---
title: "Microsoft 365 Users MCP server for AI agents - actionlake"
description: "Give Claude 274 Microsoft 365 Users actions through one MCP server: directory, applications. Your agent never holds the credential. 100,000 calls a month free."
canonical: https://actionlake.com/connectors/microsoft-365-users
updated: 2026-10-11
---

Connectors · Identity & security

# Microsoft 365 Users MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Microsoft 365 Users and the rest of your systems. It gives your agent 274 Microsoft 365 Users actions (160 reads, 61 writes and 53 that wait for a confirmation) and holds the Microsoft 365 Users credential itself, so the agent never does. It paces Microsoft 365 Users's limits and records every call.

[Connect Microsoft 365 Users free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing)

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

`claude mcp add --transport http actionlake https://connect.actionlake.com/mcp`

the first call

```
do {
  action: "m365_graph_users.users_list",
  intent: "check which Microsoft 365 Users account is connected"
}
# List users · read · 1 upstream call
```

- 274 actions in one signed file
- 160 read look, never change
- 61 write create and update
- 53 wait for a yes destructive, confirmed first

Set up

## Connect Microsoft 365 Users in three steps.

1. 01
   ### Add actionlake to Claude.
   Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
   `https://connect.actionlake.com/mcp`
2. 02
   ### Connect Microsoft 365 Users.
   OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key.
   - `client_id` Entra application (client) id
   - `client_secret` Entra client secret
   - `tenant_id` Your Microsoft 365 Users tenant id
   ```
   account { op: "connections.requirements", service: "m365_graph_users" }
   # free: exactly what to paste, and what is found for you
   ```
3. 03
   ### Make the first call. Check before a write.
   Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free.
   ```
   do    { action: "m365_graph_users.users_list" }
   # list users · read · 1 upstream call
   check { action: "m365_graph_users.users_create", input: { … } }
   # free: inputs, permissions, cost and confirmations, nothing sent
   ```

Microsoft 365 Users at a glance

**Sign-in**

OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in.

**You provide**

`client_id` `client_secret`

**Setup fields**

`tenant_id`

**Limits we pace to**

10,000 calls per 10 minutes, per connection

**API covered**

Microsoft 365 Users API v1.0`graph.microsoft.com/v1.0`

**Built from**

Microsoft 365 Users's documentation, read 8 September 2026[learn.microsoft.com](https://learn.microsoft.com/en-us/graph/api/overview)

**Service file**

Version 1.0.0, signed (Ed25519)

**Cached reads**

155 of 160 reads, for up to an hour; a write clears what it affects

**Ready-made plans**

9 in the store

**Shared entities**

8, so ask can line Microsoft 365 Users up with your other systems

**Data**

Processed and stored in Sydney, Australia. No US region yet

Capabilities

## What an AI agent can do in Microsoft 365 Users.

274 actions in 8 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

- **160** read look, never change
- **61** write create and update
- **53** destructive wait for a confirmation

1. ### Directory
   106
   67 read · 24 write · 15 destructive
   List users · List groups · Create a user · Track user changes (delta)
2. ### Applications
   44
   21 read · 12 write · 11 destructive
   List service principals · Create a service principal · Get a service principal · Update a service principal
3. ### Authentication
   42
   25 read · 5 write · 12 destructive
   List a user's authentication methods · Revoke a user's sign-in sessions · Reset a user's password · List authentication strength policies
4. ### Roles
   28
   16 read · 3 write · 9 destructive
   List directory roles · List directory role templates · List directory role definitions · Create a role definition
5. ### Policy
   25
   13 read · 8 write · 4 destructive
   List conditional access policies · Create a conditional access policy · Update a conditional access policy · Get a conditional access policy
6. ### Organization
   17
   9 read · 6 write · 2 destructive
   Create a domain · List domains · Get a domain · Update a domain
7. ### Licensing
   7
   4 read · 3 write · 0 destructive
   List subscribed SKUs · List group members with licence errors · List a user's licences · Get a subscribed SKU
8. ### Audit
   5
   5 read · 0 write · 0 destructive
   List directory audit logs · List sign-in logs · List provisioning logs · Get one directory audit record

Top actions

## The Microsoft 365 Users API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 141 of Microsoft 365 Users's 150 action names are shared with at least one other connector, so an agent learns them once.

