--- title: "Microsoft Entra ID Governance MCP server - actionlake" description: "Give Claude 250 Microsoft Entra ID Governance (Graph) actions through one MCP server. Your agent never holds the credential. 100,000 calls a month free." canonical: https://actionlake.com/connectors/microsoft-entra-id-governance-graph updated: 2026-10-23 --- Connectors · Identity & security # Microsoft Entra ID Governance (Graph) MCP server for AI agents. actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Microsoft Entra ID Governance (Graph) and the rest of your systems. It gives your agent 250 Microsoft Entra ID Governance (Graph) actions (157 reads, 57 writes and 36 that wait for a confirmation) and holds the Microsoft Entra ID Governance (Graph) credential itself, so the agent never does. It paces Microsoft Entra ID Governance (Graph)'s limits and records every call. [Connect Microsoft Entra ID Governance (Graph) free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) 100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you. `claude mcp add --transport http actionlake https://connect.actionlake.com/mcp` the first call ``` do { action: "m365_graph_identity_governance.entitlement_roles_role_definitions_list", intent: "check which Microsoft Entra ID Governance (Graph) account is connected" } # List entitlement roles role definitions · read · 1 upstream call ``` - 250 actions in one signed file - 157 read look, never change - 57 write create and update - 36 wait for a yes destructive, confirmed first Set up ## Connect Microsoft Entra ID Governance (Graph) in three steps. 1. 01 ### Add actionlake to Claude. Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us. `https://connect.actionlake.com/mcp` 2. 02 ### Connect Microsoft Entra ID Governance (Graph). OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key. - `client_id` Entra application (client) id - `client_secret` Entra client secret - `tenant_id` Your Microsoft Entra ID Governance (Graph) tenant id ``` account { op: "connections.requirements", service: "m365_graph_identity_governance" } # free: exactly what to paste, and what is found for you ``` 3. 03 ### Make the first call. Check before a write. Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free. ``` do { action: "m365_graph_identity_governance.entitlement_roles_role_definitions_list" } # list entitlement roles role definitions · read · 1 upstream call check { action: "m365_graph_identity_governance.entitlement_assignment_policies_create", input: { … } } # free: inputs, permissions, cost and confirmations, nothing sent ``` Microsoft Entra ID Governance (Graph) at a glance **Sign-in** OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. **You provide** `client_id` `client_secret` **Setup fields** `tenant_id` **Limits we pace to** 10,000 calls per 10 minutes, per connection **API covered** Microsoft Entra ID Governance (Graph) API v1.0`graph.microsoft.com/v1.0` **Built from** Microsoft Entra ID Governance (Graph)'s documentation, read 23 October 2026[learn.microsoft.com](https://learn.microsoft.com/en-us/graph/api/resources/identitygovernance-overview?view=graph-rest-1.0) **Service file** Version 1.0.0, signed (Ed25519) **Cached reads** 154 of 157 reads, for up to an hour; a write clears what it affects **Shared entities** 1, so ask can line Microsoft Entra ID Governance (Graph) up with your other systems **Data** Processed and stored in Sydney, Australia. No US region yet Capabilities ## What an AI agent can do in Microsoft Entra ID Governance (Graph). 250 actions in 9 areas. Every one carries its effect, so a key can allow the reads and hold the rest. - **157** read look, never change - **57** write create and update - **36** destructive wait for a confirmation 1. ### Entitlement management 78 38 read · 25 write · 15 destructive List entitlement assignment policies · Create entitlement assignment policies · Create entitlement assignment requests · List entitlement assignment requests 2. ### Lifecycle workflows 59 39 read · 12 write · 8 destructive Create lifecycle custom task extensions · List lifecycle custom task extensions · List lifecycle deleted items workflows · Lifecycle insights top tasks processed summary 3. ### Access reviews 36 19 read · 16 write · 1 destructive List access reviews definitions · Create access reviews definitions · Get access reviews definitions · Update access reviews definitions 4. ### Pim groups 27 22 read · 0 write · 5 destructive Pim group assignment approvals filter by current user · List pim group assignment approvals stages · Pim group assignment schedule instances filter by current user · List pim group assignment schedule instances 5. ### Pim roles 22 18 read · 0 write · 4 destructive Pim directory role eligibility schedule instances filter by current user · List pim directory role eligibility schedule instances · Create pim directory role eligibility schedule requests · Pim directory role eligibility schedule requests filter by current user 6. ### Terms of use 9 5 read · 3 write · 1 destructive List terms of use agreements acceptances · Create terms of use agreements · List terms of use agreements file localizations · Create terms of use agreements files 7. ### Pim policies 7 6 read · 1 write · 0 destructive List pim policies role management policies · List pim policies role management policies rules · List pim policies role management policy assignments · Get pim policies role management policies 8. ### App consent 6 6 read · 0 write · 0 destructive App consent app consent requests filter by current user · List app consent app consent requests · App consent app consent requests user consent requests filter by current user · List app consent app consent requests user consent requests **1 more area · 6 actions** - Entitlement roles **6** Top actions ## The Microsoft Entra ID Governance (Graph) API, shaped for agents. The ids your agent types, what each does, and the one name it shares with other systems. 