Connectors · Identity & security

Microsoft 365 Users MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Microsoft 365 Users and the rest of your systems. It gives your agent 274 Microsoft 365 Users actions (160 reads, 61 writes and 53 that wait for a confirmation) and holds the Microsoft 365 Users credential itself, so the agent never does. It paces Microsoft 365 Users's limits and records every call.

Connect Microsoft 365 Users free See pricing

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

claude mcp add --transport http actionlake https://connect.actionlake.com/mcp

274actionsin one signed file
160readlook, never change
61writecreate and update
53wait for a yesdestructive, confirmed first

Set up

Connect Microsoft 365 Users in three steps.

01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp
02
Connect Microsoft 365 Users.
OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key.
- client_idEntra application (client) id
- client_secretEntra client secret
- tenant_idYour Microsoft 365 Users tenant id
```
account { op: "connections.requirements", service: "m365_graph_users" }
# free: exactly what to paste, and what is found for you
```

Make the first call. Check before a write.

Ask in plain words; Claude picks the action. Before anything changes, check validates the call and prices it, for free.

do    { action: "m365_graph_users.users_list" }# list users · read · 1 upstream callcheck { action: "m365_graph_users.users_create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent

Microsoft 365 Users at a glance

Sign-in: OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in.
You provide: client_idclient_secret
Setup fields: tenant_id
Limits we pace to: 10,000 calls per 10 minutes, per connection
API covered: Microsoft 365 Users API v1.0graph.microsoft.com/v1.0
Built from: Microsoft 365 Users's documentation, read 8 September 2026learn.microsoft.com
Service file: Version 1.0.0, signed (Ed25519)
Cached reads: 155 of 160 reads, for up to an hour; a write clears what it affects
Ready-made plans: 9 in the store
Shared entities: 8, so ask can line Microsoft 365 Users up with your other systems
Data: Processed and stored in Sydney, Australia. No US region yet

Capabilities

What an AI agent can do in Microsoft 365 Users.

274 actions in 8 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

160readlook, never change
61writecreate and update
53destructivewait for a confirmation

Directory
106
67 read · 24 write · 15 destructive
List users · List groups · Create a user · Track user changes (delta)
Applications
44
21 read · 12 write · 11 destructive
List service principals · Create a service principal · Get a service principal · Update a service principal
Authentication
42
25 read · 5 write · 12 destructive
List a user's authentication methods · Revoke a user's sign-in sessions · Reset a user's password · List authentication strength policies
Roles
28
16 read · 3 write · 9 destructive
List directory roles · List directory role templates · List directory role definitions · Create a role definition
Policy
25
13 read · 8 write · 4 destructive
List conditional access policies · Create a conditional access policy · Update a conditional access policy · Get a conditional access policy
Organization
17
9 read · 6 write · 2 destructive
Create a domain · List domains · Get a domain · Update a domain
Licensing
7
4 read · 3 write · 0 destructive
List subscribed SKUs · List group members with licence errors · List a user's licences · Get a subscribed SKU
Audit
5
5 read · 0 write · 0 destructive
List directory audit logs · List sign-in logs · List provisioning logs · Get one directory audit record

Top actions

The Microsoft 365 Users API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 141 of Microsoft 365 Users's 150 action names are shared with at least one other connector, so an agent learns them once.

Action	What it does	Effect	Same name in
`m365_graph_users.users_list`List users	List users in the tenant directory. Graph returns a default property subset; name others with `select`.	read	`identity.user.list`474 connectors
`m365_graph_users.groups_list`List groups	List groups in the tenant directory.	read	`identity.group.list`262 connectors
`m365_graph_users.directory_roles_list`List directory roles	List directory roles in the tenant directory. Only roles that have been activated in the tenant appear here.	read	`identity.role.list`184 connectors
`m365_graph_users.users_create`Create a user	Create a user in the tenant directory.	write	`identity.user.create`262 connectors
`m365_graph_users.groups_create`Create a group	Create a group in the tenant directory.	write	`identity.group.create`205 connectors
`m365_graph_users.service_principals_list`List service principals	List service principals in the tenant directory. These are the tenant's enterprise applications.	read	`identity.service_account.list`35 connectors
`m365_graph_users.devices_list`List devices	List devices in the tenant directory.	read	`device.endpoint.list`65 connectors
`m365_graph_users.role_definitions_list`List directory role definitions	List directory role definitions in the tenant directory. Every built-in and custom role, with the resource actions each grants.	read	`identity.role.list`184 connectors
`m365_graph_users.users_delete`Delete a user	Delete a user. Directory objects go to deletedItems for 30 days.	destructive	`identity.user.delete`253 connectors
`m365_graph_users.org_contacts_list`List organizational contacts	List organizational contacts in the tenant directory. These are directory mail contacts synced from on-premises, not personal contacts.	read	`crm.contact.list`177 connectors
`m365_graph_users.subscribed_skus`List subscribed SKUs	List the licence SKUs the tenant has bought, with consumed and enabled unit counts. This is how you find out how many seats are left. Not paged by Graph.	read	`identity.license.list`10 connectors
`m365_graph_users.service_principals_create`Create a service principal	Create a service principal in the tenant directory.	write	`identity.service_account.create`32 connectors