| Action | What it does | Effect | Same name in |
| --- | --- | --- | --- |
| `m365_graph_users.users_list` List users | List users in the tenant directory. Graph returns a default property subset; name others with `select`. | read | `identity.user.list` 474 connectors |
| `m365_graph_users.groups_list` List groups | List groups in the tenant directory. | read | `identity.group.list` 262 connectors |
| `m365_graph_users.directory_roles_list` List directory roles | List directory roles in the tenant directory. Only roles that have been activated in the tenant appear here. | read | `identity.role.list` 184 connectors |
| `m365_graph_users.users_create` Create a user | Create a user in the tenant directory. | write | `identity.user.create` 262 connectors |
| `m365_graph_users.groups_create` Create a group | Create a group in the tenant directory. | write | `identity.group.create` 205 connectors |
| `m365_graph_users.service_principals_list` List service principals | List service principals in the tenant directory. These are the tenant's enterprise applications. | read | `identity.service_account.list` 35 connectors |
| `m365_graph_users.devices_list` List devices | List devices in the tenant directory. | read | `device.endpoint.list` 65 connectors |
| `m365_graph_users.role_definitions_list` List directory role definitions | List directory role definitions in the tenant directory. Every built-in and custom role, with the resource actions each grants. | read | `identity.role.list` 184 connectors |
| `m365_graph_users.users_delete` Delete a user | Delete a user. Directory objects go to deletedItems for 30 days. | destructive | `identity.user.delete` 253 connectors |
| `m365_graph_users.org_contacts_list` List organizational contacts | List organizational contacts in the tenant directory. These are directory mail contacts synced from on-premises, not personal contacts. | read | `crm.contact.list` 177 connectors |
| `m365_graph_users.subscribed_skus` List subscribed SKUs | List the licence SKUs the tenant has bought, with consumed and enabled unit counts. This is how you find out how many seats are left. Not paged by Graph. | read | `identity.license.list` 10 connectors |
| `m365_graph_users.service_principals_create` Create a service principal | Create a service principal in the tenant directory. | write | `identity.service_account.create` 32 connectors |

Try it

## Prompts to paste into Claude.

Each one names the Microsoft 365 Users actions it will call, so you know what it reads and what it changes before you send it.

1. Read read
   Which Microsoft 365 Users devices have not checked in for a week?
   calls `m365_graph_users.devices_list`
2. Plan destructive
   Lock down a suspected compromised account in Microsoft 365 Users. Ask me before anything is sent or changed.
   calls `m365_graph_users.users_get` `m365_graph_users.audit_sign_ins` `m365_graph_users.users_auth_methods` `m365_graph_users.users_update` `m365_graph_users.users_revoke_sessions` +1 more
3. Plan destructive
   Move a user to a new department, manager and group in Microsoft 365 Users. Ask me before anything is sent or changed.
   calls `m365_graph_users.users_get` `m365_graph_users.users_member_of` `m365_graph_users.users_update` `m365_graph_users.users_set_manager` `m365_graph_users.groups_add_member` +1 more
4. Write write
   Create a user in Microsoft 365 Users. Show me exactly what you will send before you save it.
   calls `m365_graph_users.users_create`
5. Across systems read
   Which contacts are in both Microsoft 365 Users and HaloPSA, and how many are in only one of them?
   calls `m365_graph_users.org_contacts_list` `halopsa.users.list`

Across your systems

## Microsoft 365 Users, joined to the rest of your business.

One `ask` fetches from Microsoft 365 Users and another system, joins the rows on the same customer on our side, and hands your agent the answer, not every row.

- Which contacts are in both Microsoft 365 Users and HaloPSA, and how many are in only one of them?
  `m365_graph_users.org_contacts_list` + `halopsa.users.list`, on `crm.contact` · [HaloPSA](https://actionlake.com/connectors/halopsa)
- Which contacts are in both Microsoft 365 Users and NetSuite, and how many are in only one of them?
  `m365_graph_users.org_contacts_list` + `netsuite.views.contacts`, on `crm.contact` · [NetSuite](https://actionlake.com/connectors/netsuite)

Also mapped by other connectors `identity.user` **517** `identity.group` **239** `crm.contact` **192** `identity.role` **107** `device.endpoint` **69** `platform.tenant` **67** `identity.service_account` **23** `identity.license` **4**

ask

```
ask {
  intent: "which contacts are in both Microsoft 365 Users and HaloPSA, and how many are in only one of them",
  steps: [
    { action: "m365_graph_users.org_contacts_list", as: "people", input: {}, limit: 100, max_pages: 5 },
    { action: "halopsa.users.list", as: "people2", input: {}, limit: 100, max_pages: 5 },
    { join: {
        left: "people",
        right: "people2",
        on: "crm.contact",
        group_by: "people.email",
        select: ["people.email", "count(people2.id) as in_halopsa"]
    } }
  ]
}
```

Example. Run it through check first: it validates the steps and prices them, and it is free.

The plan store

## Ready-made plans for Microsoft 365 Users.

9 plans in the store. Install one and your agent runs it by name; the reply says which connections are still missing. A schedule can run a plan on a timetable. There are no triggers or webhooks, by design.

