | boolean | Optional | When true, alerts are mapped to normalized Turbine Schema alert objects and returned in the Alerts field. When false, the raw Microsoft Graph API response is returned. | | `parameters.alert_organization` | string | Optional | Optional organization name to include in the Turbine Schema alert. Used only when return\_as\_turbine\_schema is true. | | `parameters.ioc_types` | array | Optional | List of observable types to extract. Supported: ipv4\_public, ipv4\_private, ipv6\_public, ipv6\_private, domain, url, email, sha1, sha256, md5. If omitted or empty, all types are extracted. | | `parameters.domains_ignore_list` | string | Optional | Comma-separated domain values to exclude from observable extraction. | | `parameters.ip_cidr_ignore_list` | string | Optional | Comma-separated CIDR ranges to exclude from observable extraction. | | `parameters.regex_ignore` | string | Optional | Regex pattern — any observable value matching this pattern is excluded. | | `parameters.ioc_ignore_paths` | array | Optional | Array of slash-separated field paths to strip from each alert before extracting observables. Supports wildcards (*) and nested paths. Example: \["processCommandLine", "context/*/ipAddress"]. | ### Input Example `{"parameters":{"$count":"string","$skip":123,"$top":123,"$filter":"string","return_as_turbine_schema":true,"alert_organization":"string","ioc_types":["string"],"domains_ignore_list":"string","ip_cidr_ignore_list":"string","regex_ignore":"string","ioc_ignore_paths":["string"]}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------- | -------- | ---------------------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `Alerts` | array | Normalized Turbine Schema alerts (when return\_as\_turbine\_schema is true). | | `total_processed` | integer | Number of Turbine Schema alerts returned. | | `@odata.context` | string | Response data | | `value` | array | Value for the parameter | | `value.id` | string | Unique identifier | | `value.providerAlertId` | string | Unique identifier | | `value.incidentId` | string | Unique identifier | | `value.status` | string | Status value | | `value.severity` | string | Value for the parameter | | `value.classification` | string | Value for the parameter | | `value.determination` | string | Value for the parameter | | `value.serviceSource` | string | Value for the parameter | | `value.detectionSource` | string | Value for the parameter | | `value.productName` | string | Name of the resource | | `value.detectorId` | string | Unique identifier | | `value.tenantId` | string | Unique identifier | | `value.title` | string | Value for the parameter | | `value.description` | string | Value for the parameter | | `value.recommendedActions` | string | Value for the parameter | | `value.category` | string | Value for the parameter | | `value.assignedTo` | string | Value for the parameter | | `value.alertWebUrl` | string | URL endpoint for the request | | `value.incidentWebUrl` | string | URL endpoint for the request | ### Output Example `{"Alerts":[],"total_processed":123,"@odata.context":"string","value":[{"id":"12345678-1234-1234-1234-123456789abc","providerAlertId":"string","incidentId":"string","status":"active","severity":"string","classification":"string","determination":"string","serviceSource":"string","detectionSource":"string","productName":"Example Name","detectorId":"string","tenantId":"string","title":"string","description":"string","recommendedActions":"string"}]}` ## Get Control Profile Retrieve detailed information for a specific security control profile using its unique ID from the Microsoft Graph Security API. ### Endpoint - **URL:** `/v1.0/security/secureScoreControlProfiles/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------ | | `path_parameters.id` | string | Required | Control Profile ID | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `id` | string | Unique identifier | | `azureTenantId` | string | Unique identifier | | `actionType` | string | Type of the resource | | `actionUrl` | string | URL endpoint for the request | | `controlCategory` | string | Output field: controlCategory | | `title` | string | Output field: title | | `deprecated` | boolean | Output field: deprecated | | `implementationCost` | string | Output field: implementationCost | | `lastModifiedDateTime` | object | Time value | | `maxScore` | number | Score value | | `rank` | number | Output field: rank | | `remediation` | string | Output field: remediation | | `remediationImpact` | string | Output field: remediationImpact | | `service` | string | Output field: service | | `threats` | array | Output field: threats | | `threats.file_name` | string | Name of the resource | | `threats.file` | string | Output field: threats.file | | `tier` | string | Output field: tier | | `userImpact` | string | Output field: userImpact | | `vendorInformation` | object | Output field: vendorInformation | | `vendorInformation.provider` | string | Unique identifier | | `vendorInformation.providerVersion` | object | Unique identifier | ### Output Example `{"@odata.context":"string","id":"12345678-1234-1234-1234-123456789abc","azureTenantId":"string","actionType":"string","actionUrl":"string","controlCategory":"string","title":"string","deprecated":true,"implementationCost":"string","lastModifiedDateTime":{},"maxScore":123,"rank":123,"remediation":"string","remediationImpact":"string","service":"string"}` ## Get Secure Scores List Retrieve a list of Secure Scores from Microsoft Graph Security API to assess your organization's overall security posture. ### Endpoint - **URL:** `/v1.0/security/secureScores` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `parameters.filter` | string | Optional | Use the `filter` query parameter to retrieve just a subset of a collection. For guidance on using `filter`, see [https://learn.microsoft.com/en-us/graph/filter-query-parameter](https://learn.microsoft.com/en-us/graph/filter-query-parameter) | | `parameters.orderBy` | string | Optional | Use the `orderby` query parameter to specify the sort order of the items returned from Microsoft Graph. | | `parameters.top` | number | Optional | Sets the page size of results. | ### Input Example `{"parameters":{"filter":"string","orderBy":"string","top":123}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `@odata.nextLink` | string | Response data | | `value` | array | Value for the parameter | | `value.id` | string | Unique identifier | | `value.azureTenantId` | string | Unique identifier | | `value.activeUserCount` | number | Value for the parameter | | `value.createdDateTime` | string | Value for the parameter | | `value.currentScore` | number | Value for the parameter | | `value.enabledServices` | array | Value for the parameter | | `value.licensedUserCount` | number | Value for the parameter | | `value.maxScore` | number | Value for the parameter | | `value.vendorInformation` | object | Value for the parameter | | `value.vendorInformation.provider` | string | Unique identifier | | `value.vendorInformation.providerVersion` | object | Unique identifier | | `value.vendorInformation.subProvider` | object | Unique identifier | | `value.vendorInformation.vendor` | string | Value for the parameter | | `value.averageComparativeScores` | array | Value for the parameter | | `value.averageComparativeScores.file_name` | string | Name of the resource | | `value.averageComparativeScores.file` | string | Value for the parameter | | `value.controlScores` | array | Value for the parameter | | `value.controlScores.controlCategory` | string | Value for the parameter | | `value.controlScores.controlName` | string | Name of the resource | | `value.controlScores.description` | object | Value for the parameter | ### Output Example `{"@odata.context":"string","@odata.nextLink":"string","value":[{"id":"12345678-1234-1234-1234-123456789abc","azureTenantId":"string","activeUserCount":123,"createdDateTime":"string","currentScore":123,"enabledServices":[],"licensedUserCount":123,"maxScore":123,"vendorInformation":{},"averageComparativeScores":[],"controlScores":[]}]}` ## Get Secure Control Profiles Retrieve a list of secure control profiles to help enhance your organization's security posture using the Microsoft Graph Security API. ### Endpoint - **URL:** `/v1.0/security/secureScoreControlProfiles` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `parameters.filter` | string | Optional | Use the `filter` query parameter to retrieve just a subset of a collection. For guidance on using `filter`, see [https://learn.microsoft.com/en-us/graph/filter-query-parameter](https://learn.microsoft.com/en-us/graph/filter-query-parameter) | | `parameters.orderBy` | string | Optional | Use the `orderby` query parameter to specify the sort order of the items returned from Microsoft Graph. | | `parameters.top` | number | Optional | Sets the page size of results. | ### Input Example `{"parameters":{"filter":"string","orderBy":"string","top":123}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `@odata.nextLink` | string | Response data | | `value` | array | Value for the parameter | | `value.id` | string | Unique identifier | | `value.azureTenantId` | string | Unique identifier | | `value.actionType` | string | Type of the resource | | `value.actionUrl` | string | URL endpoint for the request | | `value.controlCategory` | string | Value for the parameter | | `value.title` | string | Value for the parameter | | `value.deprecated` | boolean | Value for the parameter | | `value.implementationCost` | string | Value for the parameter | | `value.lastModifiedDateTime` | object | Value for the parameter | | `value.maxScore` | number | Value for the parameter | | `value.rank` | number | Value for the parameter | | `value.remediation` | string | Value for the parameter | | `value.remediationImpact` | string | Value for the parameter | | `value.service` | string | Value for the parameter | | `value.threats` | array | Value for the parameter | | `value.threats.file_name` | string | Name of the resource | | `value.threats.file` | string | Value for the parameter | | `value.tier` | string | Value for the parameter | | `value.userImpact` | string | Value for the parameter | | `value.vendorInformation` | object | Value for the parameter | ### Output Example `{"@odata.context":"string","@odata.nextLink":"string","value":[{"id":"12345678-1234-1234-1234-123456789abc","azureTenantId":"string","actionType":"string","actionUrl":"string","controlCategory":"string","title":"string","deprecated":true,"implementationCost":"string","lastModifiedDateTime":{},"maxScore":123,"rank":123,"remediation":"string","remediationImpact":"string","service":"string","threats":[]}]}` ## Get Secure Score Retrieve a specific secure score from Microsoft Graph Security API by providing the required score ID as a path parameter. ### Endpoint - **URL:** `/v1.0/security/secureScores/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------- | | `path_parameters.id` | string | Required | Secure Score ID | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | ------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `id` | string | Unique identifier | | `azureTenantId` | string | Unique identifier | | `activeUserCount` | number | Count value | | `createdDateTime` | string | Time value | | `currentScore` | number | Score value | | `enabledServices` | array | Output field: enabledServices | | `licensedUserCount` | number | Count value | | `maxScore` | number | Score value | | `vendorInformation` | object | Output field: vendorInformation | | `vendorInformation.provider` | string | Unique identifier | | `vendorInformation.providerVersion` | object | Unique identifier | | `vendorInformation.subProvider` | object | Unique identifier | | `vendorInformation.vendor` | string | Output field: vendorInformation.vendor | | `averageComparativeScores` | array | Output field: averageComparativeScores | | `averageComparativeScores.file_name` | string | Name of the resource | | `averageComparativeScores.file` | string | Output field: averageComparativeScores.file | | `controlScores` | array | Output field: controlScores | | `controlScores.controlCategory` | string | Output field: controlScores.controlCategory | | `controlScores.controlName` | string | Name of the resource | | `controlScores.description` | string | Output field: controlScores.description | | `controlScores.score` | number | Score value | | `controlScores.IsApplicable` | string | Output field: controlScores.IsApplicable | ### Output Example `{"@odata.context":"string","id":"12345678-1234-1234-1234-123456789abc","azureTenantId":"string","activeUserCount":123,"createdDateTime":"string","currentScore":123,"enabledServices":["string"],"licensedUserCount":123,"maxScore":123,"vendorInformation":{"provider":"string","providerVersion":{},"subProvider":{},"vendor":"string"},"averageComparativeScores":[{"file_name":"Example Name","file":"string"}],"controlScores":[{"controlCategory":"string","controlName":"Example Name","description":"string"...` ## Get Threat Assessment Retrieve detailed threat insights for a specified ID using the Microsoft Graph Security API. ### Endpoint - **URL:** `/v1.0/informationProtection/threatAssessmentRequests/{{id}}?$expand=results` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------- | | `path_parameters.id` | string | Required | Assessment ID | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `@odata.type` | string | Response data | | `id` | string | Unique identifier | | `createdDateTime` | string | Time value | | `contentType` | string | Type of the resource | | `expectedAssessment` | string | Output field: expectedAssessment | | `category` | string | Output field: category | | `status` | string | Status value | | `requestSource` | string | Output field: requestSource | | `recipientEmail` | string | Output field: recipientEmail | | `destinationRoutingReason` | string | Response reason phrase | | `contentData` | string | Response data | | `createdBy` | object | Output field: createdBy | | `createdBy.user` | object | Output field: createdBy.user | | `createdBy.user.id` | string | Unique identifier | | `createdBy.user.displayName` | string | Name of the resource | | `results@odata.context` | string | Response data | | `results` | array | Result of the operation | | `results.id` | string | Unique identifier | | `results.createdDateTime` | string | Result of the operation | | `results.resultType` | string | Type of the resource | | `results.message` | string | Result of the operation | ### Output Example `{"@odata.context":"string","@odata.type":"string","id":"12345678-1234-1234-1234-123456789abc","createdDateTime":"string","contentType":"string","expectedAssessment":"string","category":"string","status":"active","requestSource":"string","recipientEmail":"string","destinationRoutingReason":"string","contentData":"string","createdBy":{"user":{"id":"12345678-1234-1234-1234-123456789abc","displayName":"Example Name"}},"results@odata.context":"string","results":[{"id":"12345678-1234-1234-1234-1234567...` ## Get Threat Assessment List Retrieve and analyze threat assessments to enhance security posture using the Microsoft Graph Security API. ### Endpoint - **URL:** `/v1.0/informationProtection/threatAssessmentRequests` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `parameters.filter` | string | Optional | Use the `filter` query parameter to retrieve just a subset of a collection. For guidance on using `filter`, see [https://learn.microsoft.com/en-us/graph/filter-query-parameter](https://learn.microsoft.com/en-us/graph/filter-query-parameter) | | `parameters.orderBy` | string | Optional | Use the `orderby` query parameter to specify the sort order of the items returned from Microsoft Graph. | | `parameters.top` | number | Optional | Sets the page size of results. | ### Input Example `{"parameters":{"filter":"string","orderBy":"string","top":123}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `value` | array | Value for the parameter | | `value.