Try it

Prompts to paste into Claude.

Each one names the Microsoft 365 Users actions it will call, so you know what it reads and what it changes before you send it.

Readread
Which Microsoft 365 Users devices have not checked in for a week?
callsm365_graph_users.devices_list
Plandestructive
Lock down a suspected compromised account in Microsoft 365 Users. Ask me before anything is sent or changed.
callsm365_graph_users.users_getm365_graph_users.audit_sign_insm365_graph_users.users_auth_methodsm365_graph_users.users_updatem365_graph_users.users_revoke_sessions+1 more
Plandestructive
Move a user to a new department, manager and group in Microsoft 365 Users. Ask me before anything is sent or changed.
callsm365_graph_users.users_getm365_graph_users.users_member_ofm365_graph_users.users_updatem365_graph_users.users_set_managerm365_graph_users.groups_add_member+1 more
Writewrite
Create a user in Microsoft 365 Users. Show me exactly what you will send before you save it.
callsm365_graph_users.users_create
Across systemsread
Which contacts are in both Microsoft 365 Users and HaloPSA, and how many are in only one of them?
callsm365_graph_users.org_contacts_listhalopsa.users.list

Across your systems

Microsoft 365 Users, joined to the rest of your business.

One ask fetches from Microsoft 365 Users and another system, joins the rows on the same customer on our side, and hands your agent the answer, not every row.

Which contacts are in both Microsoft 365 Users and HaloPSA, and how many are in only one of them?
m365_graph_users.org_contacts_list + halopsa.users.list, on crm.contact · HaloPSA
Which contacts are in both Microsoft 365 Users and NetSuite, and how many are in only one of them?
m365_graph_users.org_contacts_list + netsuite.views.contacts, on crm.contact · NetSuite

Also mapped by other connectorsidentity.user 517identity.group 239crm.contact 192identity.role 107device.endpoint 69platform.tenant 67identity.service_account 23identity.license 4

ask

ask {  intent: "which contacts are in both Microsoft 365 Users and HaloPSA, and how many are in only one of them",  steps: [    { action: "m365_graph_users.org_contacts_list", as: "people", input: {}, limit: 100, max_pages: 5 },    { action: "halopsa.users.list", as: "people2", input: {}, limit: 100, max_pages: 5 },    { join: {        left: "people",        right: "people2",        on: "crm.contact",        group_by: "people.email",        select: ["people.email", "count(people2.id) as in_halopsa"]    } }  ]}

Example. Run it through check first: it validates the steps and prices them, and it is free.

The plan store

Ready-made plans for Microsoft 365 Users.

9 plans in the store. Install one and your agent runs it by name; the reply says which connections are still missing. A schedule can run a plan on a timetable. There are no triggers or webhooks, by design.