1. ### Report subscribed SKUs against actual per-user assignment
   Use it when Someone asks which licences are bought, which are actually assigned, and where seats are being wasted.
   **Effect**
   read
   **Steps**
   3 · loops
   **Install**
   `m365_graph_users-licence-usage-report`
2. ### Audit who holds privileged directory roles
   Use it when A security or compliance review asks who currently holds admin roles and how that privilege was granted.
   **Effect**
   read
   **Steps**
   4 · loops
   **Install**
   `m365_graph_users-privileged-role-audit`
3. ### Find dormant accounts and disable them after approval
   Use it when A periodic security review needs dormant or unused accounts identified and switched off.
   A person decides Disable the enabled accounts with no interactive sign-in since _window start_, based on _enabled users_ accounts checked against _recent sign ins_ sign-in records.
   **Effect**
   write
   **Steps**
   5 · loops
   **Needs**
   cutoff
   **Install**
   `m365_graph_users-stale-account-cleanup`
4. ### Invite an external guest and place them in a group
   Use it when An external partner or contractor needs guest access to the tenant and membership of a specific collaboration group.
   A person decides Invite external guest _guest email_ into the tenant and add them to group _group id_.
   **Effect**
   write
   **Steps**
   6
   **Needs**
   group id, guest display name, guest email, mail nickname and redirect url
   **Install**
   `m365_graph_users-guest-invite-and-place`
5. ### Onboard a new employee with licence, manager and groups
   Use it when A new starter needs an account created, licensed, placed under a manager and added to their team group in one pass.
   A person decides Assign licence _sku id_ to the newly created account _user principal name_. This consumes a paid seat.
   **Effect**
   write
   **Steps**
   6
   **Needs**
   department, display name, group id, initial password, mail nickname, manager id, sku id and user principal name
   **Install**
   `m365_graph_users-onboard-new-employee`
6. ### Grant a directory role to a user after sign-off
   Use it when Someone needs to be given an admin role and the grant must be signed off and evidenced.
   A person decides Grant the role _displayName_ to _displayName_ (_userPrincipalName_) at scope _directory scope id_.
   **Effect**
   destructive
   **Steps**
   6
   **Needs**
   directory scope id, role definition id and user id
   **Install**
   `m365_graph_users-grant-admin-role`
7. ### Offboard a departing user and reclaim their licences
   Use it when Someone has left the organisation and their access must be cut off and their paid seat reclaimed.
   A person decides Disable _displayName_ (_userPrincipalName_), revoke all their sessions and remove licence _sku id_.
   **Effect**
   destructive
   **Steps**
   7
   **Needs**
   sku id and user id
   **Install**
   `m365_graph_users-offboard-departing-user`
8. ### Lock down a suspected compromised account
   Use it when An account is suspected of being compromised and access must be cut immediately with evidence captured first.
   A person decides Lock down _displayName_ (_userPrincipalName_): disable the account, revoke all sessions and force a password reset.
   **Effect**
   destructive
   **Steps**
   8
   **Needs**
   new password, password method id and user id
   **Install**
   `m365_graph_users-compromised-account-lockdown`
9. ### Move a user to a new department, manager and group
   Use it when An existing employee changes department or reporting line and their directory record and groups must follow.
   A person decides Remove _displayName_ (_userPrincipalName_) from group _old group id_.
   **Effect**
   destructive
   **Steps**
   8
   **Needs**
   new department, new group id, new job title, new manager id, old group id and user id
   **Install**
   `m365_graph_users-department-transfer`

install a plan

```
account { op: "plans.install", slug: "m365_graph_users-licence-usage-report" }
# then ask for it by name; a schedule can run it on a timetable
```

Governance for Microsoft 365 Users

## Destructive actions wait for a yes.

53 Microsoft 365 Users actions are destructive. The first 10:

- Delete a user `m365_graph_users.users_delete`
- Delete a group `m365_graph_users.groups_delete`
- Delete a role definition `m365_graph_users.role_definitions_delete`
- Delete a service principal `m365_graph_users.service_principals_delete`
- Delete a device `m365_graph_users.devices_delete`
- Delete an application `m365_graph_users.applications_delete`
- Remove a member from a group `m365_graph_users.groups_remove_member`
- Delete a domain `m365_graph_users.domains_delete`
- Delete a role assignment `m365_graph_users.role_assignments_delete`
- Remove a member from a directory role `m365_graph_users.directory_roles_remove_member`

A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

do m365_graph_users.users_delete confirm_policy: **human**

Delete a user?

**intent:** the user asked me to delete a user

run suspended · waiting for a named person · key _m365-graph-users-agent_ cannot confirm itself

In the console, or from an emailed signed link.

a key for this connector

```
account {
  op: "keys.create", name: "m365-graph-users-agent",
  allowed_actions: ["m365_graph_users.*"], cap_calls: 2000,
  confirm_policy: "human_for_writes",
  approval_rules: [
    { match: "m365_graph_users.users_delete", approver: "lead@example.com" },
    { match: "m365_graph_users.groups_delete", approver: "lead@example.com" },
    { match: "m365_graph_users.role_definitions_delete", approver: "lead@example.com" }
  ]
}
```

Illustrative. Scoped to Microsoft 365 Users only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

## What Microsoft 365 Users costs on actionlake.

Every Microsoft 365 Users action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call Microsoft 365 Users refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

- 1 upstream call per action all 274 Microsoft 365 Users actions
- 106 actions page each page of a long list is one call
- 155 reads can be cached a cache hit costs nothing
- 100,000 calls a month, free paid plans from US$49 a month for 250,000

[See pricing](https://actionlake.com/pricing)

Action index

## Every Microsoft 365 Users action.

274 actions by area: the id your agent calls, what it does, and its effect.