@odata.type` | string | Response data | | `value.id` | string | Unique identifier | | `value.createdDateTime` | string | Value for the parameter | | `value.contentType` | string | Type of the resource | | `value.expectedAssessment` | string | Value for the parameter | | `value.category` | string | Value for the parameter | | `value.status` | string | Status value | | `value.requestSource` | string | Value for the parameter | | `value.recipientEmail` | string | Value for the parameter | | `value.destinationRoutingReason` | string | Value for the parameter | | `value.contentData` | string | Response data | | `value.createdBy` | object | Value for the parameter | | `value.createdBy.user` | object | Value for the parameter | ### Output Example `{"@odata.context":"string","value":[{"@odata.type":"string","id":"12345678-1234-1234-1234-123456789abc","createdDateTime":"string","contentType":"string","expectedAssessment":"string","category":"string","status":"active","requestSource":"string","recipientEmail":"string","destinationRoutingReason":"string","contentData":"string","createdBy":{}}]}` ## Delete Threat Intelligence Indicator Remove a specific Threat Intelligence indicator from Microsoft Graph Security API using the unique ID provided. ### Endpoint - **URL:** `/beta/security/tiIndicators/{{id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | -------------------------------- | | `path_parameters.id` | string | Required | Threat Intelligence Indicator ID | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `error` | object | Error message if any | | `error.code` | string | Error message if any | | `error.message` | string | Response message | | `error.innerError` | object | Error message if any | | `error.innerError.date` | string | Error message if any | | `error.innerError.request-id` | string | Unique identifier | | `error.innerError.client-request-id` | string | Unique identifier | ### Output Example `{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}` ## Get Threat Intelligence Indicator Retrieve detailed information for a specific Threat Intelligence Indicator from Microsoft Graph Security API using its unique ID. ### Endpoint - **URL:** `/beta/security/tiIndicators/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | -------------------------------- | | `path_parameters.id` | string | Required | Threat Intelligence Indicator ID | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------ | -------- | ----------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `id` | string | Unique identifier | | `azureTenantId` | string | Unique identifier | | `action` | string | Output field: action | | `additionalInformation` | object | Output field: additionalInformation | | `activityGroupNames` | array | Name of the resource | | `activityGroupNames.file_name` | string | Name of the resource | | `activityGroupNames.file` | string | Name of the resource | | `confidence` | object | Unique identifier | | `description` | string | Output field: description | | `diamondModel` | object | Output field: diamondModel | | `emailEncoding` | object | Output field: emailEncoding | | `emailLanguage` | object | Output field: emailLanguage | | `emailRecipient` | object | Output field: emailRecipient | | `emailSenderAddress` | object | Output field: emailSenderAddress | | `emailSenderName` | object | Name of the resource | | `emailSourceDomain` | object | Output field: emailSourceDomain | | `emailSourceIpAddress` | object | Output field: emailSourceIpAddress | | `emailSubject` | object | Output field: emailSubject | | `emailXMailer` | object | Output field: emailXMailer | | `expirationDateTime` | string | Time value | | `externalId` | object | Unique identifier | | `fileCompileDateTime` | object | Time value | ### Output Example `{"@odata.context":"string","id":"12345678-1234-1234-1234-123456789abc","azureTenantId":"string","action":"string","additionalInformation":{},"activityGroupNames":[{"file_name":"Example Name","file":"string"}],"confidence":{},"description":"string","diamondModel":{},"emailEncoding":{},"emailLanguage":{},"emailRecipient":{},"emailSenderAddress":{},"emailSenderName":{},"emailSourceDomain":{}}` ## Get Threat Intelligence Indicators List Retrieve threat intelligence indicators from Microsoft Graph Security API to support analysis and strengthen threat detection. ### Endpoint - **URL:** `/beta/security/tiIndicators` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `parameters.filter` | string | Optional | Use the `filter` query parameter to retrieve just a subset of a collection. For guidance on using `filter`, see [https://learn.microsoft.com/en-us/graph/filter-query-parameter](https://learn.microsoft.com/en-us/graph/filter-query-parameter) | | `parameters.orderBy` | string | Optional | Use the `orderby` query parameter to specify the sort order of the items returned from Microsoft Graph. | | `parameters.top` | number | Optional | Sets the page size of results. | ### Input Example `{"parameters":{"filter":"string","orderBy":"string","top":123}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `value` | array | Value for the parameter | | `value.id` | string | Unique identifier | | `value.azureTenantId` | string | Unique identifier | | `value.action` | string | Value for the parameter | | `value.additionalInformation` | object | Value for the parameter | | `value.activityGroupNames` | array | Name of the resource | | `value.activityGroupNames.file_name` | string | Name of the resource | | `value.activityGroupNames.file` | string | Name of the resource | | `value.confidence` | object | Unique identifier | | `value.description` | string | Value for the parameter | | `value.diamondModel` | object | Value for the parameter | | `value.emailEncoding` | object | Value for the parameter | | `value.emailLanguage` | object | Value for the parameter | | `value.emailRecipient` | object | Value for the parameter | | `value.emailSenderAddress` | object | Value for the parameter | | `value.emailSenderName` | object | Name of the resource | | `value.emailSourceDomain` | object | Value for the parameter | | `value.emailSourceIpAddress` | object | Value for the parameter | | `value.emailSubject` | object | Value for the parameter | | `value.emailXMailer` | object | Value for the parameter | | `value.expirationDateTime` | string | Value for the parameter | | `value.externalId` | object | Unique identifier | ### Output Example `{"@odata.context":"string","value":[{"id":"12345678-1234-1234-1234-123456789abc","azureTenantId":"string","action":"string","additionalInformation":{},"activityGroupNames":[],"confidence":{},"description":"string","diamondModel":{},"emailEncoding":{},"emailLanguage":{},"emailRecipient":{},"emailSenderAddress":{},"emailSenderName":{},"emailSourceDomain":{},"emailSourceIpAddress":{}}]}` ## Update Alert Update an existing security alert in Microsoft Graph Security API by specifying the alert ID and providing additional request details. ### Endpoint - **URL:** `/v1.0/security/alerts_v2/{{alert_id}}` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ------------------------------------------------------- | | `path_parameters.alert_id` | string | Required | ID of the Alert | | `assignedTo` | string | Optional | Owner of the incident, or null if no owner is assigned. | | `determination` | string | Optional | Specifies the determination of the alert. | | `classification` | string | Optional | Specifies the classification of the alert. | | `customDetails` | string | Optional | User defined custom fields with string values. | | `status` | string | Optional | Alert lifecycle status (stage). | ### Input Example `{"path_parameters":{"alert_id":"string"},"assignedTo":"string","determination":"string","classification":"string","customDetails":"string","status":"active"}` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `id` | string | Unique identifier | | `providerAlertId` | string | Unique identifier | | `incidentId` | string | Unique identifier | | `status` | string | Status value | | `severity` | string | Output field: severity | | `classification` | string | Output field: classification | | `determination` | object | Output field: determination | | `serviceSource` | string | Output field: serviceSource | | `detectionSource` | string | Output field: detectionSource | | `productName` | string | Name of the resource | | `detectorId` | string | Unique identifier | | `tenantId` | string | Unique identifier | | `title` | string | Output field: title | | `description` | string | Output field: description | | `recommendedActions` | string | Output field: recommendedActions | | `category` | string | Output field: category | | `assignedTo` | string | Output field: assignedTo | | `alertWebUrl` | string | URL endpoint for the request | | `incidentWebUrl` | string | URL endpoint for the request | | `actorDisplayName` | object | Name of the resource | | `threatDisplayName` | object | Name of the resource | | `threatFamilyName` | object | Name of the resource | ### Output Example `{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#security/alerts_v2/$entity","id":"maf25f0fa0-126a-4297-aff6-ae579cb984a3","providerAlertId":"f25f0fa0-126a-4297-aff6-ae579cb984a3","incidentId":"563","status":"new","severity":"medium","classification":"truePositive","determination":null,"serviceSource":"microsoftAppGovernance","detectionSource":"appGovernanceDetection","productName":"App Governance","detectorId":"b62ae531-7aa6-4bc8-91b9-49a9be960145","tenantId":"f5d73c4c-bb3d-421b-8b...` ## Create Threat Intel Indicator Azure Sentinel Create a threat intelligence indicator in Azure Sentinel by specifying action, tenant ID, description, expiration date, target product, threat type, and TLP level. ### Endpoint - **URL:** `/beta/security/tiIndicators` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `action` | string | Optional | The action to apply if the indicator is matched from within the targetProduct security tool. Possible values are `unknown`, `allow`, `block` or `alert` | | `activityGroupNames` | array | Optional | The cyber threat intelligence name(s) for the parties responsible for the malicious activity covered by the threat indicator | | `additionalInformation` | string | Optional | A catchall area into which extra data from the indicator not covered by the other tiIndicator properties may be placed. Data placed into additionalInformation will typically not be utilized by the targetProduct security tool | | `azureTenantId` | string | Optional | Stamped by the system when the indicator is ingested. The Azure Active Directory tenant id of submitting client | | `confidence` | number | Optional | An integer representing the confidence the data within the indicator accurately identifies malicious behavior. Acceptable values are 0-100 with 100 being the highest. | | `description` | string | Optional | Brief description (100 characters or less) of the threat represented by the indicator | | `diamondModel` | string | Optional | The area of the Diamond Model in which this indicator exists. Possible values are `unknown`, `adversary`, `capability`, `infrastructure` and `victim` | | `domainName` | string | Optional | Domain name associated with this indicator. Should be of the format subdomain.domain.topleveldomain (For example, baddomain.domain.net) | | `emailEncoding` | string | Optional | The type of text encoding used in the email | | `emailLanguage` | string | Optional | The Language of the email | | `emailRecipient` | string | Optional | Email Recipient Address | | `emailSenderAddress` | string | Optional | Email Sender Address | | `emailSenderName` | string | Optional | Email Sender Name | | `emailSourceDomain` | string | Optional | Parameter for Create Threat Intel Indicator Azure Sentinel | | `emailSourceIpAddress` | string | Optional | Parameter for Create Threat Intel Indicator Azure Sentinel | | `emailSubject` | string | Optional | Parameter for Create Threat Intel Indicator Azure Sentinel | | `emailXMailer` | string | Optional | X-Mailer value used in the email | | `expirationDateTime` | string | Optional | The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time | | `externalId` | string | Optional | Unique identifier | | `fileCompileDateTime` | string | Optional | The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time | | `fileCreatedDateTime` | string | Optional | The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time | | `fileHashType` | string | Optional | The type of hash stored in fileHashValue. Possible values are `unknown`, `sha1`, `sha256`, `md5`, `authenticodeHash256`, `lsHash`, `ctph` | | `fileHashValue` | string | Optional | Value for the parameter | | `fileMutexName` | string | Optional | Name of the resource | | `fileName` | string | Optional | Name of the resource | ### Input Example `{"action":"string","activityGroupNames":["string"],"additionalInformation":"string","azureTenantId":"string","confidence":123,"description":"string","diamondModel":"string","domainName":"Example Name","emailEncoding":"string","emailLanguage":"string","emailRecipient":"string","emailSenderAddress":"string","emailSenderName":"Example Name","emailSourceDomain":"string","emailSourceIpAddress":"string","emailSubject":"string","emailXMailer":"string","expirationDateTime":"string","externalId":"string","fileCompileDateTime":"string","fileCreatedDateTime":"string","fileHashType":"string","fileHashValue":"string","fileMutexName":"Example Name","fileName":"Example Name","filePacker":"string","filePath":"string","fileSize":123,"fileType":"string","isActive":"string","killChain":["string"],"knownFalsePositives":"string","lastReportedDateTime":"string","malwareFamilyNames":"Example Name","networkCidrBlock":"string","networkDestinationAsn":123,"networkDestinationCidrBlock":"string","networkDestinationIPv4":"string","networkDestinationIPv6":"string","networkDestinationPort":123,"networkIPv4":"string","networkIPv6":"string","networkPort":123,"networkProtocol":123,"networkSourceAsn":123,"networkSourceCidrBlock":"string","networkSourceIPv4":"string","networkSourceIPv6":"string","networkSourcePort":123,"passiveOnly":"string"}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------ | -------- | ----------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `id` | string | Unique identifier | | `azureTenantId` | string | Unique identifier | | `action` | string | Output field: action | | `additionalInformation` | object | Output field: additionalInformation | | `activityGroupNames` | array | Name of the resource | | `activityGroupNames.file_name` | string | Name of the resource | | `activityGroupNames.file` | string | Name of the resource | | `confidence` | object | Unique identifier | | `description` | string | Output field: description | | `diamondModel` | object | Output field: diamondModel | | `emailEncoding` | object | Output field: emailEncoding | | `emailLanguage` | object | Output field: emailLanguage | | `emailRecipient` | object | Output field: emailRecipient | | `emailSenderAddress` | object | Output field: emailSenderAddress | | `emailSenderName` | object | Name of the resource | | `emailSourceDomain` | object | Output field: emailSourceDomain | | `emailSourceIpAddress` | object | Output field: emailSourceIpAddress | | `emailSubject` | object | Output field: emailSubject | | `emailXMailer` | object | Output field: emailXMailer | | `expirationDateTime` | string | Time value | | `externalId` | object | Unique identifier | | `fileCompileDateTime` | object | Time value | ### Output Example `{"@odata.context":"string","id":"12345678-1234-1234-1234-123456789abc","azureTenantId":"string","action":"string","additionalInformation":{},"activityGroupNames":[{"file_name":"Example Name","file":"string"}],"confidence":{},"description":"string","diamondModel":{},"emailEncoding":{},"emailLanguage":{},"emailRecipient":{},"emailSenderAddress":{},"emailSenderName":{},"emailSourceDomain":{}}` ## Create Threat Intel Indicator Microsoft Defender Create a threat intelligence indicator in Microsoft Defender with specified action and active status using Microsoft Graph API. ### Endpoint - **URL:** `/beta/security/tiIndicators` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `action` | string | Optional | The action to apply if the indicator is matched from within the targetProduct security tool. Possible values are `unknown`, `allow`, `block` or `alert` | | `activityGroupNames` | array | Optional | The cyber threat intelligence name(s) for the parties responsible for the malicious activity covered by the threat indicator | | `additionalInformation` | string | Optional | A catchall area into which extra data from the indicator not covered by the other tiIndicator properties may be placed. Data placed into additionalInformation will typically not be utilized by the targetProduct security tool | | `azureTenantId` | string | Optional | Stamped by the system when the indicator is ingested. The Azure Active Directory tenant id of submitting client | | `confidence` | number | Optional | An integer representing the confidence the data within the indicator accurately identifies malicious behavior. Acceptable values are 0-100 with 100 being the highest. | | `description` | string | Optional | Brief description (100 characters or less) of the threat represented by the indicator | | `diamondModel` | string | Optional | The area of the Diamond Model in which this indicator exists. Possible values are `unknown`, `adversary`, `capability`, `infrastructure` and `victim` | | `domainName` | string | Optional | Domain name associated with this indicator. Should be of the format subdomain.domain.topleveldomain (For example, baddomain.domain.net) | | `emailEncoding` | string | Optional | The type of text encoding used in the email | | `emailLanguage` | string | Optional | The Language of the email | | `emailRecipient` | string | Optional | Email Recipient Address | | `emailSenderAddress` | string | Optional | Email Sender Address | | `emailSenderName` | string | Optional | Email Sender Name | | `emailSourceDomain` | string | Optional | Parameter for Create Threat Intel Indicator Microsoft Defender | | `emailSourceIpAddress` | string | Optional | Parameter for Create Threat Intel Indicator Microsoft Defender | | `emailSubject` | string | Optional | Parameter for Create Threat Intel Indicator Microsoft Defender | | `emailXMailer` | string | Optional | X-Mailer value used in the email | | `expirationDateTime` | string | Optional | The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time | | `externalId` | string | Optional | Unique identifier | | `fileCompileDateTime` | string | Optional | The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time | | `fileCreatedDateTime` | string | Optional | The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time | | `fileHashType` | string | Optional | The type of hash stored in fileHashValue. Possible values are `unknown`, `sha1`, `sha256`, `md5`, `authenticodeHash256`, `lsHash`, `ctph` | | `fileHashValue` | string | Optional | Value for the parameter | | `fileMutexName` | string | Optional | Name of the resource | | `fileName` | string | Optional | Name of the resource | ### Input Example `{"action":"string","activityGroupNames":["string"],"additionalInformation":"string","azureTenantId":"string","confidence":123,"description":"string","diamondModel":"string","domainName":"Example Name","emailEncoding":"string","emailLanguage":"string","emailRecipient":"string","emailSenderAddress":"string","emailSenderName":"Example Name","emailSourceDomain":"string","emailSourceIpAddress":"string","emailSubject":"string","emailXMailer":"string","expirationDateTime":"string","externalId":"string","fileCompileDateTime":"string","fileCreatedDateTime":"string","fileHashType":"string","fileHashValue":"string","fileMutexName":"Example Name","fileName":"Example Name","filePacker":"string","filePath":"string","fileSize":123,"fileType":"string","isActive":"string","killChain":["string"],"knownFalsePositives":"string","lastReportedDateTime":"string","malwareFamilyNames":"Example Name","networkCidrBlock":"string","networkDestinationAsn":123,"networkDestinationCidrBlock":"string","networkDestinationIPv4":"string","networkDestinationIPv6":"string","networkDestinationPort":123,"networkIPv4":"string","networkIPv6":"string","networkPort":123,"networkProtocol":123,"networkSourceAsn":123,"networkSourceCidrBlock":"string","networkSourceIPv4":"string","networkSourceIPv6":"string","networkSourcePort":123,"passiveOnly":"string"}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------ | -------- | ----------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `id` | string | Unique identifier | | `azureTenantId` | string | Unique identifier | | `action` | string | Output field: action | | `additionalInformation` | object | Output field: additionalInformation | | `activityGroupNames` | array | Name of the resource | | `activityGroupNames.file_name` | string | Name of the resource | | `activityGroupNames.file` | string | Name of the resource | | `confidence` | object | Unique identifier | | `description` | string | Output field: description | | `diamondModel` | object | Output field: diamondModel | | `emailEncoding` | object | Output field: emailEncoding | | `emailLanguage` | object | Output field: emailLanguage | | `emailRecipient` | object | Output field: emailRecipient | | `emailSenderAddress` | object | Output field: emailSenderAddress | | `emailSenderName` | object | Name of the resource | | `emailSourceDomain` | object | Output field: emailSourceDomain | | `emailSourceIpAddress` | object | Output field: emailSourceIpAddress | | `emailSubject` | object | Output field: emailSubject | | `emailXMailer` | object | Output field: emailXMailer | | `expirationDateTime` | string | Time value | | `externalId` | object | Unique identifier | | `fileCompileDateTime` | object | Time value | ### Output Example `{"@odata.context":"string","id":"12345678-1234-1234-1234-123456789abc","azureTenantId":"string","action":"string","additionalInformation":{},"activityGroupNames":[{"file_name":"Example Name","file":"string"}],"confidence":{},"description":"string","diamondModel":{},"emailEncoding":{},"emailLanguage":{},"emailRecipient":{},"emailSenderAddress":{},"emailSenderName":{},"emailSourceDomain":{}}` ## Get eDiscovery Case Retrieve details and related information for a specific eDiscovery case in Microsoft Graph API using the provided ediscoveryCaseId. ### Endpoint - **URL:** `/v1.0/security/cases/ediscoveryCases/{{ediscoveryCaseId}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------- | -------- | ------------ | ------------------ | | `path_parameters.ediscoveryCaseId` | string | Required | eDiscovery Case ID | ### Input Example `{"path_parameters":{"ediscoveryCaseId":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `description` | string | Output field: description | | `lastModifiedDateTime` | string | Time value | | `status` | string | Status value | | `closedDateTime` | object | Time value | | `externalId` | string | Unique identifier | | `id` | string | Unique identifier | | `displayName` | string | Name of the resource | | `createdDateTime` | string | Time value | | `lastModifiedBy` | object | Output field: lastModifiedBy | | `closedBy` | object | Output field: closedBy | ### Output Example `{"@odata.context":"https://graph.microsoft.com/beta/$metadata#security/cases/ediscoveryCases/$entit...","description":"","lastModifiedDateTime":"2022-05-22T18:36:46.597Z","status":"active","closedDateTime":null,"externalId":"324516","id":"22aa2acd-7554-4330-9ba9-ce20014aaae4","displayName":"CONTOSO LITIGATION-005","createdDateTime":"2022-05-22T18:36:46.597Z","lastModifiedBy":null,"closedBy":null}` ## List eDiscovery Cases Retrieve a comprehensive list of eDiscoveryCase objects and their properties from the Microsoft Graph API. ### Endpoint - **URL:** `/v1.0/security/cases/ediscoveryCases` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `parameters.filter` | string | Optional | Use the `filter` query parameter to retrieve just a subset of a collection. For guidance on using `filter`, see [https://learn.microsoft.com/en-us/graph/filter-query-parameter](https://learn.microsoft.com/en-us/graph/filter-query-parameter) | | `parameters.orderBy` | string | Optional | Use the `orderby` query parameter to specify the sort order of the items returned from Microsoft Graph. | | `parameters.top` | number | Optional | Sets the page size of results. | ### Input Example `{"parameters":{"filter":"string","orderBy":"string","top":123}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `@odata.count` | number | Response data | | `value` | array | Value for the parameter | | `value.description` | string | Value for the parameter | | `value.lastModifiedDateTime` | string | Value for the parameter | | `value.status` | string | Status value | | `value.closedDateTime` | object | Value for the parameter | | `value.externalId` | string | Unique identifier | | `value.id` | string | Unique identifier | | `value.displayName` | string | Name of the resource | | `value.createdDateTime` | string | Value for the parameter | | `value.lastModifiedBy` | object | Value for the parameter | | `value.lastModifiedBy.application` | object | Value for the parameter | | `value.lastModifiedBy.user` | object | Value for the parameter | | `value.lastModifiedBy.user.id` | object | Unique identifier | | `value.lastModifiedBy.user.displayName` | string | Name of the resource | | `value.closedBy` | object | Value for the parameter | | `value.closedBy.application` | object | Value for the parameter | | `value.closedBy.user` | object | Value for the parameter | | `value.closedBy.user.id` | object | Unique identifier | | `value.closedBy.user.displayName` | string | Name of the resource | ### Output Example `{"@odata.context":"https://graph.microsoft.com/beta/$metadata#security/cases/ediscoveryCases","@odata.count":22,"value":[{"description":"","lastModifiedDateTime":"2022-05-19T23:30:41.23Z","status":"active","closedDateTime":null,"externalId":"","id":"60f86305-ac3e-408b-baa2-ea585dd8b0c0","displayName":"My case 1","createdDateTime":"2022-05-19T23:30:41.23Z","lastModifiedBy":{},"closedBy":{}},{"description":"","lastModifiedDateTime":"2022-05-18T23:05:07.82Z","status":"active","closedDateTime":null,...` ## List eDiscovery Case Custodians Retrieve custodian objects and their properties for a specified eDiscovery case ID using Microsoft Graph API. ### Endpoint - **URL:** `/v1.0/security/cases/ediscoveryCases/{{ediscoveryCaseId}}/custodians` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------- | -------- | ------------ | ------------------ | | `path_parameters.ediscoveryCaseId` | string | Required | eDiscovery Case ID | ### Input Example `{"path_parameters":{"ediscoveryCaseId":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `@odata.count` | number | Response data | | `value` | array | Value for the parameter | | `value.status` | string | Status value | | `value.holdStatus` | string | Status value | | `value.createdDateTime` | string | Value for the parameter | | `value.lastModifiedDateTime` | string | Value for the parameter | | `value.releasedDateTime` | object | Value for the parameter | | `value.id` | string | Unique identifier | | `value.displayName` | string | Name of the resource | | `value.email` | string | Value for the parameter | | `value.acknowledgedDateTime` | string | Value for the parameter | ### Output Example `{"@odata.context":"https://graph.microsoft.com/beta/$metadata#security/cases/ediscoveryCases('b0073...","@odata.count":1,"value":[{"status":"active","holdStatus":"notApplied","createdDateTime":"2022-05-23T00:58:19.0702426Z","lastModifiedDateTime":"2022-05-23T00:58:19.0702436Z","releasedDateTime":null,"id":"0053a61a3b6c42738f7606791716a22a","displayName":"Alex Wilber","email":"AlexW@M365x809305.OnMicrosoft.com","acknowledgedDateTime":"0001-01-01T00:00:00Z"}]}` ## List eDiscovery Case Operations Retrieve operation objects and their properties for a specified eDiscovery case in Microsoft Graph API using the provided case ID. ### Endpoint - **URL:** `/v1.0/security/cases/ediscoveryCases/{{ediscoveryCaseId}}/operations` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------- | -------- | ------------ | ------------------ | | `path_parameters.ediscoveryCaseId` | string | Required | eDiscovery Case ID | ### Input Example `{"path_parameters":{"ediscoveryCaseId":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `value` | array | Value for the parameter | | `value.createdDateTime` | string | Value for the parameter | | `value.completedDateTime` | string | Value for the parameter | | `value.percentProgress` | number | Value for the parameter | | `value.status` | string | Status value | | `value.action` | string | Value for the parameter | | `value.id` | string | Unique identifier | | `value.createdBy` | object | Value for the parameter | | `value.createdBy.application` | object | Value for the parameter | | `value.createdBy.user` | object | Value for the parameter | | `value.createdBy.user.id` | string | Unique identifier | | `value.createdBy.user.displayName` | object | Name of the resource | | `value.createdBy.user.userPrincipalName` | object | Name of the resource | ### Output Example `{"@odata.context":"https://graph.microsoft.com/beta/$metadata#security/cases/ediscoveryCases('b0073...","value":[{"createdDateTime":"2022-05-23T01:09:36.834501Z","completedDateTime":"2022-05-23T01:10:08.8710734Z","percentProgress":100,"status":"succeeded","action":"holdUpdate","id":"1ab699d7e53d46de944144c4a650d66f","createdBy":{}}]}` ## List eDiscovery Case Review Sets Retrieve all eDiscovery review sets linked to a specified case in Microsoft Graph API using the required ediscoveryCaseId path parameter. ### Endpoint - **URL:** `/v1.0/security/cases/ediscoveryCases/{{ediscoveryCaseId}}/reviewSets` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------- | -------- | ------------ | ------------------ | | `path_parameters.ediscoveryCaseId` | string | Required | eDiscovery Case ID | ### Input Example `{"path_parameters":{"ediscoveryCaseId":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `value` | array | Value for the parameter | | `value.displayName` | string | Name of the resource | | `value.id` | string | Unique identifier | | `value.createdDateTime` | string | Value for the parameter | | `value.createdBy` | object | Value for the parameter | | `value.createdBy.application` | object | Value for the parameter | | `value.createdBy.user` | object | Value for the parameter | | `value.createdBy.user.id` | string | Unique identifier | | `value.createdBy.user.displayName` | string | Name of the resource | | `value.createdBy.user.userPrincipalName` | string | Name of the resource | ### Output Example `{"@odata.context":"https://graph.microsoft.com/beta/$metadata#security/cases/ediscoveryCases('b0073...","value":[{"displayName":"My review set","id":"025852b3-5062-4169-9609-9861a6fe2fe5","createdDateTime":"2022-05-23T16:26:08.7203883Z","createdBy":{}}]}` ## List eDiscovery Case Searches Retrieve all eDiscovery search resources associated with a specific case in Microsoft Graph API by providing the required ediscoveryCaseId path parameter. ### Endpoint - **URL:** `/v1.0/security/cases/ediscoveryCases/{{ediscoveryCaseId}}/searches` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------- | -------- | ------------ | ------------------ | | `path_parameters.ediscoveryCaseId` | string | Required | eDiscovery Case ID | ### Input Example `{"path_parameters":{"ediscoveryCaseId":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `value` | array | Value for the parameter | | `value.dataSourceScopes` | string | Response data | | `value.description` | string | Value for the parameter | | `value.lastModifiedDateTime` | string | Value for the parameter | | `value.contentQuery` | string | Value for the parameter | | `value.id` | string | Unique identifier | | `value.displayName` | string | Name of the resource | | `value.createdDateTime` | string | Value for the parameter | | `value.lastModifiedBy` | object | Value for the parameter | | `value.createdBy` | object | Value for the parameter | | `value.createdBy.user` | object | Value for the parameter | | `value.createdBy.user.id` | string | Unique identifier | | `value.createdBy.user.displayName` | string | Name of the resource | | `value.createdBy.user.userPrincipalName` | string | Name of the resource | | `value.createdBy.application` | object | Value for the parameter | | `value.createdBy.application.id` | string | Unique identifier | | `value.createdBy.application.displayName` | string | Name of the resource | ### Output Example `{"@odata.context":"https://graph.microsoft.com/beta/$metadata#security/cases/ediscoveryCases('b0073...","value":[{"dataSourceScopes":"none","description":"My first search","lastModifiedDateTime":"2022-05-23T04:38:07.5787454Z","contentQuery":"(Author=\"edison\")","id":"46867792-68e6-41db-9cd0-f651c2290d91","displayName":"My search 2","createdDateTime":"2022-05-23T04:38:07.5787454Z","lastModifiedBy":null,"createdBy":{}},{"dataSourceScopes":"none","description":"My first search","lastModifiedDateTi...` ## List eDiscovery Case Tags Retrieve all eDiscoveryReviewTag objects for a specified case in Microsoft Graph API using the ediscoveryCaseId path parameter. ### Endpoint - **URL:** `/v1.0/security/cases/ediscoveryCases/{{ediscoveryCaseId}}/tags` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------- | -------- | ------------ | ------------------ | | `path_parameters.ediscoveryCaseId` | string | Required | eDiscovery Case ID | ### Input Example `{"path_parameters":{"ediscoveryCaseId":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `@odata.count` | number | Response data | | `value` | array | Value for the parameter | | `value.displayName` | string | Name of the resource | | `value.lastModifiedDateTime` | string | Value for the parameter | | `value.childSelectability` | string | Value for the parameter | | `value.id` | string | Unique identifier | | `value.createdBy` | object | Value for the parameter | | `value.createdBy.user` | object | Value for the parameter | | `value.createdBy.user.id` | string | Unique identifier | | `value.createdBy.user.displayName` | string | Name of the resource | | `value.createdBy.user.userPrincipalName` | string | Name of the resource | | `value.description` | string | Value for the parameter | ### Output Example `{"@odata.context":"https://graph.microsoft.com/beta/$metadata#security/cases/ediscoveryCases('58399...","@odata.count":5,"value":[{"displayName":"My tag","lastModifiedDateTime":"2022-05-23T19:41:01.7432683Z","childSelectability":"Many","id":"062de822f17a4a2e9b833aa3f6c37108","createdBy":{"user":{"id":"c25c3914-f9f7-43ee-9cba-a25377e0cec6","displayName":"MOD Administrator","userPrincipalName":"admin@M365x809305.onmicrosoft.com"}}},{"displayName":"Responsive","description":"","lastModifiedDateTime...