Report subscribed SKUs against actual per-user assignment
Use it when Someone asks which licences are bought, which are actually assigned, and where seats are being wasted.
Effect
read
Steps
3 · loops
Install
m365_graph_users-licence-usage-report
Audit who holds privileged directory roles
Use it when A security or compliance review asks who currently holds admin roles and how that privilege was granted.
Effect
read
Steps
4 · loops
Install
m365_graph_users-privileged-role-audit
Find dormant accounts and disable them after approval
Use it when A periodic security review needs dormant or unused accounts identified and switched off.
A person decidesDisable the enabled accounts with no interactive sign-in since window start, based on enabled users accounts checked against recent sign ins sign-in records.
Effect
write
Steps
5 · loops
Needs
cutoff
Install
m365_graph_users-stale-account-cleanup
Invite an external guest and place them in a group
Use it when An external partner or contractor needs guest access to the tenant and membership of a specific collaboration group.
A person decidesInvite external guest guest email into the tenant and add them to group group id.
Effect
write
Steps
6
Needs
group id, guest display name, guest email, mail nickname and redirect url
Install
m365_graph_users-guest-invite-and-place
Onboard a new employee with licence, manager and groups
Use it when A new starter needs an account created, licensed, placed under a manager and added to their team group in one pass.
A person decidesAssign licence sku id to the newly created account user principal name. This consumes a paid seat.
Effect
write
Steps
6
Needs
department, display name, group id, initial password, mail nickname, manager id, sku id and user principal name
Install
m365_graph_users-onboard-new-employee
Grant a directory role to a user after sign-off
Use it when Someone needs to be given an admin role and the grant must be signed off and evidenced.
A person decidesGrant the role displayName to displayName (userPrincipalName) at scope directory scope id.
Effect
destructive
Steps
6
Needs
directory scope id, role definition id and user id
Install
m365_graph_users-grant-admin-role
Offboard a departing user and reclaim their licences
Use it when Someone has left the organisation and their access must be cut off and their paid seat reclaimed.
A person decidesDisable displayName (userPrincipalName), revoke all their sessions and remove licence sku id.
Effect
destructive
Steps
7
Needs
sku id and user id
Install
m365_graph_users-offboard-departing-user
Lock down a suspected compromised account
Use it when An account is suspected of being compromised and access must be cut immediately with evidence captured first.
A person decidesLock down displayName (userPrincipalName): disable the account, revoke all sessions and force a password reset.
Effect
destructive
Steps
8
Needs
new password, password method id and user id
Install
m365_graph_users-compromised-account-lockdown
Move a user to a new department, manager and group
Use it when An existing employee changes department or reporting line and their directory record and groups must follow.
A person decidesRemove displayName (userPrincipalName) from group old group id.
Effect
destructive
Steps
8
Needs
new department, new group id, new job title, new manager id, old group id and user id
Install
m365_graph_users-department-transfer

install a plan

account { op: "plans.install", slug: "m365_graph_users-licence-usage-report" }
# then ask for it by name; a schedule can run it on a timetable

Governance for Microsoft 365 Users

Destructive actions wait for a yes.

53 Microsoft 365 Users actions are destructive. The first 10:

Delete a userm365_graph_users.users_delete
Delete a groupm365_graph_users.groups_delete
Delete a role definitionm365_graph_users.role_definitions_delete
Delete a service principalm365_graph_users.service_principals_delete
Delete a devicem365_graph_users.devices_delete
Delete an applicationm365_graph_users.applications_delete
Remove a member from a groupm365_graph_users.groups_remove_member
Delete a domainm365_graph_users.domains_delete
Delete a role assignmentm365_graph_users.role_assignments_delete
Remove a member from a directory rolem365_graph_users.directory_roles_remove_member

A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

dom365_graph_users.users_deleteconfirm_policy: human

Delete a user?

intent: the user asked me to delete a user

run suspended · waiting for a named person · key m365-graph-users-agent cannot confirm itself

In the console, or from an emailed signed link.

a key for this connector

account {  op: "keys.create", name: "m365-graph-users-agent",  allowed_actions: ["m365_graph_users.*"], cap_calls: 2000,  confirm_policy: "human_for_writes",  approval_rules: [    { match: "m365_graph_users.users_delete", approver: "[email protected]" },    { match: "m365_graph_users.groups_delete", approver: "[email protected]" },    { match: "m365_graph_users.role_definitions_delete", approver: "[email protected]" }  ]}

Illustrative. Scoped to Microsoft 365 Users only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

What Microsoft 365 Users costs on actionlake.

Every Microsoft 365 Users action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Microsoft 365 Users refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

1upstream call per actionall 274 Microsoft 365 Users actions
106actions pageeach page of a long list is one call
155reads can be cacheda cache hit costs nothing
100,000calls a month, freepaid plans from US$49 a month for 250,000

See pricing

Action index

Every Microsoft 365 Users action.

274 actions by area: the id your agent calls, what it does, and its effect.