**Directory 106**

- `m365_graph_users.administrative_units_add_member` Add a member to an administrative unit write
- `m365_graph_users.administrative_units_create` Create an administrative unit write
- `m365_graph_users.administrative_units_delete` Delete an administrative unit destructive
- `m365_graph_users.administrative_units_get` Get an administrative unit read
- `m365_graph_users.administrative_units_list` List administrative units read
- `m365_graph_users.administrative_units_members` List an administrative unit's members read
- `m365_graph_users.administrative_units_remove_member` Remove a member from an administrative unit destructive
- `m365_graph_users.administrative_units_update` Update an administrative unit write
- `m365_graph_users.batch` Run up to 20 Graph requests in one call write
- `m365_graph_users.devices_add_registered_owner` Add a registered owner to a device write
- `m365_graph_users.devices_create` Create a device write
- `m365_graph_users.devices_delete` Delete a device destructive
- `m365_graph_users.devices_delta` Track device changes (delta) read
- `m365_graph_users.devices_extensions` List a device's open extensions read
- `m365_graph_users.devices_get` Get a device read
- `m365_graph_users.devices_list` List devices read
- `m365_graph_users.devices_member_of` List a device's groups read
- `m365_graph_users.devices_registered_owners` List a device's registered owners read
- `m365_graph_users.devices_registered_users` List a device's registered users read
- `m365_graph_users.devices_remove_registered_owner` Remove a registered owner from a device destructive
- `m365_graph_users.devices_transitive_member_of` List a device's groups including nested read
- `m365_graph_users.devices_update` Update a device write
- `m365_graph_users.directory_deleted_groups` List deleted groups read
- `m365_graph_users.directory_deleted_item_get` Get a deleted directory object read
- `m365_graph_users.directory_deleted_item_purge` Permanently delete a directory object destructive
- `m365_graph_users.directory_deleted_items` List deleted users read
- `m365_graph_users.directory_objects_delete` Delete a directory object destructive
- `m365_graph_users.directory_objects_get` Get a directory object read
- `m365_graph_users.directory_objects_get_available_extension_properties` List available directory extension properties read
- `m365_graph_users.directory_objects_get_by_ids` Resolve directory objects by id read
- `m365_graph_users.directory_objects_validate_properties` Validate a group's display name and alias read
- `m365_graph_users.groups_add_member` Add a member to a group write
- `m365_graph_users.groups_add_owner` Add an owner to a group write
- `m365_graph_users.groups_check_member_groups` Check which of these groups a group is in read
- `m365_graph_users.groups_create` Create a group write
- `m365_graph_users.groups_delete` Delete a group destructive
- `m365_graph_users.groups_delta` Track group changes (delta) read
- `m365_graph_users.groups_extension_create` Create a group open extension write
- `m365_graph_users.groups_extension_delete` Delete a group open extension destructive
- `m365_graph_users.groups_extensions` List a group's open extensions read
- `m365_graph_users.groups_get` Get a group read
- `m365_graph_users.groups_get_member_groups` List every group a group is transitively in read
- `m365_graph_users.groups_get_member_objects` List every directory object a group is in read
- `m365_graph_users.groups_list` List groups read
- `m365_graph_users.groups_member_of` List a group's parent groups read
- `m365_graph_users.groups_members` List a group's direct members read
- `m365_graph_users.groups_owners` List a group's owners read
- `m365_graph_users.groups_photo` Get a group's photo metadata read
- `m365_graph_users.groups_remove_member` Remove a member from a group destructive
- `m365_graph_users.groups_remove_owner` Remove an owner from a group destructive
- `m365_graph_users.groups_renew` Renew a group's expiration write
- `m365_graph_users.groups_search` Search groups read
- `m365_graph_users.groups_setting_create` Create a group setting write
- `m365_graph_users.groups_setting_delete` Delete a group setting destructive
- `m365_graph_users.groups_setting_get` Get one group setting read
- `m365_graph_users.groups_setting_update` Update a group setting write
- `m365_graph_users.groups_settings` List a group's settings read
- `m365_graph_users.groups_transitive_member_of` List a group's parents including nested read
- `m365_graph_users.groups_transitive_members` List a group's members including nested read
- `m365_graph_users.groups_update` Update a group write
- `m365_graph_users.invitations_create` Invite a guest user write
- `m365_graph_users.invitations_list` List guest invitations read
- `m365_graph_users.org_contacts_direct_reports` List an organizational contact's direct reports read
- `m365_graph_users.org_contacts_get` Get an organizational contact read
- `m365_graph_users.org_contacts_list` List organizational contacts read
- `m365_graph_users.org_contacts_manager` Get an organizational contact's manager read
- `m365_graph_users.org_contacts_member_of` List an organizational contact's groups read
- `m365_graph_users.org_contacts_transitive_member_of` List an organizational contact's groups including nested read
- `m365_graph_users.users_check_member_groups` Check which of these groups a user is in read
- `m365_graph_users.users_check_member_objects` Check which of these directory objects a user is in read
- `m365_graph_users.users_create` Create a user write
- `m365_graph_users.users_created_objects` List objects a user created read
- `m365_graph_users.users_delete` Delete a user destructive
- `m365_graph_users.users_delta` Track user changes (delta) read
- `m365_graph_users.users_direct_reports` List a user's direct reports read
- `m365_graph_users.users_export_personal_data` Export a user's personal data write
- `m365_graph_users.users_extension_create` Create a user open extension write
- `m365_graph_users.users_extension_delete` Delete a user open extension destructive
- `m365_graph_users.users_extension_get` Get one user open extension read
- `m365_graph_users.users_extensions` List a user's open extensions read
- `m365_graph_users.users_get` Get a user read
- `m365_graph_users.users_get_member_groups` List every group a user is transitively in read
- `m365_graph_users.users_get_member_objects` List every directory object a user is transitively in read
- `m365_graph_users.users_list` List users read
- `m365_graph_users.users_manager` Get a user's manager read
- `m365_graph_users.users_member_of` List a user's direct groups read
- `m365_graph_users.users_on_premises_sync` Get a user's on-premises sync behaviour read
- `m365_graph_users.users_owned_devices` List devices a user owns read
- `m365_graph_users.users_owned_objects` List objects a user owns read
- `m365_graph_users.users_people` List people relevant to a user read
- `m365_graph_users.users_photo` Get a user's photo metadata read
- `m365_graph_users.users_photo_delete` Delete a user's photo destructive
- `m365_graph_users.users_photos` List a user's photo sizes read
- `m365_graph_users.users_registered_devices` List devices registered to a user read
- `m365_graph_users.users_remove_manager` Remove a user's manager destructive
- `m365_graph_users.users_restore` Restore a deleted directory object write
- `m365_graph_users.users_retry_provisioning` Retry a user's service provisioning write
- `m365_graph_users.users_search` Search users read
- `m365_graph_users.users_service_provisioning_errors` List a user's provisioning errors read
- `m365_graph_users.users_set_manager` Set a user's manager write
- `m365_graph_users.users_settings` Get a user's settings read
- `m365_graph_users.users_settings_update` Update a user's settings write
- `m365_graph_users.users_sponsor_of` List users this user sponsors read
- `m365_graph_users.users_sponsors` List a user's sponsors read
- `m365_graph_users.users_transitive_member_of` List every group a user is in, including nested read
- `m365_graph_users.users_update` Update a user write

