Connectors · Identity & security
Microsoft Entra ID Governance (Graph) MCP server for AI agents.
actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Microsoft Entra ID Governance (Graph) and the rest of your systems. It gives your agent 250 Microsoft Entra ID Governance (Graph) actions (157 reads, 57 writes and 36 that wait for a confirmation) and holds the Microsoft Entra ID Governance (Graph) credential itself, so the agent never does. It paces Microsoft Entra ID Governance (Graph)'s limits and records every call.
100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.
claude mcp add --transport http actionlake https://connect.actionlake.com/mcpdo { action: "m365_graph_identity_governance.entitlement_roles_role_definitions_list", intent: "check which Microsoft Entra ID Governance (Graph) account is connected"}# List entitlement roles role definitions · read · 1 upstream call- 250actionsin one signed file
- 157readlook, never change
- 57writecreate and update
- 36wait for a yesdestructive, confirmed first
Set up
Connect Microsoft Entra ID Governance (Graph) in three steps.
- 01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp - 02
Connect Microsoft Entra ID Governance (Graph).
OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key.
client_idEntra application (client) idclient_secretEntra client secrettenant_idYour Microsoft Entra ID Governance (Graph) tenant id
account { op: "connections.requirements", service: "m365_graph_identity_governance" } # free: exactly what to paste, and what is found for you - 03
Make the first call. Check before a write.
Ask in plain words; Claude picks the action. Before anything changes,
checkvalidates the call and prices it, for free.do { action: "m365_graph_identity_governance.entitlement_roles_role_definitions_list" }# list entitlement roles role definitions · read · 1 upstream callcheck { action: "m365_graph_identity_governance.entitlement_assignment_policies_create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent
Microsoft Entra ID Governance (Graph) at a glance
- Sign-in
- OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in.
- You provide
client_idclient_secret- Setup fields
tenant_id- Limits we pace to
- 10,000 calls per 10 minutes, per connection
- API covered
- Microsoft Entra ID Governance (Graph) API v1.0
graph.microsoft.com/v1.0 - Built from
- Microsoft Entra ID Governance (Graph)'s documentation, read 23 October 2026learn.microsoft.com
- Service file
- Version 1.0.0, signed (Ed25519)
- Cached reads
- 154 of 157 reads, for up to an hour; a write clears what it affects
- Shared entities
- 1, so ask can line Microsoft Entra ID Governance (Graph) up with your other systems
- Data
- Processed and stored in Sydney, Australia. No US region yet
Capabilities
What an AI agent can do in Microsoft Entra ID Governance (Graph).
250 actions in 9 areas. Every one carries its effect, so a key can allow the reads and hold the rest.
- 157readlook, never change
- 57writecreate and update
- 36destructivewait for a confirmation
Entitlement management
7838 read · 25 write · 15 destructive
List entitlement assignment policies · Create entitlement assignment policies · Create entitlement assignment requests · List entitlement assignment requests
Lifecycle workflows
5939 read · 12 write · 8 destructive
Create lifecycle custom task extensions · List lifecycle custom task extensions · List lifecycle deleted items workflows · Lifecycle insights top tasks processed summary
Access reviews
3619 read · 16 write · 1 destructive
List access reviews definitions · Create access reviews definitions · Get access reviews definitions · Update access reviews definitions
Pim groups
2722 read · 0 write · 5 destructive
Pim group assignment approvals filter by current user · List pim group assignment approvals stages · Pim group assignment schedule instances filter by current user · List pim group assignment schedule instances
Pim roles
2218 read · 0 write · 4 destructive
Pim directory role eligibility schedule instances filter by current user · List pim directory role eligibility schedule instances · Create pim directory role eligibility schedule requests · Pim directory role eligibility schedule requests filter by current user
Terms of use
95 read · 3 write · 1 destructive
List terms of use agreements acceptances · Create terms of use agreements · List terms of use agreements file localizations · Create terms of use agreements files
Pim policies
76 read · 1 write · 0 destructive
List pim policies role management policies · List pim policies role management policies rules · List pim policies role management policy assignments · Get pim policies role management policies
App consent
66 read · 0 write · 0 destructive
App consent app consent requests filter by current user · List app consent app consent requests · App consent app consent requests user consent requests filter by current user · List app consent app consent requests user consent requests
1 more area · 6 actions
- Entitlement roles 6
Top actions
The Microsoft Entra ID Governance (Graph) API, shaped for agents.
The ids your agent types, what each does, and the one name it shares with other systems. 19 of Microsoft Entra ID Governance (Graph)'s 19 action names are shared with at least one other connector, so an agent learns them once.