Directory106

m365_graph_users.administrative_units_add_memberAdd a member to an administrative unitwrite
m365_graph_users.administrative_units_createCreate an administrative unitwrite
m365_graph_users.administrative_units_deleteDelete an administrative unitdestructive
m365_graph_users.administrative_units_getGet an administrative unitread
m365_graph_users.administrative_units_listList administrative unitsread
m365_graph_users.administrative_units_membersList an administrative unit's membersread
m365_graph_users.administrative_units_remove_memberRemove a member from an administrative unitdestructive
m365_graph_users.administrative_units_updateUpdate an administrative unitwrite
m365_graph_users.batchRun up to 20 Graph requests in one callwrite
m365_graph_users.devices_add_registered_ownerAdd a registered owner to a devicewrite
m365_graph_users.devices_createCreate a devicewrite
m365_graph_users.devices_deleteDelete a devicedestructive
m365_graph_users.devices_deltaTrack device changes (delta)read
m365_graph_users.devices_extensionsList a device's open extensionsread
m365_graph_users.devices_getGet a deviceread
m365_graph_users.devices_listList devicesread
m365_graph_users.devices_member_ofList a device's groupsread
m365_graph_users.devices_registered_ownersList a device's registered ownersread
m365_graph_users.devices_registered_usersList a device's registered usersread
m365_graph_users.devices_remove_registered_ownerRemove a registered owner from a devicedestructive
m365_graph_users.devices_transitive_member_ofList a device's groups including nestedread
m365_graph_users.devices_updateUpdate a devicewrite
m365_graph_users.directory_deleted_groupsList deleted groupsread
m365_graph_users.directory_deleted_item_getGet a deleted directory objectread
m365_graph_users.directory_deleted_item_purgePermanently delete a directory objectdestructive
m365_graph_users.directory_deleted_itemsList deleted usersread
m365_graph_users.directory_objects_deleteDelete a directory objectdestructive
m365_graph_users.directory_objects_getGet a directory objectread
m365_graph_users.directory_objects_get_available_extension_propertiesList available directory extension propertiesread
m365_graph_users.directory_objects_get_by_idsResolve directory objects by idread
m365_graph_users.directory_objects_validate_propertiesValidate a group's display name and aliasread
m365_graph_users.groups_add_memberAdd a member to a groupwrite
m365_graph_users.groups_add_ownerAdd an owner to a groupwrite
m365_graph_users.groups_check_member_groupsCheck which of these groups a group is inread
m365_graph_users.groups_createCreate a groupwrite
m365_graph_users.groups_deleteDelete a groupdestructive
m365_graph_users.groups_deltaTrack group changes (delta)read
m365_graph_users.groups_extension_createCreate a group open extensionwrite
m365_graph_users.groups_extension_deleteDelete a group open extensiondestructive
m365_graph_users.groups_extensionsList a group's open extensionsread
m365_graph_users.groups_getGet a groupread
m365_graph_users.groups_get_member_groupsList every group a group is transitively inread
m365_graph_users.groups_get_member_objectsList every directory object a group is inread
m365_graph_users.groups_listList groupsread
m365_graph_users.groups_member_ofList a group's parent groupsread
m365_graph_users.groups_membersList a group's direct membersread
m365_graph_users.groups_ownersList a group's ownersread
m365_graph_users.groups_photoGet a group's photo metadataread
m365_graph_users.groups_remove_memberRemove a member from a groupdestructive
m365_graph_users.groups_remove_ownerRemove an owner from a groupdestructive
m365_graph_users.groups_renewRenew a group's expirationwrite
m365_graph_users.groups_searchSearch groupsread
m365_graph_users.groups_setting_createCreate a group settingwrite
m365_graph_users.groups_setting_deleteDelete a group settingdestructive
m365_graph_users.groups_setting_getGet one group settingread
m365_graph_users.groups_setting_updateUpdate a group settingwrite
m365_graph_users.groups_settingsList a group's settingsread
m365_graph_users.groups_transitive_member_ofList a group's parents including nestedread
m365_graph_users.groups_transitive_membersList a group's members including nestedread
m365_graph_users.groups_updateUpdate a groupwrite
m365_graph_users.invitations_createInvite a guest userwrite
m365_graph_users.invitations_listList guest invitationsread
m365_graph_users.org_contacts_direct_reportsList an organizational contact's direct reportsread
m365_graph_users.org_contacts_getGet an organizational contactread
m365_graph_users.org_contacts_listList organizational contactsread
m365_graph_users.org_contacts_managerGet an organizational contact's managerread
m365_graph_users.org_contacts_member_ofList an organizational contact's groupsread
m365_graph_users.org_contacts_transitive_member_ofList an organizational contact's groups including nestedread
m365_graph_users.users_check_member_groupsCheck which of these groups a user is inread
m365_graph_users.users_check_member_objectsCheck which of these directory objects a user is inread
m365_graph_users.users_createCreate a userwrite
m365_graph_users.users_created_objectsList objects a user createdread
m365_graph_users.users_deleteDelete a userdestructive
m365_graph_users.users_deltaTrack user changes (delta)read
m365_graph_users.users_direct_reportsList a user's direct reportsread
m365_graph_users.users_export_personal_dataExport a user's personal datawrite
m365_graph_users.users_extension_createCreate a user open extensionwrite
m365_graph_users.users_extension_deleteDelete a user open extensiondestructive
m365_graph_users.users_extension_getGet one user open extensionread
m365_graph_users.users_extensionsList a user's open extensionsread
m365_graph_users.users_getGet a userread
m365_graph_users.users_get_member_groupsList every group a user is transitively inread
m365_graph_users.users_get_member_objectsList every directory object a user is transitively inread
m365_graph_users.users_listList usersread
m365_graph_users.users_managerGet a user's managerread
m365_graph_users.users_member_ofList a user's direct groupsread
m365_graph_users.users_on_premises_syncGet a user's on-premises sync behaviourread
m365_graph_users.users_owned_devicesList devices a user ownsread
m365_graph_users.users_owned_objectsList objects a user ownsread
m365_graph_users.users_peopleList people relevant to a userread
m365_graph_users.users_photoGet a user's photo metadataread
m365_graph_users.users_photo_deleteDelete a user's photodestructive
m365_graph_users.users_photosList a user's photo sizesread
m365_graph_users.users_registered_devicesList devices registered to a userread
m365_graph_users.users_remove_managerRemove a user's managerdestructive
m365_graph_users.users_restoreRestore a deleted directory objectwrite
m365_graph_users.users_retry_provisioningRetry a user's service provisioningwrite
m365_graph_users.users_searchSearch usersread
m365_graph_users.users_service_provisioning_errorsList a user's provisioning errorsread
m365_graph_users.users_set_managerSet a user's managerwrite
m365_graph_users.users_settingsGet a user's settingsread
m365_graph_users.users_settings_updateUpdate a user's settingswrite
m365_graph_users.users_sponsor_ofList users this user sponsorsread
m365_graph_users.users_sponsorsList a user's sponsorsread
m365_graph_users.users_transitive_member_ofList every group a user is in, including nestedread
m365_graph_users.users_updateUpdate a userwrite