**Applications 44**

- `m365_graph_users.applications_add_key` Add a certificate to an application write
- `m365_graph_users.applications_add_owner` Add an owner to an application write
- `m365_graph_users.applications_add_password` Add a client secret to an application write
- `m365_graph_users.applications_create` Create an application write
- `m365_graph_users.applications_delete` Delete an application destructive
- `m365_graph_users.applications_delta` Track application changes (delta) read
- `m365_graph_users.applications_extension_properties` List an application's directory extension properties read
- `m365_graph_users.applications_extension_property_create` Create a directory extension property write
- `m365_graph_users.applications_extension_property_delete` Delete a directory extension property destructive
- `m365_graph_users.applications_federated_credential_create` Create a federated identity credential write
- `m365_graph_users.applications_federated_credential_delete` Delete a federated identity credential destructive
- `m365_graph_users.applications_federated_identity_credentials` List an application's federated identity credentials read
- `m365_graph_users.applications_get` Get an application read
- `m365_graph_users.applications_list` List applications read
- `m365_graph_users.applications_owners` List an application's owners read
- `m365_graph_users.applications_remove_key` Remove a certificate from an application destructive
- `m365_graph_users.applications_remove_owner` Remove an owner from an application destructive
- `m365_graph_users.applications_remove_password` Remove a client secret from an application destructive
- `m365_graph_users.applications_set_verified_publisher` Set an application's verified publisher write
- `m365_graph_users.applications_update` Update an application write
- `m365_graph_users.directory_deleted_applications` List deleted applications read
- `m365_graph_users.oauth2_permission_grant_create` Create an OAuth2 permission grant write
- `m365_graph_users.oauth2_permission_grant_delete` Delete an OAuth2 permission grant destructive
- `m365_graph_users.oauth2_permission_grant_get` Get an OAuth2 permission grant read
- `m365_graph_users.oauth2_permission_grants` List OAuth2 delegated permission grants read
- `m365_graph_users.service_principals_add_password` Add a secret to a service principal write
- `m365_graph_users.service_principals_app_role_assigned_to` List who is assigned to an enterprise application read
- `m365_graph_users.service_principals_app_role_assignments` List app roles this service principal holds read
- `m365_graph_users.service_principals_assign_app_role` Assign a user or group to an enterprise application destructive
- `m365_graph_users.service_principals_create` Create a service principal write
- `m365_graph_users.service_principals_delegated_permission_classifications` List a service principal's permission classifications read
- `m365_graph_users.service_principals_delete` Delete a service principal destructive
- `m365_graph_users.service_principals_delta` Track service principal changes (delta) read
- `m365_graph_users.service_principals_get` Get a service principal read
- `m365_graph_users.service_principals_list` List service principals read
- `m365_graph_users.service_principals_member_of` List a service principal's groups and roles read
- `m365_graph_users.service_principals_oauth2_grants` List a service principal's delegated grants read
- `m365_graph_users.service_principals_owned_objects` List objects a service principal owns read
- `m365_graph_users.service_principals_owners` List a service principal's owners read
- `m365_graph_users.service_principals_remove_app_role_assignment` Remove an assignment from an enterprise application destructive
- `m365_graph_users.service_principals_remove_password` Remove a secret from a service principal destructive
- `m365_graph_users.service_principals_update` Update a service principal write
- `m365_graph_users.users_app_role_assignments` List a user's app role assignments read
- `m365_graph_users.users_oauth2_grants` List a user's delegated permission grants read