| Action | What it does | Effect | Same name in |
|---|---|---|---|
m365_graph_identity_governance.entitlement_roles_role_definitions_listList entitlement roles role definitions | Get a list of unifiedRoleDefinition objects for the provider. The following RBAC providers are currently supported: - directory (Microsoft Entra ID) -… | read | identity.role.list184 connectors |
m365_graph_identity_governance.entitlement_roles_role_definitions_getGet entitlement roles role definitions | Resource representing the roles allowed by RBAC providers and the permissions assigned to the roles. | read | identity.role.get127 connectors |
m365_graph_identity_governance.entitlement_roles_role_assignments_listList entitlement roles role assignments | Get a list of unifiedRoleAssignment objects for the RBAC provider. The following RBAC providers are currently supported: - directory (Microsoft Entra ID) -… | read | identity.role_assignment.list41 connectors |
m365_graph_identity_governance.entitlement_assignment_policies_listList entitlement assignment policies | Retrieve a list of accessPackageAssignmentPolicy objects in Microsoft Entra entitlement management. If the delegated user is in a directory role, the… | read | identity.access_policy.list13 connectors |
m365_graph_identity_governance.entitlement_assignment_policies_createCreate entitlement assignment policies | Create a new accessPackageAssignmentPolicy object in Microsoft Entra entitlement management. The request includes a reference to the accessPackage that… | write | identity.access_policy.create12 connectors |
m365_graph_identity_governance.entitlement_assignment_requests_createCreate entitlement assignment requests | In Microsoft Entra Entitlement Management, create a new accessPackageAssignmentRequest object. This operation is used to assign a user to an access package,… | write | identity.access_request.create12 connectors |
m365_graph_identity_governance.entitlement_assignment_requests_listList entitlement assignment requests | In Microsoft Entra entitlement management, retrieve a list of accessPackageAssignmentRequest objects. The resulting list includes all the assignment requests,… | read | identity.access_request.list10 connectors |
m365_graph_identity_governance.entitlement_roles_role_assignments_getGet entitlement roles role assignments | Resource to grant access to users or groups. | read | identity.role_assignment.get18 connectors |
m365_graph_identity_governance.access_reviews_definitions_listList access reviews definitions | Get a list of the accessReviewScheduleDefinition objects and their properties. | read | identity.access_review.list5 connectors |
m365_graph_identity_governance.access_reviews_definitions_createCreate access reviews definitions | Create a new accessReviewScheduleDefinition object. | write | identity.access_review.create4 connectors |
m365_graph_identity_governance.entitlement_assignment_policies_deleteDelete entitlement assignment policies | In Microsoft Entra entitlement management, delete an accessPackageAssignmentPolicy. | destructive | identity.access_policy.delete14 connectors |
m365_graph_identity_governance.pim_directory_role_eligibility_schedules_listList pim directory role eligibility schedules | Get the unifiedRoleEligibilitySchedule resources from the roleEligibilitySchedules navigation property. | read | this connector |
Try it
Prompts to paste into Claude.
Each one names the Microsoft Entra ID Governance (Graph) actions it will call, so you know what it reads and what it changes before you send it.
- Readread
List entitlement roles role definitions in Microsoft Entra ID Governance (Graph) and tell me what stands out.
calls
m365_graph_identity_governance.entitlement_roles_role_definitions_list - Writewrite
Create entitlement assignment policies in Microsoft Entra ID Governance (Graph). Show me exactly what you will send before you save it.
calls
m365_graph_identity_governance.entitlement_assignment_policies_create
Governance for Microsoft Entra ID Governance (Graph)
Destructive actions wait for a yes.
36 Microsoft Entra ID Governance (Graph) actions are destructive. The first 10:
- Delete entitlement assignment policies
m365_graph_identity_governance.entitlement_assignment_policies_delete - Entitlement assignment requests cancel
m365_graph_identity_governance.entitlement_assignment_requests_cancel - Delete access reviews definitions
m365_graph_identity_governance.access_reviews_definitions_delete - Delete entitlement assignment requests
m365_graph_identity_governance.entitlement_assignment_requests_delete - Create pim directory role eligibility schedule requests
m365_graph_identity_governance.pim_directory_role_eligibility_schedule_requests_create - Pim directory role eligibility schedule requests cancel
m365_graph_identity_governance.pim_directory_role_eligibility_schedule_requests_cancel - Create entitlement roles role assignments
m365_graph_identity_governance.entitlement_roles_role_assignments_create - Create pim group assignment schedule requests
m365_graph_identity_governance.pim_group_assignment_schedule_requests_create - Create pim group eligibility schedule requests
m365_graph_identity_governance.pim_group_eligibility_schedule_requests_create - Create pim directory role assignment schedule requests
m365_graph_identity_governance.pim_directory_role_assignment_schedule_requests_create
A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.
dom365_graph_identity_governance.entitlement_assignment_policies_deleteconfirm_policy: human
Delete entitlement assignment policies?
intent: the user asked me to delete entitlement assignment policies
run suspended · waiting for a named person · key m365-graph-identity-governance-agent cannot confirm itself
In the console, or from an emailed signed link.
account { op: "keys.create", name: "m365-graph-identity-governance-agent", allowed_actions: ["m365_graph_identity_governance.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "m365_graph_identity_governance.entitlement_assignment_policies_delete", approver: "[email protected]" }, { match: "m365_graph_identity_governance.entitlement_assignment_requests_cancel", approver: "[email protected]" }, { match: "m365_graph_identity_governance.access_reviews_definitions_delete", approver: "[email protected]" } ]}Cost
What Microsoft Entra ID Governance (Graph) costs on actionlake.
Every Microsoft Entra ID Governance (Graph) action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Microsoft Entra ID Governance (Graph) refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
- 1upstream call per actionall 250 Microsoft Entra ID Governance (Graph) actions
- 94actions pageeach page of a long list is one call
- 154reads can be cacheda cache hit costs nothing
- 100,000calls a month, freepaid plans from US$49 a month for 250,000
Action index
Every Microsoft Entra ID Governance (Graph) action.