19 of Microsoft Entra ID Governance (Graph)'s 19 action names are shared with at least one other connector, so an agent learns them once. | Action | What it does | Effect | Same name in | | --- | --- | --- | --- | | `m365_graph_identity_governance.entitlement_roles_role_definitions_list` List entitlement roles role definitions | Get a list of unifiedRoleDefinition objects for the provider. The following RBAC providers are currently supported: - directory (Microsoft Entra ID) -… | read | `identity.role.list` 184 connectors | | `m365_graph_identity_governance.entitlement_roles_role_definitions_get` Get entitlement roles role definitions | Resource representing the roles allowed by RBAC providers and the permissions assigned to the roles. | read | `identity.role.get` 127 connectors | | `m365_graph_identity_governance.entitlement_roles_role_assignments_list` List entitlement roles role assignments | Get a list of unifiedRoleAssignment objects for the RBAC provider. The following RBAC providers are currently supported: - directory (Microsoft Entra ID) -… | read | `identity.role_assignment.list` 41 connectors | | `m365_graph_identity_governance.entitlement_assignment_policies_list` List entitlement assignment policies | Retrieve a list of accessPackageAssignmentPolicy objects in Microsoft Entra entitlement management. If the delegated user is in a directory role, the… | read | `identity.access_policy.list` 13 connectors | | `m365_graph_identity_governance.entitlement_assignment_policies_create` Create entitlement assignment policies | Create a new accessPackageAssignmentPolicy object in Microsoft Entra entitlement management. The request includes a reference to the accessPackage that… | write | `identity.access_policy.create` 12 connectors | | `m365_graph_identity_governance.entitlement_assignment_requests_create` Create entitlement assignment requests | In Microsoft Entra Entitlement Management, create a new accessPackageAssignmentRequest object. This operation is used to assign a user to an access package,… | write | `identity.access_request.create` 12 connectors | | `m365_graph_identity_governance.entitlement_assignment_requests_list` List entitlement assignment requests | In Microsoft Entra entitlement management, retrieve a list of accessPackageAssignmentRequest objects. The resulting list includes all the assignment requests,… | read | `identity.access_request.list` 10 connectors | | `m365_graph_identity_governance.entitlement_roles_role_assignments_get` Get entitlement roles role assignments | Resource to grant access to users or groups. | read | `identity.role_assignment.get` 18 connectors | | `m365_graph_identity_governance.access_reviews_definitions_list` List access reviews definitions | Get a list of the accessReviewScheduleDefinition objects and their properties. | read | `identity.access_review.list` 5 connectors | | `m365_graph_identity_governance.access_reviews_definitions_create` Create access reviews definitions | Create a new accessReviewScheduleDefinition object. | write | `identity.access_review.create` 4 connectors | | `m365_graph_identity_governance.entitlement_assignment_policies_delete` Delete entitlement assignment policies | In Microsoft Entra entitlement management, delete an accessPackageAssignmentPolicy. | destructive | `identity.access_policy.delete` 14 connectors | | `m365_graph_identity_governance.pim_directory_role_eligibility_schedules_list` List pim directory role eligibility schedules | Get the unifiedRoleEligibilitySchedule resources from the roleEligibilitySchedules navigation property. | read | this connector | Try it ## Prompts to paste into Claude. Each one names the Microsoft Entra ID Governance (Graph) actions it will call, so you know what it reads and what it changes before you send it. 1. Read read List entitlement roles role definitions in Microsoft Entra ID Governance (Graph) and tell me what stands out. calls `m365_graph_identity_governance.entitlement_roles_role_definitions_list` 2. Write write Create entitlement assignment policies in Microsoft Entra ID Governance (Graph). Show me exactly what you will send before you save it. calls `m365_graph_identity_governance.entitlement_assignment_policies_create` Governance for Microsoft Entra ID Governance (Graph) ## Destructive actions wait for a yes. 36 Microsoft Entra ID Governance (Graph) actions are destructive. The first 10: - Delete entitlement assignment policies `m365_graph_identity_governance.entitlement_assignment_policies_delete` - Entitlement assignment requests cancel `m365_graph_identity_governance.entitlement_assignment_requests_cancel` - Delete access reviews definitions `m365_graph_identity_governance.access_reviews_definitions_delete` - Delete entitlement assignment requests `m365_graph_identity_governance.entitlement_assignment_requests_delete` - Create pim directory role eligibility schedule requests `m365_graph_identity_governance.pim_directory_role_eligibility_schedule_requests_create` - Pim directory role eligibility schedule requests cancel `m365_graph_identity_governance.pim_directory_role_eligibility_schedule_requests_cancel` - Create entitlement roles role assignments `m365_graph_identity_governance.entitlement_roles_role_assignments_create` - Create pim group assignment schedule requests `m365_graph_identity_governance.pim_group_assignment_schedule_requests_create` - Create pim group eligibility schedule requests `m365_graph_identity_governance.pim_group_eligibility_schedule_requests_create` - Create pim directory role assignment schedule requests `m365_graph_identity_governance.pim_directory_role_assignment_schedule_requests_create` A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after. do m365_graph_identity_governance.entitlement_assignment_policies_delete confirm_policy: **human** Delete entitlement assignment policies? **intent:** the user asked me to delete entitlement assignment policies run suspended · waiting for a named person · key _m365-graph-identity-governance-agent_ cannot confirm itself In the console, or from an emailed signed link. a key for this connector ``` account { op: "keys.create", name: "m365-graph-identity-governance-agent", allowed_actions: ["m365_graph_identity_governance.