**Authentication 42**

- `m365_graph_users.authentication_methods_policy` Get the authentication methods policy read
- `m365_graph_users.authentication_strength_policies` List authentication strength policies read
- `m365_graph_users.organization_certificate_based_auth` List certificate-based auth configuration read
- `m365_graph_users.users_auth_email_create` Register an email authentication method write
- `m365_graph_users.users_auth_email_delete` Delete an email authentication method destructive
- `m365_graph_users.users_auth_email_get` Get one email authentication method read
- `m365_graph_users.users_auth_email_list` List a user's email authentication methods read
- `m365_graph_users.users_auth_fido2_delete` Delete a FIDO2 security key destructive
- `m365_graph_users.users_auth_fido2_get` Get one FIDO2 security key read
- `m365_graph_users.users_auth_fido2_list` List a user's FIDO2 security keys read
- `m365_graph_users.users_auth_method_get` Get one authentication method read
- `m365_graph_users.users_auth_methods` List a user's authentication methods read
- `m365_graph_users.users_auth_microsoft_authenticator_delete` Delete a Microsoft Authenticator registration destructive
- `m365_graph_users.users_auth_microsoft_authenticator_get` Get one Microsoft Authenticator registration read
- `m365_graph_users.users_auth_microsoft_authenticator_list` List a user's Microsoft Authenticator registrations read
- `m365_graph_users.users_auth_operations` List authentication long-running operations read
- `m365_graph_users.users_auth_password_delete` Delete a password method destructive
- `m365_graph_users.users_auth_password_get` Get one password method read
- `m365_graph_users.users_auth_password_list` List a user's password methods read
- `m365_graph_users.users_auth_password_reset` Reset a user's password write
- `m365_graph_users.users_auth_phone_create` Register a phone authentication method write
- `m365_graph_users.users_auth_phone_delete` Delete a phone authentication method destructive
- `m365_graph_users.users_auth_phone_disable_sms` Disable SMS sign-in on a phone method destructive
- `m365_graph_users.users_auth_phone_enable_sms` Enable SMS sign-in on a phone method write
- `m365_graph_users.users_auth_phone_get` Get one phone authentication method read
- `m365_graph_users.users_auth_phone_list` List a user's phone authentication methods read
- `m365_graph_users.users_auth_platform_credential_delete` Delete a platform credential destructive
- `m365_graph_users.users_auth_platform_credential_get` Get one platform credential read
- `m365_graph_users.users_auth_platform_credential_list` List a user's platform credentials read
- `m365_graph_users.users_auth_software_oath_delete` Delete a software OATH token destructive
- `m365_graph_users.users_auth_software_oath_get` Get one software OATH token read
- `m365_graph_users.users_auth_software_oath_list` List a user's software OATH tokens read
- `m365_graph_users.users_auth_temporary_access_pass_create` Register a Temporary Access Pass destructive
- `m365_graph_users.users_auth_temporary_access_pass_delete` Delete a Temporary Access Pass destructive
- `m365_graph_users.users_auth_temporary_access_pass_get` Get one Temporary Access Pass read
- `m365_graph_users.users_auth_temporary_access_pass_list` List a user's Temporary Access Passes read
- `m365_graph_users.users_auth_windows_hello_for_business_delete` Delete a Windows Hello for Business credential destructive
- `m365_graph_users.users_auth_windows_hello_for_business_get` Get one Windows Hello for Business credential read
- `m365_graph_users.users_auth_windows_hello_for_business_list` List a user's Windows Hello for Business credentials read
- `m365_graph_users.users_authentication` Get a user's authentication container read
- `m365_graph_users.users_change_password` Change the signed-in user's password write
- `m365_graph_users.users_revoke_sessions` Revoke a user's sign-in sessions destructive