250 actions by area: the id your agent calls, what it does, and its effect.
Entitlement management78
m365_graph_identity_governance.entitlement_access_package_assignment_approvals_filter_by_current_userEntitlement access package assignment approvals filter by current userreadm365_graph_identity_governance.entitlement_access_package_assignment_approvals_getGet entitlement access package assignment approvalsreadm365_graph_identity_governance.entitlement_access_package_assignment_approvals_stages_getGet entitlement access package assignment approvals stagesreadm365_graph_identity_governance.entitlement_access_package_assignment_approvals_stages_listList entitlement access package assignment approvals stagesreadm365_graph_identity_governance.entitlement_access_package_assignment_approvals_stages_updateUpdate entitlement access package assignment approvals stagesdestructivem365_graph_identity_governance.entitlement_access_package_suggestions_filter_by_current_userEntitlement access package suggestions filter by current userreadm365_graph_identity_governance.entitlement_access_packages_access_packages_incompatible_with_listList entitlement access packages access packages incompatible withreadm365_graph_identity_governance.entitlement_access_packages_createCreate entitlement access packageswritem365_graph_identity_governance.entitlement_access_packages_deleteDelete entitlement access packagesdestructivem365_graph_identity_governance.entitlement_access_packages_filter_by_current_userEntitlement access packages filter by current userreadm365_graph_identity_governance.entitlement_access_packages_getGet entitlement access packagesreadm365_graph_identity_governance.entitlement_access_packages_get_applicable_policy_requirementsEntitlement access packages get applicable policy requirementsreadm365_graph_identity_governance.entitlement_access_packages_incompatible_access_packages_addEntitlement access packages incompatible access packages addwritem365_graph_identity_governance.entitlement_access_packages_incompatible_access_packages_listList entitlement access packages incompatible access packagesreadm365_graph_identity_governance.entitlement_access_packages_incompatible_access_packages_removeEntitlement access packages incompatible access packages removedestructivem365_graph_identity_governance.entitlement_access_packages_incompatible_groups_addEntitlement access packages incompatible groups addwritem365_graph_identity_governance.entitlement_access_packages_incompatible_groups_listList entitlement access packages incompatible groupsreadm365_graph_identity_governance.entitlement_access_packages_incompatible_groups_removeEntitlement access packages incompatible groups removedestructivem365_graph_identity_governance.entitlement_access_packages_listList entitlement access packagesreadm365_graph_identity_governance.entitlement_access_packages_resource_role_scopes_createCreate entitlement access packages resource role scopeswritem365_graph_identity_governance.entitlement_access_packages_resource_role_scopes_deleteDelete entitlement access packages resource role scopesdestructivem365_graph_identity_governance.entitlement_access_packages_updateUpdate entitlement access packageswritem365_graph_identity_governance.entitlement_assignment_policies_createCreate entitlement assignment policieswritem365_graph_identity_governance.entitlement_assignment_policies_deleteDelete entitlement assignment policiesdestructivem365_graph_identity_governance.entitlement_assignment_policies_getGet entitlement assignment policiesreadm365_graph_identity_governance.entitlement_assignment_policies_listList entitlement assignment policiesreadm365_graph_identity_governance.entitlement_assignment_policies_updateUpdate entitlement assignment policieswritem365_graph_identity_governance.entitlement_assignment_requests_cancelEntitlement assignment requests canceldestructivem365_graph_identity_governance.entitlement_assignment_requests_createCreate entitlement assignment requestswritem365_graph_identity_governance.entitlement_assignment_requests_deleteDelete entitlement assignment requestsdestructivem365_graph_identity_governance.entitlement_assignment_requests_filter_by_current_userEntitlement assignment requests filter by current userreadm365_graph_identity_governance.entitlement_assignment_requests_getGet entitlement assignment requestsreadm365_graph_identity_governance.entitlement_assignment_requests_listList entitlement assignment requestsreadm365_graph_identity_governance.entitlement_assignment_requests_reprocessEntitlement assignment requests reprocesswritem365_graph_identity_governance.entitlement_assignments_additional_accessEntitlement assignments additional accessreadm365_graph_identity_governance.entitlement_assignments_filter_by_current_userEntitlement assignments filter by current userreadm365_graph_identity_governance.entitlement_assignments_getGet entitlement assignmentsreadm365_graph_identity_governance.entitlement_assignments_listList entitlement assignmentsreadm365_graph_identity_governance.entitlement_assignments_reprocessEntitlement assignments reprocesswritem365_graph_identity_governance.entitlement_available_access_packages_resource_role_scopes_listList entitlement available access packages resource role scopesreadm365_graph_identity_governance.entitlement_catalogs_createCreate entitlement catalogswritem365_graph_identity_governance.entitlement_catalogs_custom_workflow_extensions_createCreate entitlement catalogs custom workflow extensionswritem365_graph_identity_governance.entitlement_catalogs_custom_workflow_extensions_deleteDelete entitlement catalogs custom workflow extensionsdestructivem365_graph_identity_governance.entitlement_catalogs_custom_workflow_extensions_getGet entitlement catalogs custom workflow