Applications44

m365_graph_users.applications_add_keyAdd a certificate to an applicationwrite
m365_graph_users.applications_add_ownerAdd an owner to an applicationwrite
m365_graph_users.applications_add_passwordAdd a client secret to an applicationwrite
m365_graph_users.applications_createCreate an applicationwrite
m365_graph_users.applications_deleteDelete an applicationdestructive
m365_graph_users.applications_deltaTrack application changes (delta)read
m365_graph_users.applications_extension_propertiesList an application's directory extension propertiesread
m365_graph_users.applications_extension_property_createCreate a directory extension propertywrite
m365_graph_users.applications_extension_property_deleteDelete a directory extension propertydestructive
m365_graph_users.applications_federated_credential_createCreate a federated identity credentialwrite
m365_graph_users.applications_federated_credential_deleteDelete a federated identity credentialdestructive
m365_graph_users.applications_federated_identity_credentialsList an application's federated identity credentialsread
m365_graph_users.applications_getGet an applicationread
m365_graph_users.applications_listList applicationsread
m365_graph_users.applications_ownersList an application's ownersread
m365_graph_users.applications_remove_keyRemove a certificate from an applicationdestructive
m365_graph_users.applications_remove_ownerRemove an owner from an applicationdestructive
m365_graph_users.applications_remove_passwordRemove a client secret from an applicationdestructive
m365_graph_users.applications_set_verified_publisherSet an application's verified publisherwrite
m365_graph_users.applications_updateUpdate an applicationwrite
m365_graph_users.directory_deleted_applicationsList deleted applicationsread
m365_graph_users.oauth2_permission_grant_createCreate an OAuth2 permission grantwrite
m365_graph_users.oauth2_permission_grant_deleteDelete an OAuth2 permission grantdestructive
m365_graph_users.oauth2_permission_grant_getGet an OAuth2 permission grantread
m365_graph_users.oauth2_permission_grantsList OAuth2 delegated permission grantsread
m365_graph_users.service_principals_add_passwordAdd a secret to a service principalwrite
m365_graph_users.service_principals_app_role_assigned_toList who is assigned to an enterprise applicationread
m365_graph_users.service_principals_app_role_assignmentsList app roles this service principal holdsread
m365_graph_users.service_principals_assign_app_roleAssign a user or group to an enterprise applicationdestructive
m365_graph_users.service_principals_createCreate a service principalwrite
m365_graph_users.service_principals_delegated_permission_classificationsList a service principal's permission classificationsread
m365_graph_users.service_principals_deleteDelete a service principaldestructive
m365_graph_users.service_principals_deltaTrack service principal changes (delta)read
m365_graph_users.service_principals_getGet a service principalread
m365_graph_users.service_principals_listList service principalsread
m365_graph_users.service_principals_member_ofList a service principal's groups and rolesread
m365_graph_users.service_principals_oauth2_grantsList a service principal's delegated grantsread
m365_graph_users.service_principals_owned_objectsList objects a service principal ownsread
m365_graph_users.service_principals_ownersList a service principal's ownersread
m365_graph_users.service_principals_remove_app_role_assignmentRemove an assignment from an enterprise applicationdestructive
m365_graph_users.service_principals_remove_passwordRemove a secret from a service principaldestructive
m365_graph_users.service_principals_updateUpdate a service principalwrite
m365_graph_users.users_app_role_assignmentsList a user's app role assignmentsread
m365_graph_users.users_oauth2_grantsList a user's delegated permission grantsread