**Roles 28**

- `m365_graph_users.administrative_units_add_scoped_role_member` Grant a scoped role in an administrative unit destructive
- `m365_graph_users.administrative_units_remove_scoped_role_member` Revoke a scoped role in an administrative unit destructive
- `m365_graph_users.administrative_units_scoped_role_members` List an administrative unit's scoped role members read
- `m365_graph_users.directory_role_templates_get` Get a directory role template read
- `m365_graph_users.directory_role_templates_list` List directory role templates read
- `m365_graph_users.directory_roles_activate` Activate a directory role write
- `m365_graph_users.directory_roles_add_member` Add a member to a directory role destructive
- `m365_graph_users.directory_roles_get` Get a directory role read
- `m365_graph_users.directory_roles_list` List directory roles read
- `m365_graph_users.directory_roles_members` List a directory role's members read
- `m365_graph_users.directory_roles_remove_member` Remove a member from a directory role destructive
- `m365_graph_users.directory_roles_scoped_members` List a directory role's AU-scoped members read
- `m365_graph_users.role_assignment_schedule_request_cancel` Cancel a role activation request destructive
- `m365_graph_users.role_assignment_schedule_request_create` Request a role activation or assignment destructive
- `m365_graph_users.role_assignment_schedule_requests` List role activation requests read
- `m365_graph_users.role_assignment_schedules` List active role assignment schedules read
- `m365_graph_users.role_assignments_create` Create a role assignment destructive
- `m365_graph_users.role_assignments_delete` Delete a role assignment destructive
- `m365_graph_users.role_assignments_get` Get a role assignment read
- `m365_graph_users.role_assignments_list` List directory role assignments read
- `m365_graph_users.role_definitions_create` Create a role definition write
- `m365_graph_users.role_definitions_delete` Delete a role definition destructive
- `m365_graph_users.role_definitions_get` Get a role definition read
- `m365_graph_users.role_definitions_list` List directory role definitions read
- `m365_graph_users.role_definitions_update` Update a role definition write
- `m365_graph_users.role_eligibility_schedules` List eligible role assignments read
- `m365_graph_users.role_resource_namespaces` List RBAC resource namespaces read
- `m365_graph_users.users_scoped_role_member_of` List a user's administrative-unit-scoped roles read

**Policy 25**

- `m365_graph_users.api_connectors_create` Create an API connector write
- `m365_graph_users.api_connectors_delete` Delete an API connector destructive
- `m365_graph_users.api_connectors_get` Get an API connector read
- `m365_graph_users.api_connectors_list` List API connectors read
- `m365_graph_users.api_connectors_update` Update an API connector write
- `m365_graph_users.authentication_context_class_references` List authentication context class references read
- `m365_graph_users.b2x_user_flows` List self-service sign-up user flows read
- `m365_graph_users.conditional_access_policies_create` Create a conditional access policy write
- `m365_graph_users.conditional_access_policies_delete` Delete a conditional access policy destructive
- `m365_graph_users.conditional_access_policies_get` Get a conditional access policy read
- `m365_graph_users.conditional_access_policies_list` List conditional access policies read
- `m365_graph_users.conditional_access_policies_update` Update a conditional access policy write
- `m365_graph_users.conditional_access_templates` List conditional access policy templates read
- `m365_graph_users.groups_lifecycle_policies` List group lifecycle policies read
- `m365_graph_users.groups_lifecycle_policy_create` Create a group lifecycle policy write
- `m365_graph_users.groups_lifecycle_policy_delete` Delete a group lifecycle policy destructive
- `m365_graph_users.groups_lifecycle_policy_get` Get a group lifecycle policy read
- `m365_graph_users.groups_lifecycle_policy_update` Update a group lifecycle policy write
- `m365_graph_users.identity_providers` List identity providers read
- `m365_graph_users.named_locations_create` Create a named location write
- `m365_graph_users.named_locations_delete` Delete a named location destructive
- `m365_graph_users.named_locations_get` Get a named location read
- `m365_graph_users.named_locations_list` List named locations read
- `m365_graph_users.named_locations_update` Update a named location write
- `m365_graph_users.users_agreement_acceptances` List a user's terms-of-use acceptances read

**Organization 17**

- `m365_graph_users.domains_create` Create a domain write
- `m365_graph_users.domains_delete` Delete a domain destructive
- `m365_graph_users.domains_force_delete` Force-delete a domain destructive
- `m365_graph_users.domains_get` Get a domain read
- `m365_graph_users.domains_list` List domains read
- `m365_graph_users.domains_name_references` List objects using a domain read
- `m365_graph_users.domains_promote` Promote a domain to primary write
- `m365_graph_users.domains_service_configuration_records` List a domain's service configuration records read
- `m365_graph_users.domains_update` Update a domain write
- `m365_graph_users.domains_verification_dns_records` List a domain's verification DNS records read
- `m365_graph_users.domains_verify` Verify a domain write
- `m365_graph_users.organization` Get the tenant organization read
- `m365_graph_users.organization_branding` Get the tenant's sign-in branding read
- `m365_graph_users.organization_branding_localizations` List localized sign-in branding read
- `m365_graph_users.organization_get` Get one organization record read
- `m365_graph_users.organization_set_mdm_authority` Set the mobile device management authority write
- `m365_graph_users.organization_update` Update the organization write