extensionsreadm365_graph_identity_governance.entitlement_catalogs_custom_workflow_extensions_listList entitlement catalogs custom workflow extensionsreadm365_graph_identity_governance.entitlement_catalogs_custom_workflow_extensions_updateUpdate entitlement catalogs custom workflow extensionswritem365_graph_identity_governance.entitlement_catalogs_deleteDelete entitlement catalogsdestructivem365_graph_identity_governance.entitlement_catalogs_getGet entitlement catalogsreadm365_graph_identity_governance.entitlement_catalogs_listList entitlement catalogsreadm365_graph_identity_governance.entitlement_catalogs_resource_roles_listList entitlement catalogs resource rolesreadm365_graph_identity_governance.entitlement_catalogs_resources_listList entitlement catalogs resourcesreadm365_graph_identity_governance.entitlement_catalogs_resources_upload_sessions_createCreate entitlement catalogs resources upload sessionswritem365_graph_identity_governance.entitlement_catalogs_resources_upload_sessions_deleteDelete entitlement catalogs resources upload sessionsdestructivem365_graph_identity_governance.entitlement_catalogs_resources_upload_sessions_getGet entitlement catalogs resources upload sessionsreadm365_graph_identity_governance.entitlement_catalogs_resources_upload_sessions_listList entitlement catalogs resources upload sessionsreadm365_graph_identity_governance.entitlement_catalogs_resources_upload_sessions_updateUpdate entitlement catalogs resources upload sessionswritem365_graph_identity_governance.entitlement_catalogs_updateUpdate entitlement catalogswritem365_graph_identity_governance.entitlement_connected_organizations_createCreate entitlement connected organizationswritem365_graph_identity_governance.entitlement_connected_organizations_deleteDelete entitlement connected organizationsdestructivem365_graph_identity_governance.entitlement_connected_organizations_external_sponsors_addEntitlement connected organizations external sponsors addwritem365_graph_identity_governance.entitlement_connected_organizations_external_sponsors_removeEntitlement connected organizations external sponsors removedestructivem365_graph_identity_governance.entitlement_connected_organizations_getGet entitlement connected organizationsreadm365_graph_identity_governance.entitlement_connected_organizations_internal_sponsors_addEntitlement connected organizations internal sponsors addwritem365_graph_identity_governance.entitlement_connected_organizations_internal_sponsors_removeEntitlement connected organizations internal sponsors removedestructivem365_graph_identity_governance.entitlement_connected_organizations_listList entitlement connected organizationsreadm365_graph_identity_governance.entitlement_connected_organizations_updateUpdate entitlement connected organizationswritem365_graph_identity_governance.entitlement_external_origin_resource_connectors_createCreate entitlement external origin resource connectorswritem365_graph_identity_governance.entitlement_external_origin_resource_connectors_deleteDelete entitlement external origin resource connectorsdestructivem365_graph_identity_governance.entitlement_external_origin_resource_connectors_getGet entitlement external origin resource connectorsreadm365_graph_identity_governance.entitlement_external_origin_resource_connectors_listList entitlement external origin resource connectorsreadm365_graph_identity_governance.entitlement_external_origin_resource_connectors_updateUpdate entitlement external origin resource connectorswritem365_graph_identity_governance.entitlement_resource_environments_listList entitlement resource environmentsreadm365_graph_identity_governance.entitlement_resource_requests_createCreate entitlement resource requestswritem365_graph_identity_governance.entitlement_resource_requests_listList entitlement resource requestsreadm365_graph_identity_governance.entitlement_settings_getGet entitlement settingsreadm365_graph_identity_governance.entitlement_settings_updateUpdate entitlement settingswritem365_graph_identity_governance.entitlement_subjects_getGet entitlement subjectsreadm365_graph_identity_governance.entitlement_subjects_updateUpdate entitlement subjectswrite
Lifecycle workflows59
m365_graph_identity_governance.lifecycle_custom_task_extensions_createCreate lifecycle custom task extensionswritem365_graph_identity_governance.lifecycle_custom_task_extensions_deleteDelete lifecycle custom task extensionsdestructivem365_graph_identity_governance.lifecycle_custom_task_extensions_getGet lifecycle custom task extensionsreadm365_graph_identity_governance.lifecycle_custom_task_extensions_listList lifecycle custom task extensionsreadm365_graph_identity_governance.lifecycle_custom_task_extensions_updateUpdate lifecycle custom task extensionswritem365_graph_identity_governance.lifecycle_deleted_items_workflows_deleteDelete lifecycle deleted items workflowsdestructivem365_graph_identity_governance.lifecycle_deleted_items_workflows_getGet lifecycle deleted items workflowsreadm365_graph_identity_governance.lifecycle_deleted_items_workflows_listList lifecycle deleted items workflowsreadm365_graph_identity_governance.lifecycle_deleted_items_workflows_restoreLifecycle deleted items workflows restorewritem365_graph_identity_governance.lifecycle_insights_top_tasks_processed_summaryLifecycle insights top tasks processed summaryreadm365_graph_identity_governance.lifecycle_insights_top_workflows_processed_summaryLifecycle insights top workflows processed summaryreadm365_graph_identity_governance.lifecycle_insights_workflows_processed_by_categoryLifecycle insights workflows processed by categoryreadm365_graph_identity_governance.lifecycle_insights_workflows_processed_summaryLifecycle insights workflows processed summaryreadm365_graph_identity_governance.lifecycle_settings_getGet