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "m365_graph_identity_governance.entitlement_assignment_policies_delete", approver: "lead@example.com" }, { match: "m365_graph_identity_governance.entitlement_assignment_requests_cancel", approver: "lead@example.com" }, { match: "m365_graph_identity_governance.access_reviews_definitions_delete", approver: "lead@example.com" } ] } ``` Illustrative. Scoped to Microsoft Entra ID Governance (Graph) only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person. Cost ## What Microsoft Entra ID Governance (Graph) costs on actionlake. Every Microsoft Entra ID Governance (Graph) action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call Microsoft Entra ID Governance (Graph) refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. - 1 upstream call per action all 250 Microsoft Entra ID Governance (Graph) actions - 94 actions page each page of a long list is one call - 154 reads can be cached a cache hit costs nothing - 100,000 calls a month, free paid plans from US$49 a month for 250,000 [See pricing](https://actionlake.com/pricing) Action index ## Every Microsoft Entra ID Governance (Graph) action. 250 actions by area: the id your agent calls, what it does, and its effect. **Entitlement management 78** - `m365_graph_identity_governance.entitlement_access_package_assignment_approvals_filter_by_current_user` Entitlement access package assignment approvals filter by current user read - `m365_graph_identity_governance.entitlement_access_package_assignment_approvals_get` Get entitlement access package assignment approvals read - `m365_graph_identity_governance.entitlement_access_package_assignment_approvals_stages_get` Get entitlement access package assignment approvals stages read - `m365_graph_identity_governance.entitlement_access_package_assignment_approvals_stages_list` List entitlement access package assignment approvals stages read - `m365_graph_identity_governance.entitlement_access_package_assignment_approvals_stages_update` Update entitlement access package assignment approvals stages destructive - `m365_graph_identity_governance.entitlement_access_package_suggestions_filter_by_current_user` Entitlement access package suggestions filter by current user read - `m365_graph_identity_governance.entitlement_access_packages_access_packages_incompatible_with_list` List entitlement access packages access packages incompatible with read - `m365_graph_identity_governance.entitlement_access_packages_create` Create entitlement access packages write - `m365_graph_identity_governance.entitlement_access_packages_delete` Delete entitlement access packages destructive - `m365_graph_identity_governance.entitlement_access_packages_filter_by_current_user` Entitlement access packages filter by current user read - `m365_graph_identity_governance.entitlement_access_packages_get` Get entitlement access packages read - `m365_graph_identity_governance.entitlement_access_packages_get_applicable_policy_requirements` Entitlement access packages get applicable policy requirements read - `m365_graph_identity_governance.entitlement_access_packages_incompatible_access_packages_add` Entitlement access packages incompatible access packages add write - `m365_graph_identity_governance.entitlement_access_packages_incompatible_access_packages_list` List entitlement access packages incompatible access packages read - `m365_graph_identity_governance.entitlement_access_packages_incompatible_access_packages_remove` Entitlement access packages incompatible access packages remove destructive - `m365_graph_identity_governance.entitlement_access_packages_incompatible_groups_add` Entitlement access packages incompatible groups add write - `m365_graph_identity_governance.entitlement_access_packages_incompatible_groups_list` List entitlement access packages incompatible groups read - `m365_graph_identity_governance.entitlement_access_packages_incompatible_groups_remove` Entitlement access packages incompatible groups remove destructive - `m365_graph_identity_governance.entitlement_access_packages_list` List entitlement access packages read - `m365_graph_identity_governance.entitlement_access_packages_resource_role_scopes_create` Create entitlement access packages resource role scopes write - `m365_graph_identity_governance.entitlement_access_packages_resource_role_scopes_delete` Delete entitlement access packages resource role scopes destructive - `m365_graph_identity_governance.entitlement_access_packages_update` Update entitlement access packages write - `m365_graph_identity_governance.entitlement_assignment_policies_create` Create entitlement assignment policies write - `m365_graph_identity_governance.entitlement_assignment_policies_delete` Delete entitlement assignment policies destructive - `m365_graph_identity_governance.entitlement_assignment_policies_get` Get entitlement assignment policies read - `m365_graph_identity_governance.entitlement_assignment_policies_list` List entitlement assignment policies read - `m365_graph_identity_governance.entitlement_assignment_policies_update` Update entitlement assignment policies write - `m365_graph_identity_governance.entitlement_assignment_requests_cancel` Entitlement assignment requests cancel destructive - `m365_graph_identity_governance.entitlement_assignment_requests_create` Create entitlement