Authentication42

m365_graph_users.authentication_methods_policyGet the authentication methods policyread
m365_graph_users.authentication_strength_policiesList authentication strength policiesread
m365_graph_users.organization_certificate_based_authList certificate-based auth configurationread
m365_graph_users.users_auth_email_createRegister an email authentication methodwrite
m365_graph_users.users_auth_email_deleteDelete an email authentication methoddestructive
m365_graph_users.users_auth_email_getGet one email authentication methodread
m365_graph_users.users_auth_email_listList a user's email authentication methodsread
m365_graph_users.users_auth_fido2_deleteDelete a FIDO2 security keydestructive
m365_graph_users.users_auth_fido2_getGet one FIDO2 security keyread
m365_graph_users.users_auth_fido2_listList a user's FIDO2 security keysread
m365_graph_users.users_auth_method_getGet one authentication methodread
m365_graph_users.users_auth_methodsList a user's authentication methodsread
m365_graph_users.users_auth_microsoft_authenticator_deleteDelete a Microsoft Authenticator registrationdestructive
m365_graph_users.users_auth_microsoft_authenticator_getGet one Microsoft Authenticator registrationread
m365_graph_users.users_auth_microsoft_authenticator_listList a user's Microsoft Authenticator registrationsread
m365_graph_users.users_auth_operationsList authentication long-running operationsread
m365_graph_users.users_auth_password_deleteDelete a password methoddestructive
m365_graph_users.users_auth_password_getGet one password methodread
m365_graph_users.users_auth_password_listList a user's password methodsread
m365_graph_users.users_auth_password_resetReset a user's passwordwrite
m365_graph_users.users_auth_phone_createRegister a phone authentication methodwrite
m365_graph_users.users_auth_phone_deleteDelete a phone authentication methoddestructive
m365_graph_users.users_auth_phone_disable_smsDisable SMS sign-in on a phone methoddestructive
m365_graph_users.users_auth_phone_enable_smsEnable SMS sign-in on a phone methodwrite
m365_graph_users.users_auth_phone_getGet one phone authentication methodread
m365_graph_users.users_auth_phone_listList a user's phone authentication methodsread
m365_graph_users.users_auth_platform_credential_deleteDelete a platform credentialdestructive
m365_graph_users.users_auth_platform_credential_getGet one platform credentialread
m365_graph_users.users_auth_platform_credential_listList a user's platform credentialsread
m365_graph_users.users_auth_software_oath_deleteDelete a software OATH tokendestructive
m365_graph_users.users_auth_software_oath_getGet one software OATH tokenread
m365_graph_users.users_auth_software_oath_listList a user's software OATH tokensread
m365_graph_users.users_auth_temporary_access_pass_createRegister a Temporary Access Passdestructive
m365_graph_users.users_auth_temporary_access_pass_deleteDelete a Temporary Access Passdestructive
m365_graph_users.users_auth_temporary_access_pass_getGet one Temporary Access Passread
m365_graph_users.users_auth_temporary_access_pass_listList a user's Temporary Access Passesread
m365_graph_users.users_auth_windows_hello_for_business_deleteDelete a Windows Hello for Business credentialdestructive
m365_graph_users.users_auth_windows_hello_for_business_getGet one Windows Hello for Business credentialread
m365_graph_users.users_auth_windows_hello_for_business_listList a user's Windows Hello for Business credentialsread
m365_graph_users.users_authenticationGet a user's authentication containerread
m365_graph_users.users_change_passwordChange the signed-in user's passwordwrite
m365_graph_users.users_revoke_sessionsRevoke a user's sign-in sessionsdestructive