` ## Get Hunting Schema Retrieve the Microsoft Defender XDR advanced hunting schema, including available tables, columns, and functions for building security queries. ### Endpoint - **URL:** `/beta/security/getHuntingSchema` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------------------- | -------- | -------------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `tables` | array | Advanced hunting tables the user is authorized to query. | | `tables.name` | string | Name of the resource | | `tables.description` | string | Output field: tables.description | | `tables.columns` | array | Output field: tables.columns | | `tables.columns.name` | string | Name of the resource | | `tables.columns.dataType` | string | Response data | | `tables.columns.description` | string | Output field: tables.columns.description | | `functions` | object | Built-in and saved advanced hunting functions available to the user. | | `functions.builtInFunctions` | array | Output field: functions.builtInFunctions | | `functions.builtInFunctions.huntingFunctionId` | number | Unique identifier | | `functions.builtInFunctions.name` | string | Name of the resource | | `functions.builtInFunctions.path` | string | Output field: functions.builtInFunctions.path | | `functions.builtInFunctions.documentation` | string | Output field: functions.builtInFunctions.documentation | | `functions.builtInFunctions.inputParameters` | array | Parameters for the Get Hunting Schema action | | `functions.builtInFunctions.inputParameters.name` | string | Parameters for the Get Hunting Schema action | | `functions.builtInFunctions.inputParameters.cslType` | string | Parameters for the Get Hunting Schema action | | `functions.builtInFunctions.inputParameters.defaultValue` | string | Parameters for the Get Hunting Schema action | | `functions.builtInFunctions.outputColumns` | array | Output field: functions.builtInFunctions.outputColumns | | `functions.builtInFunctions.outputColumns.name` | string | Name of the resource | | `functions.builtInFunctions.outputColumns.dataType` | string | Response data | | `functions.builtInFunctions.outputColumns.description` | string | Output field: functions.builtInFunctions.outputColumns.description | | `functions.savedFunctions` | array | Output field: functions.savedFunctions | | `functions.savedFunctions.huntingFunctionId` | number | Unique identifier | ### Output Example `{"tables":[{"name":"Example Name","description":"string","columns":[]}],"functions":{"builtInFunctions":[{}],"savedFunctions":[{}]}}` ## Get Incident Retrieve detailed information and related data for a specific incident by providing its incidentId from Microsoft Graph API. ### Endpoint - **URL:** `/v1.0/security/incidents/{{incidentId}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | --------------- | | `path_parameters.incidentId` | string | Required | Incident ID | ### Input Example `{"path_parameters":{"incidentId":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.type` | string | Response data | | `id` | string | Unique identifier | | `incidentWebUrl` | string | URL endpoint for the request | | `redirectIncidentId` | object | Unique identifier | | `displayName` | string | Name of the resource | | `tenantId` | string | Unique identifier | | `createdDateTime` | string | Time value | | `lastUpdateDateTime` | string | Time value | | `assignedTo` | string | Output field: assignedTo | | `classification` | string | Output field: classification | | `determination` | string | Output field: determination | | `status` | string | Status value | | `severity` | string | Output field: severity | | `customTags` | array | Output field: customTags | | `comments` | array | Output field: comments | | `comments.comment` | string | Output field: comments.comment | | `comments.createdBy` | string | Output field: comments.createdBy | | `comments.createdTime` | string | Time value | ### Output Example `{"@odata.type":"#microsoft.graph.incident","id":"2972395","incidentWebUrl":"https://security.microsoft.com/incidents/2972395?tid=12f988bf-16f1-11af-11ab-1d7...","redirectIncidentId":null,"displayName":"Multi-stage incident involving Initial access & Command and control on multiple ...","tenantId":"b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c","createdDateTime":"2021-08-13T08:43:35.5533333Z","lastUpdateDateTime":"2021-09-30T09:35:45.1133333Z","assignedTo":"KaiC@contoso.onmicrosoft.com","classification":"...` ## Get Repeat Offenders Retrieve a list of tenant users compromised multiple times in simulation and training campaigns using the Microsoft Graph API. ### Endpoint - **URL:** `/V1.0/reports/security/getAttackSimulationRepeatOffenders` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `parameters.filter` | string | Optional | Use the `filter` query parameter to retrieve just a subset of a collection. For guidance on using `filter`, see [https://learn.microsoft.com/en-us/graph/filter-query-parameter](https://learn.microsoft.com/en-us/graph/filter-query-parameter) | | `parameters.orderBy` | string | Optional | Use the `orderby` query parameter to specify the sort order of the items returned from Microsoft Graph. | | `parameters.top` | number | Optional | Sets the page size of results. | ### Input Example `{"parameters":{"filter":"string","orderBy":"string","top":123}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `@odata.nextLink` | string | Response data | | `value` | array | Value for the parameter | | `value.repeatOffenceCount` | number | Value for the parameter | | `value.attackSimulationUser` | object | Value for the parameter | | `value.attackSimulationUser.userId` | string | Unique identifier | | `value.attackSimulationUser.displayName` | string | Name of the resource | | `value.attackSimulationUser.email` | string | Value for the parameter | ### Output Example `{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#Collection(microsoft.graph.attackSimu...","@odata.nextLink":"https://graph.microsoft.com/v1.0/reports/security/getAttackSimulationRepeatOffen...","value":[{"repeatOffenceCount":5,"attackSimulationUser":{}},{"repeatOffenceCount":638,"attackSimulationUser":{}}]}` ## Get Simulation Retrieve detailed information about a specific attack simulation campaign in Microsoft Graph API using the unique simulationId. ### Endpoint - **URL:** `/V1.0/security/attackSimulation/simulations/{{simulationId}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | --------------- | | `path_parameters.simulationId` | string | Required | Simulation ID | ### Input Example `{"path_parameters":{"simulationId":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.type` | string | Response data | | `id` | string | Unique identifier | | `incidentWebUrl` | string | URL endpoint for the request | | `redirectIncidentId` | object | Unique identifier | | `displayName` | string | Name of the resource | | `tenantId` | string | Unique identifier | | `createdDateTime` | string | Time value | | `lastUpdateDateTime` | string | Time value | | `assignedTo` | string | Output field: assignedTo | | `classification` | string | Output field: classification | | `determination` | string | Output field: determination | | `status` | string | Status value | | `severity` | string | Output field: severity | | `customTags` | array | Output field: customTags | | `comments` | array | Output field: comments | | `comments.comment` | string | Output field: comments.comment | | `comments.createdBy` | string | Output field: comments.createdBy | | `comments.createdTime` | string | Time value | ### Output Example `{"@odata.type":"#microsoft.graph.incident","id":"2972395","incidentWebUrl":"https://security.microsoft.com/incidents/2972395?tid=12f988bf-16f1-11af-11ab-1d7...","redirectIncidentId":null,"displayName":"Multi-stage incident involving Initial access & Command and control on multiple ...","tenantId":"b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c","createdDateTime":"2021-08-13T08:43:35.5533333Z","lastUpdateDateTime":"2021-09-30T09:35:45.1133333Z","assignedTo":"KaiC@contoso.onmicrosoft.com","classification":"...` ## Get Simulation Automation Retrieve detailed information about a specific attack simulation automation in Microsoft Graph API using the provided simulationId. ### Endpoint - **URL:** `/V1.0/security/attackSimulation/simulationAutomations/{{simulationId}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | --------------- | | `path_parameters.simulationId` | string | Required | Simulation ID | ### Input Example `{"path_parameters":{"simulationId":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | ---------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.type` | string | Response data | | `id` | string | Unique identifier | | `displayName` | string | Name of the resource | | `description` | string | Output field: description | | `status` | string | Status value | | `createdDateTime` | string | Time value | | `createdBy` | object | Output field: createdBy | | `createdBy.id` | string | Unique identifier | | `createdBy.displayName` | string | Name of the resource | | `createdBy.email` | string | Output field: createdBy.email | | `lastModifiedDateTime` | string | Time value | | `lastModifiedBy` | object | Output field: lastModifiedBy | | `lastModifiedBy.id` | string | Unique identifier | | `lastModifiedBy.displayName` | string | Name of the resource | | `lastModifiedBy.email` | string | Output field: lastModifiedBy.email | | `lastRunDateTime` | string | Time value | | `nextRunDateTime` | string | Time value | ### Output Example `{"@odata.type":"#microsoft.graph.simulationAutomation","id":"fbad62b0-b32d-b6ac-9f48-d84bbea08f96","displayName":"Reed Flores","description":"Sample Simulation Automation Description","status":"running","createdDateTime":"2022-01-01T01:01:01.01Z","createdBy":{"id":"99af58b9-ef1a-412b-a581-cb42fe8c8e21","displayName":"Reed Flores","email":"reed@contoso.com"},"lastModifiedDateTime":"2022-01-01T01:01:01.01Z","lastModifiedBy":{"id":"99af58b9-ef1a-412b-a581-cb42fe8c8e21","displayName":"Reed Flores","...` ## Get Simulation Coverage for Users Retrieve training coverage details for tenant users involved in attack simulation and training campaigns using Microsoft Graph API. ### Endpoint - **URL:** `/V1.0/reports/security/getAttackSimulationSimulationUserCoverage` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `parameters.filter` | string | Optional | Use the `filter` query parameter to retrieve just a subset of a collection. For guidance on using `filter`, see [https://learn.microsoft.com/en-us/graph/filter-query-parameter](https://learn.microsoft.com/en-us/graph/filter-query-parameter) | | `parameters.orderBy` | string | Optional | Use the `orderby` query parameter to specify the sort order of the items returned from Microsoft Graph. | | `parameters.top` | number | Optional | Sets the page size of results. | ### Input Example `{"parameters":{"filter":"string","orderBy":"string","top":123}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `@odata.nextLink` | string | Response data | | `value` | array | Value for the parameter | | `value.simulationCount` | object | Value for the parameter | | `value.latestSimulationDateTime` | object | Value for the parameter | | `value.clickCount` | object | Value for the parameter | | `value.compromisedCount` | object | Value for the parameter | | `value.attackSimulationUser` | object | Value for the parameter | | `value.attackSimulationUser.userId` | string | Unique identifier | | `value.attackSimulationUser.displayName` | string | Name of the resource | | `value.attackSimulationUser.email` | string | Value for the parameter | ### Output Example `{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#Collection(microsoft.graph.attackSimu...","@odata.nextLink":"https://graph.microsoft.com/v1.0/reports/security/getAttackSimulationSimulationU...","value":[{"simulationCount":1063,"latestSimulationDateTime":"2022-02-10T10:45:50Z","clickCount":0,"compromisedCount":0,"attackSimulationUser":{}},{"simulationCount":null,"latestSimulationDateTime":null,"clickCount":null,"compromisedCount":null,"attackSimulationUser":{}}]}` ## Get Simulation Overview Retrieve an overview of a specific attack simulation and training campaign in Microsoft Graph API using the required simulationId path parameter. ### Endpoint - **URL:** `/V1.0/security/attackSimulation/simulations/{{simulationId}}/report/overview` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | --------------- | | `path_parameters.simulationId` | string | Required | Simulation ID | ### Input Example `{"path_parameters":{"simulationId":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `value` | array | Value for the parameter | | `value.@odata.type` | string | Response data | | `value.id` | string | Unique identifier | | `value.displayName` | string | Name of the resource | | `value.description` | string | Value for the parameter | | `value.status` | string | Status value | | `value.createdDateTime` | string | Value for the parameter | | `value.createdBy` | object | Value for the parameter | | `value.createdBy.id` | string | Unique identifier | | `value.createdBy.displayName` | string | Name of the resource | | `value.createdBy.email` | string | Value for the parameter | | `value.lastModifiedDateTime` | string | Value for the parameter | | `value.lastModifiedBy` | object | Value for the parameter | | `value.lastModifiedBy.id` | string | Unique identifier | | `value.lastModifiedBy.displayName` | string | Name of the resource | | `value.lastModifiedBy.email` | string | Value for the parameter | | `value.lastRunDateTime` | string | Value for the parameter | | `value.nextRunDateTime` | string | Value for the parameter | ### Output Example `{"value":[{"@odata.type":"#microsoft.graph.simulationAutomation","id":"fbad62b0-b32d-b6ac-9f48-d84bbea08f96","displayName":"Reed Flores","description":"Sample Simulation Automation Description","status":"running","createdDateTime":"2022-01-01T01:01:01.01Z","createdBy":{},"lastModifiedDateTime":"2022-01-01T01:01:01.01Z","lastModifiedBy":{},"lastRunDateTime":"2022-01-01T01:01:01.01Z","nextRunDateTime":"2022-01-01T01:01:01.01Z"}]}` ## Get Training Coverage for Users Retrieve a list of tenant users' training coverage in attack simulation and training campaigns using Microsoft Graph API. ### Endpoint - **URL:** `/V1.0/reports/security/getAttackSimulationTrainingUserCoverage` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `parameters.filter` | string | Optional | Use the `filter` query parameter to retrieve just a subset of a collection. For guidance on using `filter`, see [https://learn.microsoft.com/en-us/graph/filter-query-parameter](https://learn.microsoft.com/en-us/graph/filter-query-parameter) | | `parameters.orderBy` | string | Optional | Use the `orderby` query parameter to specify the sort order of the items returned from Microsoft Graph. | | `parameters.top` | number | Optional | Sets the page size of results. | ### Input Example `{"parameters":{"filter":"string","orderBy":"string","top":123}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `@odata.nextLink` | string | Response data | | `value` | array | Value for the parameter | | `value.userTrainings` | array | Value for the parameter | | `value.userTrainings.assignedDateTime` | string | Value for the parameter | | `value.userTrainings.completionDateTime` | string | Value for the parameter | | `value.userTrainings.trainingStatus` | string | Status value | | `value.userTrainings.displayName` | string | Name of the resource | | `value.attackSimulationUser` | object | Value for the parameter | | `value.attackSimulationUser.userId` | string | Unique identifier | | `value.attackSimulationUser.displayName` | object | Name of the resource | | `value.attackSimulationUser.email` | object | Value for the parameter | ### Output Example `{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#Collection(microsoft.graph.attackSimu...","@odata.nextLink":"https://graph.microsoft.com/v1.0/reports/security/getAttackSimulationTrainingUse...","value":[{"userTrainings":[],"attackSimulationUser":{}}]}` ## List Incidents Retrieve and monitor incidents from Microsoft 365 Defender to help manage and track organizational security attacks. ### Endpoint - **URL:** `/v1.0/security/incidents` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.$count` | string | Optional | Retrieves the total count of matching resources. | | `parameters.$skip` | number | Optional | Indexes into a result set. Also used by some APIs to implement paging and can be used together with $top to manually page results. | | `parameters.$top` | number | Optional | Sets the page size of results. | | `parameters.$expand` | string | Optional | Retrieves related resources. | | `parameters.$filter` | string | Optional | Use the `filter` query parameter to retrieve just a subset of a collection. For guidance on using `filter`, see [https://learn.microsoft.com/en-us/graph/filter-query-parameter](https://learn.microsoft.com/en-us/graph/filter-query-parameter). | | `parameters.return_as_turbine_schema` | boolean | Optional | When true, incidents are mapped to normalized Turbine Schema alert objects and returned in the Alerts field. When false, the raw Microsoft Graph API response is returned. | | `parameters.alert_organization` | string | Optional | Optional organization name to include in the Turbine Schema alert. Used only when return\_as\_turbine\_schema is true. | | `parameters.ioc_types` | array | Optional | List of observable types to extract. Supported: ipv4\_public, ipv4\_private, ipv6\_public, ipv6\_private, domain, url, email, sha1, sha256, md5. If omitted or empty, all types are extracted. | | `parameters.domains_ignore_list` | string | Optional | Comma-separated domain values to exclude from observable extraction. | | `parameters.ip_cidr_ignore_list` | string | Optional | Comma-separated CIDR ranges to exclude from observable extraction. | | `parameters.regex_ignore` | string | Optional | Regex pattern — any observable value matching this pattern is excluded. | | `parameters.ioc_ignore_paths` | array | Optional | Array of slash-separated field paths to strip from each alert before extracting observables. Supports wildcards (*) and nested paths. Example: \["processCommandLine", "context/*/ipAddress"]. | ### Input Example `{"parameters":{"$count":"string","$skip":123,"$top":123,"$expand":"string","$filter":"string","return_as_turbine_schema":true,"alert_organization":"string","ioc_types":["string"],"domains_ignore_list":"string","ip_cidr_ignore_list":"string","regex_ignore":"string","ioc_ignore_paths":["string"]}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | ---------------------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `Alerts` | array | Normalized Turbine Schema alerts (when return\_as\_turbine\_schema is true). | | `total_processed` | integer | Number of Turbine Schema alerts returned. | | `value` | array | Value for the parameter | | `value.