assignment requests write - `m365_graph_identity_governance.entitlement_assignment_requests_delete` Delete entitlement assignment requests destructive - `m365_graph_identity_governance.entitlement_assignment_requests_filter_by_current_user` Entitlement assignment requests filter by current user read - `m365_graph_identity_governance.entitlement_assignment_requests_get` Get entitlement assignment requests read - `m365_graph_identity_governance.entitlement_assignment_requests_list` List entitlement assignment requests read - `m365_graph_identity_governance.entitlement_assignment_requests_reprocess` Entitlement assignment requests reprocess write - `m365_graph_identity_governance.entitlement_assignments_additional_access` Entitlement assignments additional access read - `m365_graph_identity_governance.entitlement_assignments_filter_by_current_user` Entitlement assignments filter by current user read - `m365_graph_identity_governance.entitlement_assignments_get` Get entitlement assignments read - `m365_graph_identity_governance.entitlement_assignments_list` List entitlement assignments read - `m365_graph_identity_governance.entitlement_assignments_reprocess` Entitlement assignments reprocess write - `m365_graph_identity_governance.entitlement_available_access_packages_resource_role_scopes_list` List entitlement available access packages resource role scopes read - `m365_graph_identity_governance.entitlement_catalogs_create` Create entitlement catalogs write - `m365_graph_identity_governance.entitlement_catalogs_custom_workflow_extensions_create` Create entitlement catalogs custom workflow extensions write - `m365_graph_identity_governance.entitlement_catalogs_custom_workflow_extensions_delete` Delete entitlement catalogs custom workflow extensions destructive - `m365_graph_identity_governance.entitlement_catalogs_custom_workflow_extensions_get` Get entitlement catalogs custom workflow extensions read - `m365_graph_identity_governance.entitlement_catalogs_custom_workflow_extensions_list` List entitlement catalogs custom workflow extensions read - `m365_graph_identity_governance.entitlement_catalogs_custom_workflow_extensions_update` Update entitlement catalogs custom workflow extensions write - `m365_graph_identity_governance.entitlement_catalogs_delete` Delete entitlement catalogs destructive - `m365_graph_identity_governance.entitlement_catalogs_get` Get entitlement catalogs read - `m365_graph_identity_governance.entitlement_catalogs_list` List entitlement catalogs read - `m365_graph_identity_governance.entitlement_catalogs_resource_roles_list` List entitlement catalogs resource roles read - `m365_graph_identity_governance.entitlement_catalogs_resources_list` List entitlement catalogs resources read - `m365_graph_identity_governance.entitlement_catalogs_resources_upload_sessions_create` Create entitlement catalogs resources upload sessions write - `m365_graph_identity_governance.entitlement_catalogs_resources_upload_sessions_delete` Delete entitlement catalogs resources upload sessions destructive - `m365_graph_identity_governance.entitlement_catalogs_resources_upload_sessions_get` Get entitlement catalogs resources upload sessions read - `m365_graph_identity_governance.entitlement_catalogs_resources_upload_sessions_list` List entitlement catalogs resources upload sessions read - `m365_graph_identity_governance.entitlement_catalogs_resources_upload_sessions_update` Update entitlement catalogs resources upload sessions write - `m365_graph_identity_governance.entitlement_catalogs_update` Update entitlement catalogs write - `m365_graph_identity_governance.entitlement_connected_organizations_create` Create entitlement connected organizations write - `m365_graph_identity_governance.entitlement_connected_organizations_delete` Delete entitlement connected organizations destructive - `m365_graph_identity_governance.entitlement_connected_organizations_external_sponsors_add` Entitlement connected organizations external sponsors add write - `m365_graph_identity_governance.entitlement_connected_organizations_external_sponsors_remove` Entitlement connected organizations external sponsors remove destructive - `m365_graph_identity_governance.entitlement_connected_organizations_get` Get entitlement connected organizations read - `m365_graph_identity_governance.entitlement_connected_organizations_internal_sponsors_add` Entitlement connected organizations internal sponsors add write - `m365_graph_identity_governance.entitlement_connected_organizations_internal_sponsors_remove` Entitlement connected organizations internal sponsors remove destructive - `m365_graph_identity_governance.entitlement_connected_organizations_list` List entitlement connected organizations read - `m365_graph_identity_governance.entitlement_connected_organizations_update` Update entitlement connected organizations write - `m365_graph_identity_governance.entitlement_external_origin_resource_connectors_create` Create entitlement external origin resource connectors write - `m365_graph_identity_governance.entitlement_external_origin_resource_connectors_delete` Delete entitlement external origin resource connectors destructive - `m365_graph_identity_governance.entitlement_external_origin_resource_connectors_get` Get entitlement external origin resource connectors read - `m365_graph_identity_governance.entitlement_external_origin_resource_connectors_list` List entitlement external origin resource connectors read - `m365_graph_identity_governance.entitlement_external_origin_resource_connectors_update` Update entitlement external origin resource connectors write - `m365_graph_identity_governance.entitlement_resource_environments_list` List entitlement resource environments read - `m365_graph_identity_governance.entitlement_resource_requests_create` Create entitlement resource requests write - `m365_graph_identity_governance.entitlement_resource_requests_list` List entitlement resource requests read - `m365_graph_identity_governance.entitlement_settings_get` Get entitlement settings read - `m365_graph_identity_governance.entitlement_settings_update` Update entitlement settings write - `m365_graph_identity_governance.entitlement_subjects_get` Get entitlement subjects read - `m365_graph_identity_governance.entitlement_subjects_update` Update entitlement subjects write **Lifecycle workflows 59** - `m365_graph_identity_governance.lifecycle_custom_task_extensions_create` Create lifecycle custom task extensions write - `m365_graph_identity_governance.lifecycle_custom_task_extensions_delete` Delete lifecycle custom task extensions destructive - `m365_graph_identity_governance.lifecycle_custom_task_extensions_get` Get lifecycle custom task extensions read - `m365_graph_identity_governance.lifecycle_custom_task_extensions_list` List lifecycle custom task extensions read - `m365_graph_identity_governance.lifecycle_custom_task_extensions_update` Update lifecycle custom task extensions write - `m365_graph_identity_governance.lifecycle_deleted_items_workflows_delete` Delete lifecycle deleted items workflows destructive - `m365_graph_identity_governance.lifecycle_deleted_items_workflows_get` Get lifecycle deleted items workflows read - `m365_graph_identity_governance.lifecycle_deleted_items_workflows_list` List lifecycle deleted items workflows read - `m365_graph_identity_governance.lifecycle_deleted_items_workflows_restore` Lifecycle deleted items workflows restore write - `m365_graph_identity_governance.lifecycle_insights_top_tasks_processed_summary` Lifecycle insights top tasks processed summary read - `m365_graph_identity_governance.lifecycle_insights_top_workflows_processed_summary` Lifecycle insights top workflows processed summary read - `m365_graph_identity_governance.lifecycle_insights_workflows_processed_by_category` Lifecycle insights workflows processed by category read - `m365_graph_identity_governance.lifecycle_insights_workflows_processed_summary` Lifecycle insights workflows processed summary read - `m365_graph_identity_governance.lifecycle_settings_get` Get lifecycle settings read - `m365_graph_identity_governance.lifecycle_settings_update` Update lifecycle settings write - `m365_graph_identity_governance.lifecycle_task_definitions_get` Get lifecycle task definitions read - `m365_graph_identity_governance.lifecycle_task_definitions_list` List lifecycle task definitions read - `m365_graph_identity_governance.lifecycle_workflow_templates_get` Get lifecycle workflow templates read - `m365_graph_identity_governance.lifecycle_workflow_templates_list` List lifecycle workflow templates read - `m365_graph_identity_governance.lifecycle_workflows_activate` Lifecycle workflows activate write - `m365_graph_identity_governance.lifecycle_workflows_activate_and_wait` Lifecycle workflows activate and wait write - `m365_graph_identity_governance.lifecycle_workflows_activate_with_scope` Lifecycle workflows activate with scope write - `m365_graph_identity_governance.lifecycle_workflows_cancel_processing` Lifecycle workflows cancel processing destructive - `m365_graph_identity_governance.lifecycle_workflows_clear_quarantine` Lifecycle workflows clear quarantine write - `m365_graph_identity_governance.lifecycle_workflows_create` Create lifecycle workflows write - `m365_graph_identity_governance.lifecycle_workflows_create_new_version` Lifecycle workflows create new version write - `m365_graph_identity_governance.lifecycle_workflows_delete` Delete lifecycle workflows destructive - `m365_graph_identity_governance.lifecycle_workflows_get` Get lifecycle workflows read - `m365_graph_identity_governance.lifecycle_workflows_list` List lifecycle workflows read - `m365_graph_identity_governance.lifecycle_workflows_preview_task_failures` Lifecycle workflows preview task failures read - `m365_graph_identity_governance.lifecycle_workflows_preview_workflow` Lifecycle workflows preview workflow read - `m365_graph_identity_governance.lifecycle_workflows_restore` Lifecycle workflows restore write - `m365_graph_identity_governance.lifecycle_workflows_runs_get` Get lifecycle workflows runs read - `m365_graph_identity_governance.lifecycle_workflows_runs_list` List lifecycle workflows runs read - `m365_graph_identity_governance.lifecycle_workflows_runs_subject_processing_results_get` Get lifecycle workflows runs subject processing results read - `m365_graph_identity_governance.lifecycle_workflows_runs_subject_processing_results_list` List lifecycle workflows runs subject processing results read - `m365_graph_identity_governance.lifecycle_workflows_runs_subject_processing_results_task_processing_results_resume` Lifecycle workflows runs subject processing results task processing results resume destructive - `m365_graph_identity_governance.lifecycle_workflows_runs_summary` Lifecycle workflows runs summary read - `m365_graph_identity_governance.lifecycle_workflows_runs_task_processing_results_list` List lifecycle workflows runs task processing results read - `m365_graph_identity_governance.lifecycle_workflows_runs_user_processing_results_get` Get lifecycle workflows runs user processing results read - `m365_graph_identity_governance.lifecycle_workflows_runs_user_processing_results_list` List lifecycle workflows runs user processing results read - `m365_graph_identity_governance.lifecycle_workflows_runs_user_processing_results_summary` Lifecycle workflows runs user processing results summary read - `m365_graph_identity_governance.lifecycle_workflows_runs_user_processing_results_task_processing_results_list` List lifecycle workflows runs user processing results task processing results read - `m365_graph_identity_governance.lifecycle_workflows_runs_user_processing_results_task_processing_results_resume` Lifecycle