lifecycle settingsreadm365_graph_identity_governance.lifecycle_settings_updateUpdate lifecycle settingswritem365_graph_identity_governance.lifecycle_task_definitions_getGet lifecycle task definitionsreadm365_graph_identity_governance.lifecycle_task_definitions_listList lifecycle task definitionsreadm365_graph_identity_governance.lifecycle_workflow_templates_getGet lifecycle workflow templatesreadm365_graph_identity_governance.lifecycle_workflow_templates_listList lifecycle workflow templatesreadm365_graph_identity_governance.lifecycle_workflows_activateLifecycle workflows activatewritem365_graph_identity_governance.lifecycle_workflows_activate_and_waitLifecycle workflows activate and waitwritem365_graph_identity_governance.lifecycle_workflows_activate_with_scopeLifecycle workflows activate with scopewritem365_graph_identity_governance.lifecycle_workflows_cancel_processingLifecycle workflows cancel processingdestructivem365_graph_identity_governance.lifecycle_workflows_clear_quarantineLifecycle workflows clear quarantinewritem365_graph_identity_governance.lifecycle_workflows_createCreate lifecycle workflowswritem365_graph_identity_governance.lifecycle_workflows_create_new_versionLifecycle workflows create new versionwritem365_graph_identity_governance.lifecycle_workflows_deleteDelete lifecycle workflowsdestructivem365_graph_identity_governance.lifecycle_workflows_getGet lifecycle workflowsreadm365_graph_identity_governance.lifecycle_workflows_listList lifecycle workflowsreadm365_graph_identity_governance.lifecycle_workflows_preview_task_failuresLifecycle workflows preview task failuresreadm365_graph_identity_governance.lifecycle_workflows_preview_workflowLifecycle workflows preview workflowreadm365_graph_identity_governance.lifecycle_workflows_restoreLifecycle workflows restorewritem365_graph_identity_governance.lifecycle_workflows_runs_getGet lifecycle workflows runsreadm365_graph_identity_governance.lifecycle_workflows_runs_listList lifecycle workflows runsreadm365_graph_identity_governance.lifecycle_workflows_runs_subject_processing_results_getGet lifecycle workflows runs subject processing resultsreadm365_graph_identity_governance.lifecycle_workflows_runs_subject_processing_results_listList lifecycle workflows runs subject processing resultsreadm365_graph_identity_governance.lifecycle_workflows_runs_subject_processing_results_task_processing_results_resumeLifecycle workflows runs subject processing results task processing results resumedestructivem365_graph_identity_governance.lifecycle_workflows_runs_summaryLifecycle workflows runs summaryreadm365_graph_identity_governance.lifecycle_workflows_runs_task_processing_results_listList lifecycle workflows runs task processing resultsreadm365_graph_identity_governance.lifecycle_workflows_runs_user_processing_results_getGet lifecycle workflows runs user processing resultsreadm365_graph_identity_governance.lifecycle_workflows_runs_user_processing_results_listList lifecycle workflows runs user processing resultsreadm365_graph_identity_governance.lifecycle_workflows_runs_user_processing_results_summaryLifecycle workflows runs user processing results summaryreadm365_graph_identity_governance.lifecycle_workflows_runs_user_processing_results_task_processing_results_listList lifecycle workflows runs user processing results task processing resultsreadm365_graph_identity_governance.lifecycle_workflows_runs_user_processing_results_task_processing_results_resumeLifecycle workflows runs user processing results task processing results resumedestructivem365_graph_identity_governance.lifecycle_workflows_task_reports_listList lifecycle workflows task reportsreadm365_graph_identity_governance.lifecycle_workflows_task_reports_summaryLifecycle workflows task reports summaryreadm365_graph_identity_governance.lifecycle_workflows_task_reports_task_processing_results_listList lifecycle workflows task reports task processing resultsreadm365_graph_identity_governance.lifecycle_workflows_task_reports_task_processing_results_resumeLifecycle workflows task reports task processing results resumedestructivem365_graph_identity_governance.lifecycle_workflows_tasks_getGet lifecycle workflows tasksreadm365_graph_identity_governance.lifecycle_workflows_tasks_listList lifecycle workflows tasksreadm365_graph_identity_governance.lifecycle_workflows_updateUpdate lifecycle workflowswritem365_graph_identity_governance.lifecycle_workflows_user_processing_results_listList lifecycle workflows user processing resultsreadm365_graph_identity_governance.lifecycle_workflows_user_processing_results_summaryLifecycle workflows user processing results summaryreadm365_graph_identity_governance.lifecycle_workflows_user_processing_results_task_processing_results_listList lifecycle workflows user processing results task processing resultsreadm365_graph_identity_governance.lifecycle_workflows_user_processing_results_task_processing_results_resumeLifecycle workflows user processing results task processing results resumedestructivem365_graph_identity_governance.lifecycle_workflows_versions_getGet lifecycle workflows versionsreadm365_graph_identity_governance.lifecycle_workflows_versions_listList lifecycle workflows versionsreadm365_graph_identity_governance.lifecycle_workflows_versions_tasks_getGet lifecycle workflows versions tasksreadm365_graph_identity_governance.lifecycle_workflows_versions_tasks_listList lifecycle workflows versions tasksread
Access reviews36