**Licensing 7**

- `m365_graph_users.groups_assign_license` Assign or remove group-based licences write
- `m365_graph_users.groups_members_with_license_errors` List group members with licence errors read
- `m365_graph_users.subscribed_sku_get` Get a subscribed SKU read
- `m365_graph_users.subscribed_skus` List subscribed SKUs read
- `m365_graph_users.users_assign_license` Assign or remove user licences write
- `m365_graph_users.users_license_details` List a user's licences read
- `m365_graph_users.users_reprocess_license` Reprocess a user's group-based licences write

**Audit 5**

- `m365_graph_users.audit_directory_audit_get` Get one directory audit record read
- `m365_graph_users.audit_directory_audits` List directory audit logs read
- `m365_graph_users.audit_provisioning` List provisioning logs read
- `m365_graph_users.audit_sign_in_get` Get one sign-in record read
- `m365_graph_users.audit_sign_ins` List sign-in logs read

Questions

## The Microsoft 365 Users MCP server, answered.

**Is there a Microsoft 365 Users MCP server for Claude?**

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 274 Microsoft 365 Users actions across directory, applications, authentication and roles, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Microsoft 365 Users.

**What do I need to connect Microsoft 365 Users?**

Entra application (client) id and Entra client secret. Plus your tenant id. The free call account { op: "connections.requirements", service: "m365_graph_users" } lists exactly what to paste.

**Can an AI agent delete or change things in Microsoft 365 Users?**

Only if its key allows it, and only with an explicit confirmation. 53 Microsoft 365 Users actions are destructive, including delete a user, delete a group and delete a role definition. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

**Will an AI agent use up my Microsoft 365 Users API limit?**

actionlake paces every call to the limits in the Microsoft 365 Users service file: 10,000 calls per 10 minutes per connection. Repeated reads are answered from cache (155 Microsoft 365 Users actions can be), which never reaches Microsoft 365 Users.

**What does a Microsoft 365 Users action cost?**

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (106 Microsoft 365 Users actions page). Cache hits, searches, dry runs and calls Microsoft 365 Users refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

**Which Microsoft 365 Users API does it cover?**

The Microsoft 365 Users API v1.0 at graph.microsoft.com/v1.0. It is built from Microsoft 365 Users's documentation as read on 8 September 2026. 274 actions in 8 areas, each one in the signed service file (version 1.0.0).

**Can I combine Microsoft 365 Users with my other systems?**

Yes. ask joins Microsoft 365 Users to HaloPSA or NetSuite on the same customer and returns the answer rather than every row. Microsoft 365 Users maps crm.contact, which 192 other connectors also map.

**Does actionlake keep my Microsoft 365 Users data, and where?**

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to an hour, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Microsoft 365 Users credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

**Which AI clients can use it?**

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

## More connectors like Microsoft 365 Users

Shares the most action names with

- [Okta 91](https://actionlake.com/connectors/okta)
- [JumpCloud 61](https://actionlake.com/connectors/jumpcloud)
- [PingOne Platform API 53](https://actionlake.com/connectors/pingone-platform-api)
- [Google Workspace Directory 51](https://actionlake.com/connectors/google-workspace-directory)
- [Clerk 37](https://actionlake.com/connectors/clerk)
- [WorkOS 33](https://actionlake.com/connectors/workos)

Joins with, on shared entities

- [Sophos Central 5](https://actionlake.com/connectors/sophos-central)
- [HaloPSA 4](https://actionlake.com/connectors/halopsa)
- [Genesys Cloud CX 4](https://actionlake.com/connectors/genesys-cloud-cx)
- [Commvault Cloud 4](https://actionlake.com/connectors/commvault-cloud)
- [NetBox 4](https://actionlake.com/connectors/netbox)
- [CIPP 4](https://actionlake.com/connectors/cipp)

Browse

- [All Identity & security connectors](https://actionlake.com/connectors/category/identity-and-security)
- [All connectors](https://actionlake.com/connectors)
- [How actionlake compares](https://actionlake.com/compare)

actionlake is independent. It is not made or endorsed by Microsoft 365 Users; the name is the vendor's own. Counts are from the Microsoft 365 Users service file, version 1.0.0.

## Give your agent Microsoft 365 Users today.

[Connect Microsoft 365 Users free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing)

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.

---

Source: https://actionlake.com/connectors/microsoft-365-users
More: https://actionlake.com/llms.txt