workflows runs user processing results task processing results resume destructive - `m365_graph_identity_governance.lifecycle_workflows_task_reports_list` List lifecycle workflows task reports read - `m365_graph_identity_governance.lifecycle_workflows_task_reports_summary` Lifecycle workflows task reports summary read - `m365_graph_identity_governance.lifecycle_workflows_task_reports_task_processing_results_list` List lifecycle workflows task reports task processing results read - `m365_graph_identity_governance.lifecycle_workflows_task_reports_task_processing_results_resume` Lifecycle workflows task reports task processing results resume destructive - `m365_graph_identity_governance.lifecycle_workflows_tasks_get` Get lifecycle workflows tasks read - `m365_graph_identity_governance.lifecycle_workflows_tasks_list` List lifecycle workflows tasks read - `m365_graph_identity_governance.lifecycle_workflows_update` Update lifecycle workflows write - `m365_graph_identity_governance.lifecycle_workflows_user_processing_results_list` List lifecycle workflows user processing results read - `m365_graph_identity_governance.lifecycle_workflows_user_processing_results_summary` Lifecycle workflows user processing results summary read - `m365_graph_identity_governance.lifecycle_workflows_user_processing_results_task_processing_results_list` List lifecycle workflows user processing results task processing results read - `m365_graph_identity_governance.lifecycle_workflows_user_processing_results_task_processing_results_resume` Lifecycle workflows user processing results task processing results resume destructive - `m365_graph_identity_governance.lifecycle_workflows_versions_get` Get lifecycle workflows versions read - `m365_graph_identity_governance.lifecycle_workflows_versions_list` List lifecycle workflows versions read - `m365_graph_identity_governance.lifecycle_workflows_versions_tasks_get` Get lifecycle workflows versions tasks read - `m365_graph_identity_governance.lifecycle_workflows_versions_tasks_list` List lifecycle workflows versions tasks read **Access reviews 36** - `m365_graph_identity_governance.access_reviews_definitions_create` Create access reviews definitions write - `m365_graph_identity_governance.access_reviews_definitions_delete` Delete access reviews definitions destructive - `m365_graph_identity_governance.access_reviews_definitions_filter_by_current_user` Access reviews definitions filter by current user read - `m365_graph_identity_governance.access_reviews_definitions_get` Get access reviews definitions read - `m365_graph_identity_governance.access_reviews_definitions_instances_accept_recommendations` Access reviews definitions instances accept recommendations write - `m365_graph_identity_governance.access_reviews_definitions_instances_apply_decisions` Access reviews definitions instances apply decisions write - `m365_graph_identity_governance.access_reviews_definitions_instances_batch_record_decisions` Access reviews definitions instances batch record decisions write - `m365_graph_identity_governance.access_reviews_definitions_instances_contacted_reviewers_list` List access reviews definitions instances contacted reviewers read - `m365_graph_identity_governance.access_reviews_definitions_instances_decisions_filter_by_current_user` Access reviews definitions instances decisions filter by current user read - `m365_graph_identity_governance.access_reviews_definitions_instances_decisions_get` Get access reviews definitions instances decisions read - `m365_graph_identity_governance.access_reviews_definitions_instances_decisions_list` List access reviews definitions instances decisions read - `m365_graph_identity_governance.access_reviews_definitions_instances_filter_by_current_user` Access reviews definitions instances filter by current user read - `m365_graph_identity_governance.access_reviews_definitions_instances_get` Get access reviews definitions instances read - `m365_graph_identity_governance.access_reviews_definitions_instances_list` List access reviews definitions instances read - `m365_graph_identity_governance.access_reviews_definitions_instances_reset_decisions` Access reviews definitions instances reset decisions write - `m365_graph_identity_governance.access_reviews_definitions_instances_send_reminder` Access reviews definitions instances send reminder write - `m365_graph_identity_governance.access_reviews_definitions_instances_stages_accept_recommendations` Access reviews definitions instances stages accept recommendations write - `m365_graph_identity_governance.access_reviews_definitions_instances_stages_batch_record_decisions` Access reviews definitions instances stages batch record decisions write - `m365_graph_identity_governance.access_reviews_definitions_instances_stages_decisions_filter_by_current_user` Access reviews definitions instances stages decisions filter by current user read - `m365_graph_identity_governance.access_reviews_definitions_instances_stages_decisions_get` Get access reviews definitions instances stages decisions read - `m365_graph_identity_governance.access_reviews_definitions_instances_stages_decisions_list` List access reviews definitions instances stages decisions read - `m365_graph_identity_governance.access_reviews_definitions_instances_stages_decisions_update` Update access reviews definitions instances stages decisions write - `m365_graph_identity_governance.access_reviews_definitions_instances_stages_filter_by_current_user` Access reviews definitions instances stages filter by current user read - `m365_graph_identity_governance.access_reviews_definitions_instances_stages_get` Get access reviews definitions instances stages read - `m365_graph_identity_governance.access_reviews_definitions_instances_stages_list` List access reviews definitions instances