m365_graph_identity_governance.access_reviews_definitions_createCreate access reviews definitionswritem365_graph_identity_governance.access_reviews_definitions_deleteDelete access reviews definitionsdestructivem365_graph_identity_governance.access_reviews_definitions_filter_by_current_userAccess reviews definitions filter by current userreadm365_graph_identity_governance.access_reviews_definitions_getGet access reviews definitionsreadm365_graph_identity_governance.access_reviews_definitions_instances_accept_recommendationsAccess reviews definitions instances accept recommendationswritem365_graph_identity_governance.access_reviews_definitions_instances_apply_decisionsAccess reviews definitions instances apply decisionswritem365_graph_identity_governance.access_reviews_definitions_instances_batch_record_decisionsAccess reviews definitions instances batch record decisionswritem365_graph_identity_governance.access_reviews_definitions_instances_contacted_reviewers_listList access reviews definitions instances contacted reviewersreadm365_graph_identity_governance.access_reviews_definitions_instances_decisions_filter_by_current_userAccess reviews definitions instances decisions filter by current userreadm365_graph_identity_governance.access_reviews_definitions_instances_decisions_getGet access reviews definitions instances decisionsreadm365_graph_identity_governance.access_reviews_definitions_instances_decisions_listList access reviews definitions instances decisionsreadm365_graph_identity_governance.access_reviews_definitions_instances_filter_by_current_userAccess reviews definitions instances filter by current userreadm365_graph_identity_governance.access_reviews_definitions_instances_getGet access reviews definitions instancesreadm365_graph_identity_governance.access_reviews_definitions_instances_listList access reviews definitions instancesreadm365_graph_identity_governance.access_reviews_definitions_instances_reset_decisionsAccess reviews definitions instances reset decisionswritem365_graph_identity_governance.access_reviews_definitions_instances_send_reminderAccess reviews definitions instances send reminderwritem365_graph_identity_governance.access_reviews_definitions_instances_stages_accept_recommendationsAccess reviews definitions instances stages accept recommendationswritem365_graph_identity_governance.access_reviews_definitions_instances_stages_batch_record_decisionsAccess reviews definitions instances stages batch record decisionswritem365_graph_identity_governance.access_reviews_definitions_instances_stages_decisions_filter_by_current_userAccess reviews definitions instances stages decisions filter by current userreadm365_graph_identity_governance.access_reviews_definitions_instances_stages_decisions_getGet access reviews definitions instances stages decisionsreadm365_graph_identity_governance.access_reviews_definitions_instances_stages_decisions_listList access reviews definitions instances stages decisionsreadm365_graph_identity_governance.access_reviews_definitions_instances_stages_decisions_updateUpdate access reviews definitions instances stages decisionswritem365_graph_identity_governance.access_reviews_definitions_instances_stages_filter_by_current_userAccess reviews definitions instances stages filter by current userreadm365_graph_identity_governance.access_reviews_definitions_instances_stages_getGet access reviews definitions instances stagesreadm365_graph_identity_governance.access_reviews_definitions_instances_stages_listList access reviews definitions instances stagesreadm365_graph_identity_governance.access_reviews_definitions_instances_stages_stopAccess reviews definitions instances stages stopwritem365_graph_identity_governance.access_reviews_definitions_instances_stages_updateUpdate access reviews definitions instances stageswritem365_graph_identity_governance.access_reviews_definitions_instances_stopAccess reviews definitions instances stopwritem365_graph_identity_governance.access_reviews_definitions_instances_updateUpdate access reviews definitions instanceswritem365_graph_identity_governance.access_reviews_definitions_listList access reviews definitionsreadm365_graph_identity_governance.access_reviews_definitions_updateUpdate access reviews definitionswritem365_graph_identity_governance.access_reviews_history_definitions_createCreate access reviews history definitionswritem365_graph_identity_governance.access_reviews_history_definitions_getGet access reviews history definitionsreadm365_graph_identity_governance.access_reviews_history_definitions_instances_generate_download_uriAccess reviews history definitions instances generate download uriwritem365_graph_identity_governance.access_reviews_history_definitions_instances_listList access reviews history definitions instancesreadm365_graph_identity_governance.access_reviews_history_definitions_listList access reviews history definitionsread
Pim groups27
m365_graph_identity_governance.pim_group_assignment_approvals_filter_by_current_userPim group assignment approvals filter by current userreadm365_graph_identity_governance.pim_group_assignment_approvals_getGet pim group assignment approvalsreadm365_graph_identity_governance.pim_group_assignment_approvals_stages_getGet pim group assignment approvals stagesreadm365_graph_identity_governance.pim_group_assignment_approvals_stages_listList pim group assignment approvals stagesreadm365_graph_identity_governance.pim_group_assignment_approvals_stages_updateUpdate pim group assignment approvals stagesdestructivem365_graph_identity_governance.pim_group_assignment_schedule_instances_filter_by_current_userPim group assignment schedule instances filter by current userreadm365_graph_identity_governance.pim_group_assignment_schedule_instances_getGet pim group assignment schedule instancesreadm365_graph_identity_governance.pim_group_assignment_schedule_instances_listList pim group assignment schedule instancesreadm365_graph_identity_governance.pim_group_assignment_schedule_requests_cancelPim group assignment schedule requests canceldestructivem365_graph_identity_governance.pim_group_assignment_schedule_requests_createCreate