@odata.type` | string | Response data | | `value.id` | string | Unique identifier | | `value.incidentWebUrl` | string | URL endpoint for the request | | `value.redirectIncidentId` | object | Unique identifier | | `value.tenantId` | string | Unique identifier | | `value.displayName` | string | Name of the resource | | `value.createdDateTime` | string | Value for the parameter | | `value.lastUpdateDateTime` | string | Value for the parameter | | `value.assignedTo` | string | Value for the parameter | | `value.classification` | string | Value for the parameter | | `value.determination` | string | Value for the parameter | | `value.status` | string | Status value | | `value.severity` | string | Value for the parameter | | `value.customTags` | array | Value for the parameter | | `value.comments` | array | Value for the parameter | | `value.comments.comment` | string | Value for the parameter | | `value.comments.createdBy` | string | Value for the parameter | | `value.comments.createdTime` | string | Value for the parameter | ### Output Example `{"value":[{"@odata.type":"#microsoft.graph.security.incident","id":"2972395","incidentWebUrl":"https://security.microsoft.com/incidents/2972395?tid=12f988bf-16f1-11af-11ab-1d7...","redirectIncidentId":null,"tenantId":"b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c","displayName":"Multi-stage incident involving Initial access & Command and control on multiple ...","createdDateTime":"2021-08-13T08:43:35.5533333Z","lastUpdateDateTime":"2021-09-30T09:35:45.1133333Z","assignedTo":"KaiC@contoso.onmicrosoft.com"...` ## List Simulation Automations Retrieve an overview of attack simulation automations and security test settings configured in a Microsoft Graph tenant. ### Endpoint - **URL:** `/V1.0/security/attackSimulation/simulationAutomations` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `parameters.filter` | string | Optional | Use the `filter` query parameter to retrieve just a subset of a collection. For guidance on using `filter`, see [https://learn.microsoft.com/en-us/graph/filter-query-parameter](https://learn.microsoft.com/en-us/graph/filter-query-parameter) | | `parameters.orderBy` | string | Optional | Use the `orderby` query parameter to specify the sort order of the items returned from Microsoft Graph. | | `parameters.top` | number | Optional | Sets the page size of results. | ### Input Example `{"parameters":{"filter":"string","orderBy":"string","top":123}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `value` | array | Value for the parameter | | `value.@odata.type` | string | Response data | | `value.id` | string | Unique identifier | | `value.displayName` | string | Name of the resource | | `value.description` | string | Value for the parameter | | `value.status` | string | Status value | | `value.createdDateTime` | string | Value for the parameter | | `value.createdBy` | object | Value for the parameter | | `value.createdBy.id` | string | Unique identifier | | `value.createdBy.displayName` | string | Name of the resource | | `value.createdBy.email` | string | Value for the parameter | | `value.lastModifiedDateTime` | string | Value for the parameter | | `value.lastModifiedBy` | object | Value for the parameter | | `value.lastModifiedBy.id` | string | Unique identifier | | `value.lastModifiedBy.displayName` | string | Name of the resource | | `value.lastModifiedBy.email` | string | Value for the parameter | | `value.lastRunDateTime` | string | Value for the parameter | | `value.nextRunDateTime` | string | Value for the parameter | ### Output Example `{"value":[{"@odata.type":"#microsoft.graph.simulationAutomation","id":"fbad62b0-b32d-b6ac-9f48-d84bbea08f96","displayName":"Reed Flores","description":"Sample Simulation Automation Description","status":"running","createdDateTime":"2022-01-01T01:01:01.01Z","createdBy":{},"lastModifiedDateTime":"2022-01-01T01:01:01.01Z","lastModifiedBy":{},"lastRunDateTime":"2022-01-01T01:01:01.01Z","nextRunDateTime":"2022-01-01T01:01:01.01Z"}]}` ## List Simulation Users Retrieve users and their actions from an attack simulation campaign in Microsoft Graph API using the specified simulationId. ### Endpoint - **URL:** `/V1.0/security/attackSimulation/simulations/{{simulationId}}/report/simulationUsers` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | --------------- | | `path_parameters.simulationId` | string | Required | Simulation ID | ### Input Example `{"path_parameters":{"simulationId":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `value` | array | Value for the parameter | | `value.isCompromised` | boolean | Value for the parameter | | `value.compromisedDateTime` | string | Value for the parameter | | `value.simulationEvents` | array | Value for the parameter | | `value.simulationEvents.eventName` | string | Name of the resource | | `value.simulationEvents.eventDateTime` | string | Value for the parameter | | `value.simulationEvents.ipAddress` | string | Value for the parameter | | `value.simulationEvents.osPlatformDeviceDetails` | string | Value for the parameter | | `value.simulationEvents.browser` | string | Value for the parameter | | `value.trainingEvents` | array | Value for the parameter | | `value.trainingEvents.displayName` | string | Name of the resource | | `value.trainingEvents.latestTrainingStatus` | string | Status value | | `value.trainingEvents.trainingAssignedProperties` | object | Value for the parameter | | `value.trainingEvents.trainingAssignedProperties.contentDateTime` | string | Value for the parameter | | `value.trainingEvents.trainingAssignedProperties.ipAddress` | string | Value for the parameter | | `value.trainingEvents.trainingAssignedProperties.osPlatformDeviceDetails` | string | Value for the parameter | | `value.trainingEvents.trainingAssignedProperties.browser` | string | Value for the parameter | | `value.trainingEvents.trainingAssignedProperties.potentialScoreImpact` | number | Value for the parameter | | `value.trainingEvents.trainingUpdatedProperties` | object | Value for the parameter | | `value.trainingEvents.trainingUpdatedProperties.contentDateTime` | string | Value for the parameter | | `value.trainingEvents.trainingUpdatedProperties.ipAddress` | string | Value for the parameter | | `value.trainingEvents.trainingUpdatedProperties.osPlatformDeviceDetails` | string | Value for the parameter | | `value.trainingEvents.trainingUpdatedProperties.browser` | string | Value for the parameter | ### Output Example `{"value":[{"isCompromised":true,"compromisedDateTime":"2021-01-01T01:02:01.01Z","simulationEvents":[],"trainingEvents":[],"assignedTrainingsCount":1,"completedTrainingsCount":0,"inProgressTrainingsCount":0,"reportedPhishDateTime":"2021-01-01T01:01:01.01Z","simulationUser":{}}]}` ## List Simulations Retrieve attack simulation campaigns from a Microsoft Graph tenant to assess organizational security preparedness. ### Endpoint - **URL:** `/v1.0/security/attackSimulation/simulations` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `parameters.filter` | string | Optional | Use the `filter` query parameter to retrieve just a subset of a collection. For guidance on using `filter`, see [https://learn.microsoft.com/en-us/graph/filter-query-parameter](https://learn.microsoft.com/en-us/graph/filter-query-parameter) | | `parameters.orderBy` | string | Optional | Use the `orderby` query parameter to specify the sort order of the items returned from Microsoft Graph. | | `parameters.top` | number | Optional | Sets the page size of results. | ### Input Example `{"parameters":{"filter":"string","orderBy":"string","top":123}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `value` | array | Value for the parameter | | `value.id` | string | Unique identifier | | `value.displayName` | string | Name of the resource | | `value.description` | string | Value for the parameter | | `value.attackType` | string | Type of the resource | | `value.attackTechnique` | string | Value for the parameter | | `value.status` | string | Status value | | `value.createdDateTime` | string | Value for the parameter | | `value.createdBy` | object | Value for the parameter | | `value.createdBy.id` | string | Unique identifier | | `value.createdBy.displayName` | string | Name of the resource | | `value.createdBy.email` | string | Value for the parameter | | `value.lastModifiedDateTime` | string | Value for the parameter | | `value.lastModifiedBy` | object | Value for the parameter | | `value.lastModifiedBy.id` | string | Unique identifier | | `value.lastModifiedBy.displayName` | string | Name of the resource | | `value.lastModifiedBy.email` | string | Value for the parameter | | `value.launchDateTime` | string | Value for the parameter | | `value.completionDateTime` | string | Value for the parameter | | `value.isAutomated` | boolean | Value for the parameter | | `value.automationId` | string | Unique identifier | | `value.payloadDeliveryPlatform` | string | Value for the parameter | ### Output Example `{"value":[{"id":"f1b13829-3829-f1b1-2938-b1f12938b1f1","displayName":"Sample Simulation","description":"Sample Simulation Description","attackType":"social","attackTechnique":"credentialHarvesting","status":"scheduled","createdDateTime":"2021-01-01T01:01:01.01Z","createdBy":{},"lastModifiedDateTime":"2021-01-01T01:01:01.01Z","lastModifiedBy":{},"launchDateTime":"2021-01-01T02:01:01.01Z","completionDateTime":"2021-01-07T01:01:01.01Z","isAutomated":false,"automationId":"f1b13829-3829-f1b1-2938-b1f...` ## Run Hunting Query Execute advanced threat hunting queries in Microsoft 365 Defender via Microsoft Graph API to identify and analyze potential security threats. ### Endpoint - **URL:** `/v1.0/security/runHuntingQuery` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------------------------- | | `query` | string | Optional | The hunting query in Kusto Query Language (KQL) | ### Input Example `{"query":"string"}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `schema` | array | Output field: schema | | `schema.Name` | string | Name of the resource | | `schema.Type` | string | Type of the resource | | `results` | array | Result of the operation | | `results.Timestamp` | string | Result of the operation | | `results.FileName` | string | Name of the resource | | `results.InitiatingProcessFileName` | string | Name of the resource | ### Output Example `{"schema":[{"Name":"Timestamp","Type":"DateTime"},{"Name":"FileName","Type":"String"},{"Name":"InitiatingProcessFileName","Type":"String"}],"results":[{"Timestamp":"2020-08-30T06:38:35.7664356Z","FileName":"conhost.exe","InitiatingProcessFileName":"powershell.exe"},{"Timestamp":"2020-08-30T06:38:30.5163363Z","FileName":"conhost.exe","InitiatingProcessFileName":"powershell.exe"}]}` ## Delete Subscription Remove an existing Microsoft Graph API subscription and stop receiving change notifications by specifying the subscriptionId. ### Endpoint - **URL:** `/v1.0/subscriptions/{{subscriptionId}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | ---------------------------------------------------- | | `path_parameters.subscriptionId` | string | Required | The unique identifier of the subscription to delete. | ### Input Example `{"path_parameters":{"subscriptionId":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | ------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `error` | object | Error object when the delete request fails. | | `error.code` | string | Error message if any | | `error.message` | string | Response message | | `error.innerError` | object | Error message if any | | `error.innerError.date` | string | Error message if any | | `error.innerError.request-id` | string | Unique identifier | | `error.innerError.client-request-id` | string | Unique identifier | ### Output Example `{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}` ## Get Subscription Retrieve detailed information for a specific Microsoft Graph API security subscription using the provided subscriptionId. ### Endpoint - **URL:** `/v1.0/subscriptions/{{subscriptionId}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | ------------------------------------------------------ | | `path_parameters.subscriptionId` | string | Required | The unique identifier of the subscription to retrieve. | ### Input Example `{"path_parameters":{"subscriptionId":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------- | -------- | -------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `id` | string | Unique identifier for the subscription. | | `resource` | string | The resource path subscribed to. | | `applicationId` | string | Identifier of the application used to create the subscription. | | `changeType` | string | Type of change that triggers notification. | | `clientState` | string | Secret value sent with each notification for validation. | | `creatorId` | string | User or service principal that created the subscription. | | `encryptionCertificate` | string | Base64-encoded certificate for encrypting resource data. | | `encryptionCertificateId` | string | Custom identifier for the decryption certificate. | | `expirationDateTime` | string | Date and time when the subscription expires (UTC). | | `includeResourceData` | boolean | Whether change notifications include resource data. | | `latestSupportedTlsVersion` | string | TLS version supported by the notification endpoint. | | `lifecycleNotificationUrl` | string | Endpoint for lifecycle notifications. | | `notificationQueryOptions` | string | OData query options for targeting resource state. | | `notificationUrl` | string | Endpoint that receives change notifications. | | `notificationUrlAppId` | string | App ID for validation token generation. | | `notificationContentType` | string | Content type of change notifications. | ### Output Example `{"@odata.context":"string","id":"12345678-1234-1234-1234-123456789abc","resource":"string","applicationId":"string","changeType":"string","clientState":"string","creatorId":"string","encryptionCertificate":"string","encryptionCertificateId":"string","expirationDateTime":"string","includeResourceData":true,"latestSupportedTlsVersion":"string","lifecycleNotificationUrl":"string","notificationQueryOptions":"string","notificationUrl":"string"}` ## Update Subscription Renew or modify a Microsoft Graph API security subscription by updating its expiry time or notification URL using the required subscriptionId. ### Endpoint - **URL:** `/v1.0/subscriptions/{{subscriptionId}}` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | ---------------------------------------------------------- | | `path_parameters.subscriptionId` | string | Required | The unique identifier of the subscription to update. | | `expirationDateTime` | string | Optional | New ISO 8601 date and time when subscription expires. | | `notificationUrl` | string | Optional | New HTTPS endpoint URL for receiving change notifications. | ### Input Example `{"path_parameters":{"subscriptionId":"string"},"expirationDateTime":"string","notificationUrl":"string"}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------- | -------- | -------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier for the subscription. | | `resource` | string | The resource path subscribed to. | | `applicationId` | string | Identifier of the application used to create the subscription. | | `changeType` | string | Type of change that triggers notification. | | `clientState` | string | Secret value sent with each notification for validation. | | `creatorId` | string | User or service principal that created the subscription. | | `encryptionCertificate` | string | Base64-encoded certificate for encrypting resource data. | | `encryptionCertificateId` | string | Custom identifier for the decryption certificate. | | `expirationDateTime` | string | Date and time when the subscription expires (UTC). | | `includeResourceData` | boolean | Whether change notifications include resource data. | | `latestSupportedTlsVersion` | string | TLS version supported by the notification endpoint. | | `lifecycleNotificationUrl` | string | Endpoint for lifecycle notifications. | | `notificationQueryOptions` | string | OData query options for targeting resource state. | | `notificationUrl` | string | Endpoint that receives change notifications. | | `notificationUrlAppId` | string | App ID for