stages read - `m365_graph_identity_governance.access_reviews_definitions_instances_stages_stop` Access reviews definitions instances stages stop write - `m365_graph_identity_governance.access_reviews_definitions_instances_stages_update` Update access reviews definitions instances stages write - `m365_graph_identity_governance.access_reviews_definitions_instances_stop` Access reviews definitions instances stop write - `m365_graph_identity_governance.access_reviews_definitions_instances_update` Update access reviews definitions instances write - `m365_graph_identity_governance.access_reviews_definitions_list` List access reviews definitions read - `m365_graph_identity_governance.access_reviews_definitions_update` Update access reviews definitions write - `m365_graph_identity_governance.access_reviews_history_definitions_create` Create access reviews history definitions write - `m365_graph_identity_governance.access_reviews_history_definitions_get` Get access reviews history definitions read - `m365_graph_identity_governance.access_reviews_history_definitions_instances_generate_download_uri` Access reviews history definitions instances generate download uri write - `m365_graph_identity_governance.access_reviews_history_definitions_instances_list` List access reviews history definitions instances read - `m365_graph_identity_governance.access_reviews_history_definitions_list` List access reviews history definitions read **Pim groups 27** - `m365_graph_identity_governance.pim_group_assignment_approvals_filter_by_current_user` Pim group assignment approvals filter by current user read - `m365_graph_identity_governance.pim_group_assignment_approvals_get` Get pim group assignment approvals read - `m365_graph_identity_governance.pim_group_assignment_approvals_stages_get` Get pim group assignment approvals stages read - `m365_graph_identity_governance.pim_group_assignment_approvals_stages_list` List pim group assignment approvals stages read - `m365_graph_identity_governance.pim_group_assignment_approvals_stages_update` Update pim group assignment approvals stages destructive - `m365_graph_identity_governance.pim_group_assignment_schedule_instances_filter_by_current_user` Pim group assignment schedule instances filter by current user read - `m365_graph_identity_governance.pim_group_assignment_schedule_instances_get` Get pim group assignment schedule instances read - `m365_graph_identity_governance.pim_group_assignment_schedule_instances_list` List pim group assignment schedule instances read - `m365_graph_identity_governance.pim_group_assignment_schedule_requests_cancel` Pim group assignment schedule requests cancel destructive - `m365_graph_identity_governance.pim_group_assignment_schedule_requests_create` Create pim group assignment schedule requests destructive - `m365_graph_identity_governance.pim_group_assignment_schedule_requests_filter_by_current_user` Pim group assignment schedule requests filter by current user read - `m365_graph_identity_governance.pim_group_assignment_schedule_requests_get` Get pim group assignment schedule requests read - `m365_graph_identity_governance.pim_group_assignment_schedule_requests_list` List pim group assignment schedule requests read - `m365_graph_identity_governance.pim_group_assignment_schedules_filter_by_current_user` Pim group assignment schedules filter by current user read - `m365_graph_identity_governance.pim_group_assignment_schedules_get` Get pim group assignment schedules read - `m365_graph_identity_governance.pim_group_assignment_schedules_list` List pim group assignment schedules read - `m365_graph_identity_governance.pim_group_eligibility_schedule_instances_filter_by_current_user` Pim group eligibility schedule instances filter by current user read - `m365_graph_identity_governance.pim_group_eligibility_schedule_instances_get` Get pim group eligibility schedule instances read - `m365_graph_identity_governance.pim_group_eligibility_schedule_instances_list` List pim group eligibility schedule instances read - `m365_graph_identity_governance.pim_group_eligibility_schedule_requests_cancel` Pim group eligibility schedule requests cancel destructive - `m365_graph_identity_governance.pim_group_eligibility_schedule_requests_create` Create pim group eligibility schedule requests destructive - `m365_graph_identity_governance.pim_group_eligibility_schedule_requests_filter_by_current_user` Pim group eligibility schedule requests filter by current user read - `m365_graph_identity_governance.pim_group_eligibility_schedule_requests_get` Get pim group eligibility schedule requests read - `m365_graph_identity_governance.pim_group_eligibility_schedule_requests_list` List pim group eligibility schedule requests read - `m365_graph_identity_governance.pim_group_eligibility_schedules_filter_by_current_user` Pim group eligibility schedules filter by current user read - `m365_graph_identity_governance.pim_group_eligibility_schedules_get` Get pim group eligibility schedules read - `m365_graph_identity_governance.pim_group_eligibility_schedules_list` List pim group eligibility schedules read **Pim roles 22** - `m365_graph_identity_governance.pim_directory_role_assignment_schedule_instances_filter_by_current_user` Pim directory role assignment schedule instances filter by current user read - `m365_graph_identity_governance.pim_directory_role_assignment_schedule_instances_get` Get pim directory role assignment schedule instances read - `m365_graph_identity_governance.pim_directory_role_assignment_schedule_instances_list` List pim directory role assignment schedule instances read - `m365_graph_identity_governance.pim_directory_role_assignment_schedule_requests_cancel` Pim directory role assignment schedule requests cancel destructive - `m365_graph_identity_governance.pim_directory_role_assignment_schedule_requests_create` Create