pim group assignment schedule requestsdestructivem365_graph_identity_governance.pim_group_assignment_schedule_requests_filter_by_current_userPim group assignment schedule requests filter by current userreadm365_graph_identity_governance.pim_group_assignment_schedule_requests_getGet pim group assignment schedule requestsreadm365_graph_identity_governance.pim_group_assignment_schedule_requests_listList pim group assignment schedule requestsreadm365_graph_identity_governance.pim_group_assignment_schedules_filter_by_current_userPim group assignment schedules filter by current userreadm365_graph_identity_governance.pim_group_assignment_schedules_getGet pim group assignment schedulesreadm365_graph_identity_governance.pim_group_assignment_schedules_listList pim group assignment schedulesreadm365_graph_identity_governance.pim_group_eligibility_schedule_instances_filter_by_current_userPim group eligibility schedule instances filter by current userreadm365_graph_identity_governance.pim_group_eligibility_schedule_instances_getGet pim group eligibility schedule instancesreadm365_graph_identity_governance.pim_group_eligibility_schedule_instances_listList pim group eligibility schedule instancesreadm365_graph_identity_governance.pim_group_eligibility_schedule_requests_cancelPim group eligibility schedule requests canceldestructivem365_graph_identity_governance.pim_group_eligibility_schedule_requests_createCreate pim group eligibility schedule requestsdestructivem365_graph_identity_governance.pim_group_eligibility_schedule_requests_filter_by_current_userPim group eligibility schedule requests filter by current userreadm365_graph_identity_governance.pim_group_eligibility_schedule_requests_getGet pim group eligibility schedule requestsreadm365_graph_identity_governance.pim_group_eligibility_schedule_requests_listList pim group eligibility schedule requestsreadm365_graph_identity_governance.pim_group_eligibility_schedules_filter_by_current_userPim group eligibility schedules filter by current userreadm365_graph_identity_governance.pim_group_eligibility_schedules_getGet pim group eligibility schedulesreadm365_graph_identity_governance.pim_group_eligibility_schedules_listList pim group eligibility schedulesread
Pim roles22
m365_graph_identity_governance.pim_directory_role_assignment_schedule_instances_filter_by_current_userPim directory role assignment schedule instances filter by current userreadm365_graph_identity_governance.pim_directory_role_assignment_schedule_instances_getGet pim directory role assignment schedule instancesreadm365_graph_identity_governance.pim_directory_role_assignment_schedule_instances_listList pim directory role assignment schedule instancesreadm365_graph_identity_governance.pim_directory_role_assignment_schedule_requests_cancelPim directory role assignment schedule requests canceldestructivem365_graph_identity_governance.pim_directory_role_assignment_schedule_requests_createCreate pim directory role assignment schedule requestsdestructivem365_graph_identity_governance.pim_directory_role_assignment_schedule_requests_filter_by_current_userPim directory role assignment schedule requests filter by current userreadm365_graph_identity_governance.pim_directory_role_assignment_schedule_requests_getGet pim directory role assignment schedule requestsreadm365_graph_identity_governance.pim_directory_role_assignment_schedule_requests_listList pim directory role assignment schedule requestsreadm365_graph_identity_governance.pim_directory_role_assignment_schedules_filter_by_current_userPim directory role assignment schedules filter by current userreadm365_graph_identity_governance.pim_directory_role_assignment_schedules_getGet pim directory role assignment schedulesreadm365_graph_identity_governance.pim_directory_role_assignment_schedules_listList pim directory role assignment schedulesreadm365_graph_identity_governance.pim_directory_role_eligibility_schedule_instances_filter_by_current_userPim directory role eligibility schedule instances filter by current userreadm365_graph_identity_governance.pim_directory_role_eligibility_schedule_instances_getGet pim directory role eligibility schedule instancesreadm365_graph_identity_governance.pim_directory_role_eligibility_schedule_instances_listList pim directory role eligibility schedule instancesreadm365_graph_identity_governance.pim_directory_role_eligibility_schedule_requests_cancelPim directory role eligibility schedule requests canceldestructivem365_graph_identity_governance.pim_directory_role_eligibility_schedule_requests_createCreate pim directory role eligibility schedule requestsdestructivem365_graph_identity_governance.pim_directory_role_eligibility_schedule_requests_filter_by_current_userPim directory role eligibility schedule requests filter by current userreadm365_graph_identity_governance.pim_directory_role_eligibility_schedule_requests_getGet pim directory role eligibility schedule requestsreadm365_graph_identity_governance.pim_directory_role_eligibility_schedule_requests_listList pim directory role eligibility schedule requestsreadm365_graph_identity_governance.pim_directory_role_eligibility_schedules_filter_by_current_userPim directory role eligibility schedules filter by current userreadm365_graph_identity_governance.pim_directory_role_eligibility_schedules_getGet pim directory role eligibility schedulesreadm365_graph_identity_governance.pim_directory_role_eligibility_schedules_listList pim directory role eligibility schedulesread
Terms of use9