Roles28

m365_graph_users.administrative_units_add_scoped_role_memberGrant a scoped role in an administrative unitdestructive
m365_graph_users.administrative_units_remove_scoped_role_memberRevoke a scoped role in an administrative unitdestructive
m365_graph_users.administrative_units_scoped_role_membersList an administrative unit's scoped role membersread
m365_graph_users.directory_role_templates_getGet a directory role templateread
m365_graph_users.directory_role_templates_listList directory role templatesread
m365_graph_users.directory_roles_activateActivate a directory rolewrite
m365_graph_users.directory_roles_add_memberAdd a member to a directory roledestructive
m365_graph_users.directory_roles_getGet a directory roleread
m365_graph_users.directory_roles_listList directory rolesread
m365_graph_users.directory_roles_membersList a directory role's membersread
m365_graph_users.directory_roles_remove_memberRemove a member from a directory roledestructive
m365_graph_users.directory_roles_scoped_membersList a directory role's AU-scoped membersread
m365_graph_users.role_assignment_schedule_request_cancelCancel a role activation requestdestructive
m365_graph_users.role_assignment_schedule_request_createRequest a role activation or assignmentdestructive
m365_graph_users.role_assignment_schedule_requestsList role activation requestsread
m365_graph_users.role_assignment_schedulesList active role assignment schedulesread
m365_graph_users.role_assignments_createCreate a role assignmentdestructive
m365_graph_users.role_assignments_deleteDelete a role assignmentdestructive
m365_graph_users.role_assignments_getGet a role assignmentread
m365_graph_users.role_assignments_listList directory role assignmentsread
m365_graph_users.role_definitions_createCreate a role definitionwrite
m365_graph_users.role_definitions_deleteDelete a role definitiondestructive
m365_graph_users.role_definitions_getGet a role definitionread
m365_graph_users.role_definitions_listList directory role definitionsread
m365_graph_users.role_definitions_updateUpdate a role definitionwrite
m365_graph_users.role_eligibility_schedulesList eligible role assignmentsread
m365_graph_users.role_resource_namespacesList RBAC resource namespacesread
m365_graph_users.users_scoped_role_member_ofList a user's administrative-unit-scoped rolesread

Policy25

m365_graph_users.api_connectors_createCreate an API connectorwrite
m365_graph_users.api_connectors_deleteDelete an API connectordestructive
m365_graph_users.api_connectors_getGet an API connectorread
m365_graph_users.api_connectors_listList API connectorsread
m365_graph_users.api_connectors_updateUpdate an API connectorwrite
m365_graph_users.authentication_context_class_referencesList authentication context class referencesread
m365_graph_users.b2x_user_flowsList self-service sign-up user flowsread
m365_graph_users.conditional_access_policies_createCreate a conditional access policywrite
m365_graph_users.conditional_access_policies_deleteDelete a conditional access policydestructive
m365_graph_users.conditional_access_policies_getGet a conditional access policyread
m365_graph_users.conditional_access_policies_listList conditional access policiesread
m365_graph_users.conditional_access_policies_updateUpdate a conditional access policywrite
m365_graph_users.conditional_access_templatesList conditional access policy templatesread
m365_graph_users.groups_lifecycle_policiesList group lifecycle policiesread
m365_graph_users.groups_lifecycle_policy_createCreate a group lifecycle policywrite
m365_graph_users.groups_lifecycle_policy_deleteDelete a group lifecycle policydestructive
m365_graph_users.groups_lifecycle_policy_getGet a group lifecycle policyread
m365_graph_users.groups_lifecycle_policy_updateUpdate a group lifecycle policywrite
m365_graph_users.identity_providersList identity providersread
m365_graph_users.named_locations_createCreate a named locationwrite
m365_graph_users.named_locations_deleteDelete a named locationdestructive
m365_graph_users.named_locations_getGet a named locationread
m365_graph_users.named_locations_listList named locationsread
m365_graph_users.named_locations_updateUpdate a named locationwrite
m365_graph_users.users_agreement_acceptancesList a user's terms-of-use acceptancesread