validation token generation. | | `notificationContentType` | string | Content type of change notifications. | ### Output Example `{"id":"12345678-1234-1234-1234-123456789abc","resource":"string","applicationId":"string","changeType":"string","clientState":"string","creatorId":"string","encryptionCertificate":"string","encryptionCertificateId":"string","expirationDateTime":"string","includeResourceData":true,"latestSupportedTlsVersion":"string","lifecycleNotificationUrl":"string","notificationQueryOptions":"string","notificationUrl":"string","notificationUrlAppId":"string"}` ## Post Threat Assessment Email Submit an email with recipient and attachments to Microsoft Graph API for security threat analysis and receive detailed assessment results. ### Endpoint - **URL:** `/v1.0/informationProtection/threatAssessmentRequests` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | --------------------------------------------------------------------------------- | | `attachments` | array | Optional | Parameter for Post Threat Assessment Email | | `attachments.contentData` | string | Optional | Response data | | `recipientEmail` | string | Optional | The mail recipient whose policies are used to assess the mail | | `expectedAssessment` | string | Optional | The expected assessment from the ubmitter. Possible values are `block`, `unblock` | | `category` | string | Optional | The threat category. Possible values are `spam`, `phishing`, `malware` | ### Input Example `{"attachments":[{"contentData":"string"}],"recipientEmail":"string","expectedAssessment":"string","category":"string"}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `error` | object | Error message if any | | `error.code` | string | Error message if any | | `error.message` | string | Response message | | `error.innerError` | object | Error message if any | | `error.innerError.date` | string | Error message if any | | `error.innerError.request-id` | string | Unique identifier | | `error.innerError.client-request-id` | string | Unique identifier | ### Output Example `{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}` ## Post Threat Assessment File Submit file attachments to Microsoft Graph API for security threat analysis and receive detailed assessment results. ### Endpoint - **URL:** `/v1.0/informationProtection/threatAssessmentRequests` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | --------------------------------------------------------------------------------- | | `attachments` | array | Optional | Parameter for Post Threat Assessment File | | `attachments.contentData` | string | Optional | Response data | | `attachments.fileName` | string | Optional | Name of the resource | | `expectedAssessment` | string | Optional | The expected assessment from the ubmitter. Possible values are `block`, `unblock` | | `category` | string | Optional | The threat category. Possible values are `spam`, `phishing`, `malware` | ### Input Example `{"attachments":[{"contentData":"string","fileName":"Example Name"}],"expectedAssessment":"string","category":"string"}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `error` | object | Error message if any | | `error.code` | string | Error message if any | | `error.message` | string | Response message | | `error.innerError` | object | Error message if any | | `error.innerError.date` | string | Error message if any | | `error.innerError.request-id` | string | Unique identifier | | `error.innerError.client-request-id` | string | Unique identifier | ### Output Example `{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}` ## Post Threat Assessment URI Submit a message URI and recipient email to Microsoft Graph API for security threat assessment and receive detailed evaluation results. ### Endpoint - **URL:** `/v1.0/informationProtection/threatAssessmentRequests` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------------------------------------------------------------------------- | | `messageUri` | string | Optional | The resource URI of the mail message for assessment | | `recipientEmail` | string | Optional | The mail recipient whose policies are used to assess the mail | | `expectedAssessment` | string | Optional | The expected assessment from the ubmitter. Possible values are `block`, `unblock` | | `category` | string | Optional | The threat category. Possible values are `spam`, `phishing`, `malware` | ### Input Example `{"messageUri":"string","recipientEmail":"string","expectedAssessment":"string","category":"string"}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `error` | object | Error message if any | | `error.code` | string | Error message if any | | `error.message` | string | Response message | | `error.innerError` | object | Error message if any | | `error.innerError.date` | string | Error message if any | | `error.innerError.request-id` | string | Unique identifier | | `error.innerError.client-request-id` | string | Unique identifier | ### Output Example `{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}` ## Post Threat Assessment URL Initiate a security threat assessment on a specified URL using Microsoft Graph API to identify potential risks. Requires the 'url' parameter in the JSON body. ### Endpoint - **URL:** `/v1.0/informationProtection/threatAssessmentRequests` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------------------------------------------------------------------------- | | `url` | string | Optional | The URL string | | `expectedAssessment` | string | Optional | The expected assessment from the ubmitter. Possible values are `block`, `unblock` | | `category` | string | Optional | The threat category. Possible values are `spam`, `phishing`, `malware` | ### Input Example `{"url":"https://example.com/api/resource","expectedAssessment":"string","category":"string"}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `error` | object | Error message if any | | `error.code` | string | Error message if any | | `error.message` | string | Response message | | `error.innerError` | object | Error message if any | | `error.innerError.date` | string | Error message if any | | `error.innerError.request-id` | string | Unique identifier | | `error.innerError.client-request-id` | string | Unique identifier | ### Output Example `{"error":{"code":"string","message":"string","innerError":{"date":"2024-01-01T00:00:00Z","request-id":"string","client-request-id":"string"}}}` ## Create Subscription Create a webhook subscription in Microsoft Graph to receive change notifications for specified resources using changeType, notificationUrl, resource, and expirationDateTime. ### Endpoint - **URL:** `/v1.0/subscriptions` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ---------------------------------------------------------------------------- | | `changeType` | string | Optional | Type of change that triggers notification (e.g., created, updated, deleted). | | `notificationUrl` | string | Optional | HTTPS endpoint URL to receive change notifications. | | `resource` | string | Optional | Resource path to subscribe to (e.g., me/mailFolders('Inbox')/messages). | | `expirationDateTime` | string | Optional | ISO 8601 date and time when subscription expires. | | `clientState` | string | Optional | Optional secret value for validation (max 128 characters). | | `latestSupportedTlsVersion` | string | Optional | TLS version for notifications (e.g., v1\_2). | ### Input Example `{"changeType":"string","notificationUrl":"string","resource":"string","expirationDateTime":"string","clientState":"string","latestSupportedTlsVersion":"string"}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------- | -------- | -------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `id` | string | Unique identifier for the subscription. | | `resource` | string | The resource path subscribed to. | | `applicationId` | string | Identifier of the application used to create the subscription. | | `changeType` | string | Type of change that triggers notification. | | `clientState` | string | Secret value sent with each notification for validation. | | `creatorId` | string | User or service principal that created the subscription. | | `encryptionCertificate` | string | Base64-encoded certificate for encrypting resource data. | | `encryptionCertificateId` | string | Custom identifier for the decryption certificate. | | `expirationDateTime` | string | Date and time when the subscription expires (UTC). | | `includeResourceData` | boolean | Whether change notifications include resource data. | | `latestSupportedTlsVersion` | string | TLS version supported by the notification endpoint. | | `lifecycleNotificationUrl` | string | Endpoint for lifecycle notifications. | | `notificationQueryOptions` | string | OData query options for targeting resource state. | | `notificationUrl` | string | Endpoint that receives change notifications. | | `notificationUrlAppId` | string | App ID for validation token generation. | | `notificationContentType` | string | Content type of change notifications. | ### Output Example `{"@odata.context":"string","id":"12345678-1234-1234-1234-123456789abc","resource":"string","applicationId":"string","changeType":"string","clientState":"string","creatorId":"string","encryptionCertificate":"string","encryptionCertificateId":"string","expirationDateTime":"string","includeResourceData":true,"latestSupportedTlsVersion":"string","lifecycleNotificationUrl":"string","notificationQueryOptions":"string","notificationUrl":"string"}` ## Send Channel Message Send a new chat message to a specified Microsoft Teams channel using the team ID, channel ID, and message body. ### Endpoint - **URL:** `/v1.0/teams/{{team_id}}/channels/{{channel_id}}/messages` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ------------------------------------------------------------------------------- | | `path_parameters.team_id` | string | Required | The unique identifier of the team. | | `path_parameters.channel_id` | string | Required | The unique identifier of the channel. | | `body` | object | Optional | The content of the message. | | `body.content` | string | Required | The content of the message. | | `body.contentType` | string | Optional | The type of the content. Possible values are text and html. | | `subject` | string | Optional | The subject of the chat message, in plaintext. | | `importance` | string | Optional | The importance of the chat message. Possible values are normal, high, urgent. | | `mentions` | array | Optional | List of entities mentioned in the chat message. | | `mentions.id` | integer | Optional | Index of an entity being mentioned. | | `mentions.mentionText` | string | Optional | String used to represent the mention. | | `mentions.mentioned` | object | Optional | The entity (user, application, team, or channel) that was mentioned. | | `attachments` | array | Optional | References to attached objects such as files, tabs, meetings or other messages. | | `attachments.id` | string | Optional | Read-only. Unique id of the attachment. | | `attachments.contentType` | string | Optional | The media type of the content attachment. | | `attachments.contentUrl` | string | Optional | URL for the content of the attachment. | | `attachments.content` | string | Optional | The content of the attachment. | | `attachments.name` | string | Optional | Name of the attachment. | | `attachments.thumbnailUrl` | string | Optional | URL to a thumbnail image that the channel can use. | ### Input Example `{"path_parameters":{"team_id":"string","channel_id":"string"},"body":{"content":"string","contentType":"string"},"subject":"string","importance":"string","mentions":[{"id":123,"mentionText":"string","mentioned":{}}],"attachments":[{"id":"12345678-1234-1234-1234-123456789abc","contentType":"string","contentUrl":"string","content":"string","name":"Example Name","thumbnailUrl":"string"}]}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------- | -------- | ------------------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | | `id` | string | The unique read-only identifier of the message. | | `createdDateTime` | string | Timestamp of when the message was created. | | `lastModifiedDateTime` | string | Timestamp of when the message was last modified. | | `etag` | string | Version number of the chat message. | | `messageType` | string | The type of chat message. | | `subject` | string | The subject of the chat message. | | `importance` | string | The importance of the chat message. | | `locale` | string | Locale of the client used when the message was sent. | | `webUrl` | string | Link to the message in Microsoft Teams. | | `from` | object | Details of the sender of the chat message. | | `body` | object | Plaintext/HTML representation of the content. | | `body.contentType` | string | Request body data | | `body.content` | string | Request body data | | `channelIdentity` | object | If the message was sent in a channel, represents identity of the channel. | | `channelIdentity.teamId` | string | Unique identifier | | `channelIdentity.channelId` | string | Unique identifier | | `attachments` | array | Attached files. | | `mentions` | array | List of entities mentioned in the chat message. | | `reactions` | array | Reactions for this chat message. | ### Output Example `{"response_text":"string","id":"string","createdDateTime":"string","lastModifiedDateTime":"string","etag":"string","messageType":"string","subject":"string","importance":"string","locale":"string","webUrl":"string","from":{},"body":{"contentType":"string","content":"string"},"channelIdentity":{"teamId":"string","channelId":"string"},"attachments":[],"mentions":[]}` ## Send Channel Message Reply Send a reply to an existing message in a Microsoft Teams channel by providing the team ID, channel ID, message ID, and message body. ### Endpoint - **URL:** `/v1.0/teams/{{team_id}}/channels/{{channel_id}}/messages/{{message_id}}/replies` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ------------------------------------------------------------------------------- | | `path_parameters.team_id` | string | Required | The unique identifier of the team. | | `path_parameters.channel_id` | string | Required | The unique identifier of the channel. | | `path_parameters.message_id` | string | Required | The unique identifier of the message to reply to. | | `body` | object | Optional | The content of the reply. | | `body.content` | string | Required | The content of the reply. | | `body.contentType` | string | Optional | The type of the content. Possible values are text and html. | | `subject` | string | Optional | The subject of the chat message, in plaintext. | | `importance` | string | Optional | The importance of the chat message. Possible values are normal, high, urgent. | | `mentions` | array | Optional | List of entities mentioned in the chat message. | | `mentions.id` | integer | Optional | Index of an entity being mentioned. | | `mentions.mentionText` | string | Optional | String used to represent the mention. | | `mentions.mentioned` | object | Optional | The entity (user, application, team, or channel) that was mentioned. | | `attachments` | array | Optional | References to attached objects such as files, tabs, meetings or other messages. | | `attachments.id` | string | Optional | Read-only. Unique id of the attachment. | | `attachments.contentType` | string | Optional | The media type of the content attachment. | | `attachments.contentUrl` | string | Optional | URL for the content of the attachment. | | `attachments.content` | string | Optional | The content of the attachment. | | `attachments.name` | string | Optional | Name of the attachment. | | `attachments.thumbnailUrl` | string | Optional | URL to a thumbnail image that the channel can use. | ### Input Example `{"path_parameters":{"team_id":"string","channel_id":"string","message_id":"string"},"body":{"content":"string","contentType":"string"},"subject":"string","importance":"string","mentions":[{"id":123,"mentionText":"string","mentioned":{}}],"attachments":[{"id":"12345678-1234-1234-1234-123456789abc","contentType":"string","contentUrl":"string","content":"string","name":"Example Name","thumbnailUrl":"string"}]}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------- | -------- | ------------------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | | `id` | string | The unique read-only identifier of the reply message. | | `replyToId` | string | Read-only. ID of the parent chat message or root chat message. | | `createdDateTime` | string | Timestamp of when the message was created. | | `lastModifiedDateTime` | string | Timestamp of when the message was last modified. | | `etag` | string | Version number of the chat message. | | `messageType` | string | The type of chat message. | | `subject` | string | The subject of the chat message. | | `importance` | string | The importance of the chat message. | | `locale` | string | Locale of the client used when the message was sent. | | `webUrl` | string | Link to the message in Microsoft Teams. | | `from` | object | Details of the sender of the chat message. | | `body` | object | Plaintext/HTML representation of the content. | | `body.contentType` | string | Request body data | | `body.content` | string | Request body data | | `channelIdentity` | object | If the message was sent in a channel, represents identity of the channel. | | `channelIdentity.teamId` | string | Unique identifier | | `channelIdentity.channelId` | string | Unique identifier | | `attachments` | array | Attached files. | | `mentions` | array | List of entities mentioned in the chat message. | | `reactions` | array | Reactions for this chat message. | ### Output Example `{"response_text":"string","id":"string","replyToId":"string","createdDateTime":"string","lastModifiedDateTime":"string","etag":"string","messageType":"string","subject":"string","importance":"string","locale":"string","webUrl":"string","from":{},"body":{"contentType":"string","content":"string"},"channelIdentity":{"teamId":"string","channelId":"string"},"attachments":[]}` ## Send Chat Message Send a new message to a specified Microsoft Teams chat by providing the chat ID and message content using Microsoft Graph API. ### Endpoint - **URL:** `/v1.0/chats/{{chat_id}}/messages` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ------------------------------------------------------------------------------- | | `path_parameters.chat_id` | string | Required | The unique identifier of the chat. | | `body` | object | Optional | The content of the message. | | `body.content` | string | Required | The content of the message. | | `body.contentType` | string | Optional | The type of the content. Possible values are text and html. | | `subject` | string | Optional | The subject of the chat message, in plaintext. | | `importance` | string | Optional | The importance of the chat message. Possible values are normal, high, urgent. | | `mentions` | array | Optional | List of entities mentioned in the chat message. | | `mentions.id` | integer | Optional | Index of an entity being mentioned. | | `mentions.mentionText` | string | Optional | String used to represent the mention. | | `mentions.mentioned` | object | Optional | The entity (user, application, team, or channel) that was mentioned. | | `attachments` | array | Optional | References to attached objects such as files, tabs, meetings or other messages. | | `attachments.id` | string | Optional | Read-only. Unique id of the attachment. | | `attachments.contentType` | string | Optional | The media type of the content attachment. | | `attachments.contentUrl` | string | Optional | URL for the content of the attachment. | | `attachments.content` | string | Optional | The content of the attachment. | | `attachments.name` | string | Optional | Name of the attachment. | | `attachments.thumbnailUrl` | string | Optional | URL to a thumbnail image that the channel can use. | ### Input Example `{"path_parameters":{"chat_id":"string"},"body":{"content":"string","contentType":"string"},"subject":"string","importance":"string","mentions":[{"id":123,"mentionText":"string","mentioned":{}}],"attachments":[{"id":"12345678-1234-1234-1234-123456789abc","contentType":"string","contentUrl":"string","content":"string","name":"Example Name","thumbnailUrl":"string"}]}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | ----------------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | | `id` | string | The unique read-only identifier of the message. | | `createdDateTime` | string | Timestamp of when the message was created. | | `lastModifiedDateTime` | string | Timestamp of when the message was last modified. | | `etag` | string | Version number of the chat message. | | `messageType` | string | The type of chat message. | | `subject` | string | The subject of the chat message. | | `importance` | string | The importance of the chat message. | | `locale` | string | Locale of the client used when the message was sent. | | `webUrl` | string | Link to the message in Microsoft Teams. | | `chatId` | string | If the message was sent in a chat, represents the identity of the chat. | | `from` | object | Details of the sender of the chat message. | | `body` | object | Plaintext/HTML representation of the content. | | `body.contentType` | string | Request body data | | `body.content` | string | Request body data | | `attachments` | array | Attached files. | | `mentions` | array | List of entities mentioned in the chat message. | | `reactions` | array | Reactions for this chat message. | ### Output Example `{"response_text":"string","id":"string","createdDateTime":"string","lastModifiedDateTime":"string","etag":"string","messageType":"string","subject":"string","importance":"string","locale":"string","webUrl":"string","chatId":"string","from":{},"body":{"contentType":"string","content":"string"},"attachments":[],"mentions":[]}` ## Move Email Relocate an email to a specified folder in a user's mailbox by providing the email address, email ID, and destination folder ID using Microsoft Graph API. ### Endpoint - **URL:** `/v1.0/users/{{email_address}}/messages/{{email_id}}/move` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ------------------------------------------------------ | | `path_parameters.email_address` | string | Required | The account associated with the email | | `path_parameters.email_id` | string | Required | The ID of the email | | `destinationId` | string | Optional | The destination folder ID, or a well-known folder name | ### Input Example `{"path_parameters":{"email_address":"string","email_id":"string"},"destinationId":"string"}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | ---------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `@odata.etag` | string | Response data | | `id` | string | Unique identifier | | `createdDateTime` | string | Time value | | `lastModifiedDateTime` | string | Time value | | `changeKey` | string | Output field: changeKey | | `categories` | array | Output field: categories | | `categories.file_name` | string | Name of the resource | | `categories.file` | string | Output field: categories.file | | `receivedDateTime` | string | Time value | | `sentDateTime` | string | Time value | | `hasAttachments` | boolean | Output field: hasAttachments | | `internetMessageId` | string | Unique identifier | | `subject` | string | Output field: subject | | `bodyPreview` | string | Request body data | | `importance` | string | Output field: importance | | `parentFolderId` | string | Unique identifier | | `conversationId` | string | Unique identifier | | `conversationIndex` | string | Output field: conversationIndex | | `isDeliveryReceiptRequested` | object | Output field: isDeliveryReceiptRequested | | `isReadReceiptRequested` | boolean | Output field: isReadReceiptRequested | | `isRead` | boolean | Output field: isRead | | `isDraft` | boolean | Output field: isDraft | ### Output Example `{"@odata.context":"string","@odata.etag":"string","id":"12345678-1234-1234-1234-123456789abc","createdDateTime":"string","lastModifiedDateTime":"string","changeKey":"string","categories":[{"file_name":"Example Name","file":"string"}],"receivedDateTime":"string","sentDateTime":"string","hasAttachments":true,"internetMessageId":"string","subject":"string","bodyPreview":"string","importance":"string","parentFolderId":"string"}` ## Reply to Email Send a custom reply to a specific email by specifying the recipient's address and email ID using Microsoft Graph API. ### Endpoint - **URL:** `/v1.0/users/{{email_address}}/messages/{{email_id}}/reply` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.email_address` | string | Required | The account associated with the email | | `path_parameters.email_id` | string | Required | The ID of the email | | `comment` | string | Optional | A comment to include. Can be an empty string. | | `saveToSentItems` | boolean | Optional | Indicates whether to save the message in Sent Items. Specify it only if the parameter is false; default is true. Optional. | | `message` | object | Optional | The message to send | | `message.subject` | string | Optional | The subject of the email | | `message.body` | object | Optional | The body of the message. It can be in HTML or text format. | | `message.body.content` | string | Optional | The content of the item | | `message.body.contentType` | string | Optional | The type of the content. Possible values are text and html. | | `message.sender` | object | Optional | The account that is actually used to generate the message. In most cases, this value is the same as the from property | | `message.sender.address` | string | Required | Response message | | `message.sender.name` | string | Optional | Name of the resource | | `message.replyTo` | array | Optional | The email addresses to use when replying. | | `message.replyTo.emailAddress` | object | Required | Response message | | `message.replyTo.emailAddress.address` | string | Required | Response message | | `message.replyTo.emailAddress.name` | string | Optional | Name of the resource | | `message.toRecipients` | array | Optional | The list of direct recipient objects. | | `message.toRecipients.emailAddress` | object | Required | Response message | | `message.toRecipients.emailAddress.address` | string | Required | Response message | | `message.toRecipients.emailAddress.name` | string | Optional | Name of the resource | | `message.ccRecipients` | array | Optional | The list of CC recipient objects. | | `message.ccRecipients.emailAddress` | object | Required | Response message | | `message.ccRecipients.emailAddress.address` | string | Required | Response message | | `message.ccRecipients.emailAddress.name` | string | Optional | Name of the resource | | `message.bccRecipients` | array | Optional | The list of BCC recipient objects. | ### Input Example `{"path_parameters":{"email_address":"string","email_id":"string"},"comment":"string","saveToSentItems":true,"message":{"subject":"string","body":{"content":"string","contentType":"string"},"sender":{"address":"string","name":"Example Name"},"replyTo":[{"emailAddress":{"address":"string","name":"Example Name"}}],"toRecipients":[{"emailAddress":{"address":"string","name":"Example Name"}}],"ccRecipients":[{"emailAddress":{"address":"string","name":"Example Name"}}],"bccRecipients":[{"emailAddress":{"address":"string","name":"Example Name"}}],"attachments":[{"contentBytes":"string","name":"Example Name","@odata.type":"#microsoft.graph.fileAttachment","contentType":"text/plain"}]}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"response_text":"string"}` ## Retrieve Authentication Methods Retrieve a user's authentication methods from Microsoft Graph API by specifying the user's mail ID as a path parameter. ### Endpoint - **URL:** `/v1.0/users/{{mailid}}/authentication/methods` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | -------------------------------------- | | `path_parameters.mailid` | string | Required | The account associated with the email. | ### Input Example `{"path_parameters":{"mailid":"integrations@swimlaneintegrations.onmicrosoft.com"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | ----------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `@microsoft.graph.tips` | string | Output field: @microsoft.graph.tips | | `value` | array | Value for the parameter | | `value.@odata.type` | string | Response data | | `value.id` | string | Unique identifier | | `value.password` | object | Value for the parameter | | `value.createdDateTime` | string | Value for the parameter | | `value.secretKey` | object | Value for the parameter | ### Output Example `{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#users('integrations%40swimlaneintegra...","@microsoft.graph.tips":"Use $select to choose only the properties your app needs, as this can lead to pe...","value":[{"@odata.type":"#microsoft.graph.passwordAuthenticationMethod","id":"28c10230-6103-485e-b985-444c60001490","password":null,"createdDateTime":"2021-12-15T01:31:09Z"},{"@odata.type":"#microsoft.graph.softwareOathAuthenticationMethod","id":"c03db085-34e7-47bc-b7d6-b54069b6042f","...` ## Revoke Signin Sessions Invalidate all refresh tokens and browser session cookies for a user to enforce secure sign-out using Microsoft Graph API. Requires the user's ID as a path parameter. ### Endpoint - **URL:** `v1.0/users/{{id}}/revokeSignInSessions` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------- | | `path_parameters.id` | string | Required | User ID | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `value` | boolean | Value for the parameter | ### Output Example `{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#Edm.Boolean","value":true}` ## Send Email Send an email to a specified recipient by providing the recipient's email address and message content using Microsoft Graph API. ### Endpoint - **URL:** `/v1.0/users/{{email_address}}/sendMail` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.email_address` | string | Required | The account associated with the email | | `saveToSentItems` | boolean | Optional | Indicates whether to save the message in Sent Items. Specify it only if the parameter is false; default is true. Optional. | | `message` | object | Optional | The message to send | | `message.subject` | string | Optional | The subject of the email | | `message.body` | object | Optional | The body of the message. It can be in HTML or text format. | | `message.body.content` | string | Optional | The content of the item | | `message.body.contentType` | string | Optional | The type of the content. Possible values are text and html. | | `message.replyTo` | array | Optional | The email addresses to use when replying. | | `message.replyTo.emailAddress` | object | Required | Response message | | `message.replyTo.emailAddress.address` | string | Required | Response message | | `message.replyTo.emailAddress.name` | string | Optional | Name of the resource | | `message.toRecipients` | array | Required | The list of direct recipient objects. | | `message.toRecipients.emailAddress` | object | Required | Response message | | `message.toRecipients.emailAddress.address` | string | Required | Response message | | `message.toRecipients.emailAddress.name` | string | Optional | Name of the resource | | `message.ccRecipients` | array | Optional | The list of CC recipient objects. | | `message.ccRecipients.emailAddress` | object | Required | Response message | | `message.ccRecipients.emailAddress.address` | string | Required | Response message | | `message.ccRecipients.emailAddress.name` | string | Optional | Name of the resource | | `message.bccRecipients` | array | Optional | The list of BCC recipient objects. | | `message.bccRecipients.emailAddress` | object | Required | Response message | | `message.bccRecipients.emailAddress.address` | string | Required | Response message | | `message.bccRecipients.emailAddress.name` | string | Optional | Name of the resource | | `message.attachments` | array | Optional | Items attached to this email | | `message.attachments.contentBytes` | string | Optional | Response content | ### Input Example `{"path_parameters":{"email_address":"string"},"saveToSentItems":true,"message":{"subject":"string","body":{"content":"string","contentType":"string"},"replyTo":[{"emailAddress":{"address":"string","name":"Example Name"}}],"toRecipients":[{"emailAddress":{"address":"string","name":"Example Name"}}],"ccRecipients":[{"emailAddress":{"address":"string","name":"Example Name"}}],"bccRecipients":[{"emailAddress":{"address":"string","name":"Example Name"}}],"attachments":[{"contentBytes":"string","name":"Example Name","@odata.type":"#microsoft.graph.fileAttachment","contentType":"text/plain"}]}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"response_text":"string"}` ## Send Email with Attachments Data Send a custom email with attachments to a specified recipient using Microsoft Graph API. Requires the recipient's email address and message content. ### Endpoint - **URL:** `/v1.0/users/{{email_address}}/sendMail` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.email_address` | string | Required | The account associated with the email | | `saveToSentItems` | boolean | Optional | Indicates whether to save the message in Sent Items. Specify it only if the parameter is false; default is true. Optional. | | `message` | object | Optional | The message to send | | `message.subject` | string | Optional | The subject of the email | | `message.body` | object | Optional | The body of the message. It can be in HTML or text format. | | `message.body.content` | string | Optional | The content of the item | | `message.body.contentType` | string | Optional | The type of the content. Possible values are text and html. | | `message.replyTo` | array | Optional | The email addresses to use when replying. | | `message.replyTo.emailAddress` | object | Required | Response message | | `message.replyTo.emailAddress.address` | string | Required | Response message | | `message.replyTo.emailAddress.name` | string | Optional | Name of the resource | | `message.toRecipients` | array | Required | The list of direct recipient objects. | | `message.toRecipients.emailAddress` | object | Required | Response message | | `message.toRecipients.emailAddress.address` | string | Required | Response message | | `message.toRecipients.emailAddress.name` | string | Optional | Name of the resource | | `message.ccRecipients` | array | Optional | The list of CC recipient objects. | | `message.ccRecipients.emailAddress` | object | Required | Response message | | `message.ccRecipients.emailAddress.address` | string | Required | Response message | | `message.ccRecipients.emailAddress.name` | string | Optional | Name of the resource | | `message.bccRecipients` | array | Optional | The list of BCC recipient objects. | | `message.bccRecipients.emailAddress` | object | Required | Response message | | `message.bccRecipients.emailAddress.address` | string | Required | Response message | | `message.bccRecipients.emailAddress.name` | string | Optional | Name of the resource | | `message.attachments` | array | Optional | Items attached to this email with content in text or base64 encoded string format. | | `message.attachments.contentBytes` | string | Optional | The content of the attachment either in text or in base64 encoded string format. | ### Input Example `{"path_parameters":{"email_address":"string"},"saveToSentItems":true,"message":{"subject":"string","body":{"content":"string","contentType":"string"},"replyTo":[{"emailAddress":{"address":"string","name":"Example Name"}}],"toRecipients":[{"emailAddress":{"address":"string","name":"Example Name"}}],"ccRecipients":[{"emailAddress":{"address":"string","name":"Example Name"}}],"bccRecipients":[{"emailAddress":{"address":"string","name":"Example Name"}}],"attachments":[{"contentBytes":"string","name":"Example Name","@odata.type":"#microsoft.graph.fileAttachment","contentType":"text/plain"}]}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"response_text":"string"}` ## Set Email Read Status Update the read status of a specific email in Microsoft Graph API using the provided email address, email ID, and isRead value. ### Endpoint - **URL:** `/v1.0/users/{{email_address}}/messages/{{email_id}}` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ----------------------------------------------- | | `path_parameters.email_address` | string | Required | Parameters for the Set Email Read Status action | | `path_parameters.email_id` | string | Required | Parameters for the Set Email Read Status action | | `isRead` | string | Optional | Parameter for Set Email Read Status | ### Input Example `{"json_body":{"isRead":"true"},"path_parameters":{"email_address":"integrations@swimlaneintegrations.onmicrosoft.com","email_id":"ed7b3366-10f2-4992-9edc-31024afd556b@BN8NAM12FT082.eop-nam12.prod.protection.outlook.com"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | ---------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `@odata.etag` | string | Response data | | `id` | string | Unique identifier | | `createdDateTime` | string | Time value | | `lastModifiedDateTime` | string | Time value | | `changeKey` | string | Output field: changeKey | | `categories` | array | Output field: categories | | `categories.file_name` | string | Name of the resource | | `categories.file` | string | Output field: categories.file | | `receivedDateTime` | string | Time value | | `sentDateTime` | string | Time value | | `hasAttachments` | boolean | Output field: hasAttachments | | `internetMessageId` | string | Unique identifier | | `subject` | string | Output field: subject | | `bodyPreview` | string | Request body data | | `importance` | string | Output field: importance | | `parentFolderId` | string | Unique identifier | | `conversationId` | string | Unique identifier | | `conversationIndex` | string | Output field: conversationIndex | | `isDeliveryReceiptRequested` | object | Output field: isDeliveryReceiptRequested | | `isReadReceiptRequested` | boolean | Output field: isReadReceiptRequested | | `isRead` | boolean | Output field: isRead | | `isDraft` | boolean | Output field: isDraft | ### Output Example `{"@odata.context":"string","@odata.etag":"string","id":"12345678-1234-1234-1234-123456789abc","createdDateTime":"string","lastModifiedDateTime":"string","changeKey":"string","categories":[{"file_name":"Example Name","file":"string"}],"receivedDateTime":"string","sentDateTime":"string","hasAttachments":true,"internetMessageId":"string","subject":"string","bodyPreview":"string","importance":"string","parentFolderId":"string"}` ## Update Incident Modify an incident by specifying the incident ID and update its classification, determination, and custom tags using Microsoft Graph API. ### Endpoint - **URL:** `/v1.0/security/incidents/{{incidentId}}` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | --------------------------------------------------------------------------- | | `path_parameters.incidentId` | string | Required | ID of the Incident | | `classification` | string | Optional | Parameter for Update Incident | | `determination` | string | Optional | Parameter for Update Incident | | `customTags` | array | Optional | Parameter for Update Incident | | `assignedTo` | string | Optional | Owner of the incident, or null if no owner is assigned. Free editable text. | | `status` | string | Optional | Status value | ### Input Example `{"json_body":{"classification":"TruePositive","determination":"MultiStagedAttack","customTags":["Demo"],"assignedTo":"John Smith","status":"unknown"},"path_parameters":{"incidentId":"2972395"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.type` | string | Response data | | `id` | string | Unique identifier | | `incidentWebUrl` | string | URL endpoint for the request | | `redirectIncidentId` | object | Unique identifier | | `displayName` | string | Name of the resource | | `tenantId` | string | Unique identifier | | `createdDateTime` | string | Time value | | `lastUpdateDateTime` | string | Time value | | `assignedTo` | string | Output field: assignedTo | | `classification` | string | Output field: classification | | `determination` | string | Output field: determination | | `status` | string | Status value | | `severity` | string | Output field: severity | | `customTags` | array | Output field: customTags | | `comments` | array | Output field: comments | | `comments.comment` | string | Output field: comments.comment | | `comments.createdBy` | string | Output field: comments.createdBy | | `comments.createdTime` | string | Time value | ### Output Example `{"@odata.type":"#microsoft.graph.incident","id":"2972395","incidentWebUrl":"https://security.microsoft.com/incidents/2972395?tid=12f988bf-16f1-11af-11ab-1d7...","redirectIncidentId":null,"displayName":"Multi-stage incident involving Initial access & Command and control on multiple ...","tenantId":"b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c","createdDateTime":"2021-08-13T08:43:35.5533333Z","lastUpdateDateTime":"2021-09-30T09:35:45.1133333Z","assignedTo":"KaiC@contoso.onmicrosoft.com","classification":"...` ## Update Message Update the properties of a specific email message in Microsoft Graph API using the provided userPrincipalName and message ID. ### Endpoint - **URL:** `/users/{{userPrincipalName}}/messages/{{id}}` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------ | -------- | ------------ | --------------------------------------------------------------------------------------------------- | | `path_parameters.userPrincipalName` | string | Required | The email address of the user. | | `path_parameters.id` | string | Required | The unique identifier of the message. | | `bccRecipients` | array | Optional | The list of BCC recipient objects. | | `bccRecipients.emailAddress` | object | Required | Parameter for Update Message | | `bccRecipients.emailAddress.address` | string | Required | Parameter for Update Message | | `bccRecipients.emailAddress.name` | string | Optional | Name of the resource | | `body` | object | Optional | The body of the message. Updatable only if isDraft = true. | | `body.contentType` | string | Required | Request body data | | `body.content` | string | Required | Request body data | | `categories` | array | Optional | The categories associated with the message. | | `ccRecipients` | array | Optional | The Cc recipients for the message. | | `ccRecipients.emailAddress` | object | Required | Parameter for Update Message | | `ccRecipients.emailAddress.address` | string | Required | Parameter for Update Message | | `ccRecipients.emailAddress.name` | string | Optional | Name of the resource | | `flag` | object | Optional | The flag value that indicates the status, start date, due date, or completion date for the message. | | `flag.flagStatus` | string | Optional | Status value | | `flag.startDateTime` | object | Optional | Time value | | `flag.startDateTime.dateTime` | string | Optional | Time value | | `flag.startDateTime.timeZone` | string | Optional | Parameter for Update Message | | `flag.dueDateTime` | object | Optional | Time value | | `flag.dueDateTime.dateTime` | string | Optional | Time value | | `flag.dueDateTime.timeZone` | string | Optional | Parameter for Update Message | | `flag.completedDateTime` | object | Optional | Time value | | `flag.completedDateTime.dateTime` | string | Optional | Time value | | `flag.completedDateTime.timeZone` | string | Optional | Parameter for Update Message | ### Input Example `{"path_parameters":{"userPrincipalName":"Example Name","id":"12345678-1234-1234-1234-123456789abc"},"bccRecipients":[{"emailAddress":{"address":"string","name":"Example Name"}}],"body":{"contentType":"string","content":"string"},"categories":["string"],"ccRecipients":[{"emailAddress":{"address":"string","name":"Example Name"}}],"flag":{"flagStatus":"active","startDateTime":{"dateTime":"string","timeZone":"string"},"dueDateTime":{"dateTime":"string","timeZone":"string"},"completedDateTime":{"dateTime":"string","timeZone":"string"}},"from":{"emailAddress":{"address":"string","name":"Example Name"}},"importance":"string","inferenceClassification":"string","internetMessageId":"string","isDeliveryReceiptRequested":true,"isRead":true,"isReadReceiptRequested":true,"multiValueExtendedProperties":[{"id":"12345678-1234-1234-1234-123456789abc","value":["string"]}],"replyTo":[{"emailAddress":{"address":"string","name":"Example Name"}}],"sender":{"emailAddress":{"address":"string","name":"Example Name"}},"singleValueExtendedProperties":[{"id":"12345678-1234-1234-1234-123456789abc","value":"string"}],"subject":"string","toRecipients":[{"emailAddress":{"address":"string","name":"Example Name"}}]}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------- | -------- | ------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `receivedDateTime` | string | Time value | | `sentDateTime` | string | Time value | | `hasAttachments` | boolean | Output field: hasAttachments | | `subject` | string | Output field: subject | | `body` | object | Request body data | | `body.contentType` | string | Request body data | | `body.content` | string | Request body data | | `bodyPreview` | string | Request body data | | `inferenceClassification` | string | Output field: inferenceClassification | ### Output Example `{"receivedDateTime":"datetime-value","sentDateTime":"datetime-value","hasAttachments":true,"subject":"subject-value","body":{"contentType":"","content":"content-value"},"bodyPreview":"bodyPreview-value","inferenceClassification":"other"}` ## Update User Modify user properties in Microsoft Graph API by specifying the user ID and providing updated information in the request body. ### Endpoint - **URL:** `/v1.0/users/{{user_id}}` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.user_id` | string | Required | Parameters for the Update User action | | `aboutMe` | string | Optional | A freeform text entry field for the user to describe themselves. | | `accountEnabled` | boolean | Optional | True if the account is enabled; otherwise, false. | | `ageGroup` | string | Optional | Sets the age group of the user. | | `birthday` | string | Optional | The birthday of the user. | | `businessPhones` | array | Optional | The telephone numbers for the user. | | `city` | string | Optional | The city in which the user is located. | | `companyName` | string | Optional | The name of the company that the user is associated. | | `consentProvidedForMinor` | string | Optional | Sets whether consent has been obtained for minors. | | `country` | string | Optional | The country/region in which the user is located. | | `customSecurityAttributes` | object | Optional | An open complex type that holds the value of a custom security attribute that is assigned to a directory object. | | `customSecurityAttributes.@odata.type` | string | Optional | Response data | | `department` | string | Optional | The name for the department in which the user works. | | `displayName` | string | Optional | The name displayed in the address book for the user. | | `employeeId` | string | Optional | The employee identifier assigned to the user by the organization. | | `employeeType` | string | Optional | Captures enterprise worker type. | | `givenName` | string | Optional | The given name (first name) of the user. | | `employeeHireDate` | string | Optional | The hire date of the user. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. | | `employeeLeaveDateTime` | string | Optional | The date and time when the user left or will leave the organization. The timestamp type represents date and time information using ISO 8601 format and is always in UTC time. | | `employeeOrgData` | object | Optional | Represents organization data (for example, division and costCenter) associated with a user. | | `employeeOrgData.costCenter` | string | Optional | The cost center associated with the user. | | `employeeOrgData.division` | string | Optional | The name of the division in which the user works. | | `interests` | array | Optional | A list for the user to describe their interests. | | `jobTitle` | string | Optional | The user's job title. | | `mail` | string | Optional | The SMTP address for the user, | ### Input Example `{"json_body":{"aboutMe":"Name","accountEnabled":true,"ageGroup":"Adult","birthday":"2014-01-01T00:00:00Z","businessPhones":["+44 20 7946 0958","+91-9876543210"],"city":"London","companyName":"Global Enterprises","consentProvidedForMinor":"Granted","country":"US","customSecurityAttributes":{"@odata.type":"#microsoft.graph.customSecurityAttributeValue"},"department":"Engineering","displayName":"ane M. Smith","employeeId":"EMP123456789","employeeType":"Contractor","givenName":"Sana","employeeHireDate":"2024-05-27T00:00:00Z","employeeLeaveDateTime":"2014-01-01T00:00:00Z.","employeeOrgData":{"costCenter":"string","division":"string"},"interests":["Cooking","Playing"],"jobTitle":"Software Engineer","mail":"jeff@contoso.com","mailNickname":"john","mobilePhone":"+1234567890","mySite":"https://www.example.com/johndoe","officeLocation":"Hyderabad","onPremisesExtensionAttributes":{"extensionAttribute1":"string","extensionAttribute2":"string","extensionAttribute3":"string","extensionAttribute4":"string","extensionAttribute5":"string","extensionAttribute6":"string","extensionAttribute7":"string","extensionAttribute8":"string","extensionAttribute9":"string","extensionAttribute10":"string","extensionAttribute11":"string","extensionAttribute12":"string","extensionAttribute13":"string","extensionAttribute14":"string","extensionAttribute15":"string"},"onPremisesImmutableId":"01234567-89ab-cdef-0123-456789abcdef","otherMails":["bob@contoso.com","Robert@fabrikam.com"],"passwordPolicies":"DisableStrongPassword","passwordProfile":{"forceChangePasswordNextSignIn":true,"forceChangePasswordNextSignInWithMfa":false,"password":"string"},"pastProjects":["Project Alpha","Project Gama"],"postalCode":"12345","preferredLanguage":"en-US","responsibilities":["Managing client relationships","Project management"],"schools":["High School ABC","High School XYZ"],"skills":["Data Analysis","Data Science"],"state":"AP","streetAddress":"Sreeram nagar","surname":"Sana","usageLocation":"US","userPrincipalName":"john.doe@example.com","userType":"Guest"},"path_parameters":{"user_id":"678f80e5-e506-4f10-895d-bf664699475d"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"response_text":"string"}` # Response Headers | **Header** | **Description** | **Example** | | ------------------------- | ----------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | | Cache-Control | Directives for caching mechanisms | private | | client-request-id | HTTP response header: client-request-id | 3763884a-1de2-4f55-a7cd-53a5fda6a36d | | Content-Encoding | HTTP response header: Content-Encoding | gzip | | content-length | The length of the response body in bytes | 140 | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Tue, 20 Dec 2022 19:24:30 GMT | | Deprecation | HTTP response header: Deprecation | | | Link | HTTP response header: Link | | | Location | The URL to redirect a page to | [https://graph.microsoft.com](https://graph.microsoft.com) | | OData-Version | HTTP response header: OData-Version | 4.0 | | request-id | HTTP response header: request-id | bc1b10c5-b74d-4492-8c94-7c9165c883af | | Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=31536000 | | Sunset | HTTP response header: Sunset | | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | Vary | HTTP response header: Vary | Accept-Encoding | | x-ms-ags-diagnostic | HTTP response header: x-ms-ags-diagnostic | \{"ServerInfo":\{"DataCenter":"Central US","Slice":"E","Ring":"2","ScaleUnit":"001","RoleInstance":"DS2PEPF00001339"}} | | x-ms-resource-unit | HTTP response header: x-ms-resource-unit | 3 |