m365_graph_identity_governance.terms_of_use_agreements_acceptances_listList terms of use agreements acceptancesreadm365_graph_identity_governance.terms_of_use_agreements_createCreate terms of use agreementswritem365_graph_identity_governance.terms_of_use_agreements_deleteDelete terms of use agreementsdestructivem365_graph_identity_governance.terms_of_use_agreements_file_getGet terms of use agreements filereadm365_graph_identity_governance.terms_of_use_agreements_file_localizations_listList terms of use agreements file localizationsreadm365_graph_identity_governance.terms_of_use_agreements_files_createCreate terms of use agreements fileswritem365_graph_identity_governance.terms_of_use_agreements_getGet terms of use agreementsreadm365_graph_identity_governance.terms_of_use_agreements_listList terms of use agreementsreadm365_graph_identity_governance.terms_of_use_agreements_updateUpdate terms of use agreementswrite
Pim policies7
m365_graph_identity_governance.pim_policies_role_management_policies_getGet pim policies role management policiesreadm365_graph_identity_governance.pim_policies_role_management_policies_listList pim policies role management policiesreadm365_graph_identity_governance.pim_policies_role_management_policies_rules_getGet pim policies role management policies rulesreadm365_graph_identity_governance.pim_policies_role_management_policies_rules_listList pim policies role management policies rulesreadm365_graph_identity_governance.pim_policies_role_management_policies_rules_updateUpdate pim policies role management policies ruleswritem365_graph_identity_governance.pim_policies_role_management_policy_assignments_getGet pim policies role management policy assignmentsreadm365_graph_identity_governance.pim_policies_role_management_policy_assignments_listList pim policies role management policy assignmentsread
App consent6
m365_graph_identity_governance.app_consent_app_consent_requests_filter_by_current_userApp consent app consent requests filter by current userreadm365_graph_identity_governance.app_consent_app_consent_requests_getGet app consent app consent requestsreadm365_graph_identity_governance.app_consent_app_consent_requests_listList app consent app consent requestsreadm365_graph_identity_governance.app_consent_app_consent_requests_user_consent_requests_filter_by_current_userApp consent app consent requests user consent requests filter by current userreadm365_graph_identity_governance.app_consent_app_consent_requests_user_consent_requests_getGet app consent app consent requests user consent requestsreadm365_graph_identity_governance.app_consent_app_consent_requests_user_consent_requests_listList app consent app consent requests user consent requestsread
Entitlement roles6
m365_graph_identity_governance.entitlement_roles_role_assignments_createCreate entitlement roles role assignmentsdestructivem365_graph_identity_governance.entitlement_roles_role_assignments_deleteDelete entitlement roles role assignmentsdestructivem365_graph_identity_governance.entitlement_roles_role_assignments_getGet entitlement roles role assignmentsreadm365_graph_identity_governance.entitlement_roles_role_assignments_listList entitlement roles role assignmentsreadm365_graph_identity_governance.entitlement_roles_role_definitions_getGet entitlement roles role definitionsreadm365_graph_identity_governance.entitlement_roles_role_definitions_listList entitlement roles role definitionsread
Questions
The Microsoft Entra ID Governance (Graph) MCP server, answered.
Is there a Microsoft Entra ID Governance (Graph) MCP server for Claude?
Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 250 Microsoft Entra ID Governance (Graph) actions across entitlement management, lifecycle workflows, access reviews and pim groups, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Microsoft Entra ID Governance (Graph).
What do I need to connect Microsoft Entra ID Governance (Graph)?
Entra application (client) id and Entra client secret. Plus your tenant id. The free call account { op: "connections.requirements", service: "m365_graph_identity_governance" } lists exactly what to paste.
Can an AI agent delete or change things in Microsoft Entra ID Governance (Graph)?
Only if its key allows it, and only with an explicit confirmation. 36 Microsoft Entra ID Governance (Graph) actions are destructive, including delete entitlement assignment policies, entitlement assignment requests cancel and delete access reviews definitions. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.
Will an AI agent use up my Microsoft Entra ID Governance (Graph) API limit?
actionlake paces every call to the limits in the Microsoft Entra ID Governance (Graph) service file: 10,000 calls per 10 minutes per connection. Repeated reads are answered from cache (154 Microsoft Entra ID Governance (Graph) actions can be), which never reaches Microsoft Entra ID Governance (Graph).
What does a Microsoft Entra ID Governance (Graph) action cost?
One upstream call, the only unit actionlake bills. A list that pages bills one call per page (94 Microsoft Entra ID Governance (Graph) actions page). Cache hits, searches, dry runs and calls Microsoft Entra ID Governance (Graph) refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
Which Microsoft Entra ID Governance (Graph) API does it cover?
The Microsoft Entra ID Governance (Graph) API v1.0 at graph.microsoft.com/v1.0. It is built from Microsoft Entra ID Governance (Graph)'s documentation as read on 23 October 2026. 250 actions in 9 areas, each one in the signed service file (version 1.0.0).
Does actionlake keep my Microsoft Entra ID Governance (Graph) data, and where?
actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to an hour, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Microsoft Entra ID Governance (Graph) credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.
Which AI clients can use it?
Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.
Give your agent Microsoft Entra ID Governance (Graph) today.
Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.