Organization17

m365_graph_users.domains_createCreate a domainwrite
m365_graph_users.domains_deleteDelete a domaindestructive
m365_graph_users.domains_force_deleteForce-delete a domaindestructive
m365_graph_users.domains_getGet a domainread
m365_graph_users.domains_listList domainsread
m365_graph_users.domains_name_referencesList objects using a domainread
m365_graph_users.domains_promotePromote a domain to primarywrite
m365_graph_users.domains_service_configuration_recordsList a domain's service configuration recordsread
m365_graph_users.domains_updateUpdate a domainwrite
m365_graph_users.domains_verification_dns_recordsList a domain's verification DNS recordsread
m365_graph_users.domains_verifyVerify a domainwrite
m365_graph_users.organizationGet the tenant organizationread
m365_graph_users.organization_brandingGet the tenant's sign-in brandingread
m365_graph_users.organization_branding_localizationsList localized sign-in brandingread
m365_graph_users.organization_getGet one organization recordread
m365_graph_users.organization_set_mdm_authoritySet the mobile device management authoritywrite
m365_graph_users.organization_updateUpdate the organizationwrite

Licensing7

m365_graph_users.groups_assign_licenseAssign or remove group-based licenceswrite
m365_graph_users.groups_members_with_license_errorsList group members with licence errorsread
m365_graph_users.subscribed_sku_getGet a subscribed SKUread
m365_graph_users.subscribed_skusList subscribed SKUsread
m365_graph_users.users_assign_licenseAssign or remove user licenceswrite
m365_graph_users.users_license_detailsList a user's licencesread
m365_graph_users.users_reprocess_licenseReprocess a user's group-based licenceswrite

Audit5

m365_graph_users.audit_directory_audit_getGet one directory audit recordread
m365_graph_users.audit_directory_auditsList directory audit logsread
m365_graph_users.audit_provisioningList provisioning logsread
m365_graph_users.audit_sign_in_getGet one sign-in recordread
m365_graph_users.audit_sign_insList sign-in logsread

Questions

The Microsoft 365 Users MCP server, answered.

Is there a Microsoft 365 Users MCP server for Claude?

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 274 Microsoft 365 Users actions across directory, applications, authentication and roles, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Microsoft 365 Users.

What do I need to connect Microsoft 365 Users?

Entra application (client) id and Entra client secret. Plus your tenant id. The free call account { op: "connections.requirements", service: "m365_graph_users" } lists exactly what to paste.

Can an AI agent delete or change things in Microsoft 365 Users?

Only if its key allows it, and only with an explicit confirmation. 53 Microsoft 365 Users actions are destructive, including delete a user, delete a group and delete a role definition. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

Will an AI agent use up my Microsoft 365 Users API limit?

actionlake paces every call to the limits in the Microsoft 365 Users service file: 10,000 calls per 10 minutes per connection. Repeated reads are answered from cache (155 Microsoft 365 Users actions can be), which never reaches Microsoft 365 Users.

What does a Microsoft 365 Users action cost?

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (106 Microsoft 365 Users actions page). Cache hits, searches, dry runs and calls Microsoft 365 Users refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

Which Microsoft 365 Users API does it cover?

The Microsoft 365 Users API v1.0 at graph.microsoft.com/v1.0. It is built from Microsoft 365 Users's documentation as read on 8 September 2026. 274 actions in 8 areas, each one in the signed service file (version 1.0.0).

Can I combine Microsoft 365 Users with my other systems?

Yes. ask joins Microsoft 365 Users to HaloPSA or NetSuite on the same customer and returns the answer rather than every row. Microsoft 365 Users maps crm.contact, which 192 other connectors also map.

Does actionlake keep my Microsoft 365 Users data, and where?

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to an hour, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Microsoft 365 Users credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

Which AI clients can use it?

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

Give your agent Microsoft 365 Users today.

Connect Microsoft 365 Users free See pricing

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.

Microsoft 365 Users MCP server for AI agents.

Connect Microsoft 365 Users in three steps.

Add actionlake to Claude.

Connect Microsoft 365 Users.

Make the first call. Check before a write.

What an AI agent can do in Microsoft 365 Users.

Directory

Applications

Authentication

Roles

Policy

Organization

Licensing

Audit

The Microsoft 365 Users API, shaped for agents.

Prompts to paste into Claude.

Microsoft 365 Users, joined to the rest of your business.

Ready-made plans for Microsoft 365 Users.

Report subscribed SKUs against actual per-user assignment

Audit who holds privileged directory roles

Find dormant accounts and disable them after approval

Invite an external guest and place them in a group

Onboard a new employee with licence, manager and groups

Grant a directory role to a user after sign-off

Offboard a departing user and reclaim their licences

Lock down a suspected compromised account

Move a user to a new department, manager and group

Destructive actions wait for a yes.

What Microsoft 365 Users costs on actionlake.

Every Microsoft 365 Users action.

The Microsoft 365 Users MCP server, answered.

More connectors like Microsoft 365 Users

Give your agent Microsoft 365 Users today.