pim directory role assignment schedule requests destructive - `m365_graph_identity_governance.pim_directory_role_assignment_schedule_requests_filter_by_current_user` Pim directory role assignment schedule requests filter by current user read - `m365_graph_identity_governance.pim_directory_role_assignment_schedule_requests_get` Get pim directory role assignment schedule requests read - `m365_graph_identity_governance.pim_directory_role_assignment_schedule_requests_list` List pim directory role assignment schedule requests read - `m365_graph_identity_governance.pim_directory_role_assignment_schedules_filter_by_current_user` Pim directory role assignment schedules filter by current user read - `m365_graph_identity_governance.pim_directory_role_assignment_schedules_get` Get pim directory role assignment schedules read - `m365_graph_identity_governance.pim_directory_role_assignment_schedules_list` List pim directory role assignment schedules read - `m365_graph_identity_governance.pim_directory_role_eligibility_schedule_instances_filter_by_current_user` Pim directory role eligibility schedule instances filter by current user read - `m365_graph_identity_governance.pim_directory_role_eligibility_schedule_instances_get` Get pim directory role eligibility schedule instances read - `m365_graph_identity_governance.pim_directory_role_eligibility_schedule_instances_list` List pim directory role eligibility schedule instances read - `m365_graph_identity_governance.pim_directory_role_eligibility_schedule_requests_cancel` Pim directory role eligibility schedule requests cancel destructive - `m365_graph_identity_governance.pim_directory_role_eligibility_schedule_requests_create` Create pim directory role eligibility schedule requests destructive - `m365_graph_identity_governance.pim_directory_role_eligibility_schedule_requests_filter_by_current_user` Pim directory role eligibility schedule requests filter by current user read - `m365_graph_identity_governance.pim_directory_role_eligibility_schedule_requests_get` Get pim directory role eligibility schedule requests read - `m365_graph_identity_governance.pim_directory_role_eligibility_schedule_requests_list` List pim directory role eligibility schedule requests read - `m365_graph_identity_governance.pim_directory_role_eligibility_schedules_filter_by_current_user` Pim directory role eligibility schedules filter by current user read - `m365_graph_identity_governance.pim_directory_role_eligibility_schedules_get` Get pim directory role eligibility schedules read - `m365_graph_identity_governance.pim_directory_role_eligibility_schedules_list` List pim directory role eligibility schedules read **Terms of use 9** - `m365_graph_identity_governance.terms_of_use_agreements_acceptances_list` List terms of use agreements acceptances read - `m365_graph_identity_governance.terms_of_use_agreements_create` Create terms of use agreements write - `m365_graph_identity_governance.terms_of_use_agreements_delete` Delete terms of use agreements destructive - `m365_graph_identity_governance.terms_of_use_agreements_file_get` Get terms of use agreements file read - `m365_graph_identity_governance.terms_of_use_agreements_file_localizations_list` List terms of use agreements file localizations read - `m365_graph_identity_governance.terms_of_use_agreements_files_create` Create terms of use agreements files write - `m365_graph_identity_governance.terms_of_use_agreements_get` Get terms of use agreements read - `m365_graph_identity_governance.terms_of_use_agreements_list` List terms of use agreements read - `m365_graph_identity_governance.terms_of_use_agreements_update` Update terms of use agreements write **Pim policies 7** - `m365_graph_identity_governance.pim_policies_role_management_policies_get` Get pim policies role management policies read - `m365_graph_identity_governance.pim_policies_role_management_policies_list` List pim policies role management policies read - `m365_graph_identity_governance.pim_policies_role_management_policies_rules_get` Get pim policies role management policies rules read - `m365_graph_identity_governance.pim_policies_role_management_policies_rules_list` List pim policies role management policies rules read - `m365_graph_identity_governance.pim_policies_role_management_policies_rules_update` Update pim policies role management policies rules write - `m365_graph_identity_governance.pim_policies_role_management_policy_assignments_get` Get pim policies role management policy assignments read - `m365_graph_identity_governance.pim_policies_role_management_policy_assignments_list` List pim policies role management policy assignments read **App consent 6** - `m365_graph_identity_governance.app_consent_app_consent_requests_filter_by_current_user` App consent app consent requests filter by current user read - `m365_graph_identity_governance.app_consent_app_consent_requests_get` Get app consent app consent requests read - `m365_graph_identity_governance.app_consent_app_consent_requests_list` List app consent app consent requests read - `m365_graph_identity_governance.app_consent_app_consent_requests_user_consent_requests_filter_by_current_user` App consent app consent requests user consent requests filter by current user read - `m365_graph_identity_governance.app_consent_app_consent_requests_user_consent_requests_get` Get app consent app consent requests user consent requests read - `m365_graph_identity_governance.app_consent_app_consent_requests_user_consent_requests_list` List app consent app consent requests user consent requests read **Entitlement roles 6** - `m365_graph_identity_governance.entitlement_roles_role_assignments_create` Create entitlement roles role assignments destructive - `m365_graph_identity_governance.entitlement_roles_role_assignments_delete` Delete entitlement roles role assignments destructive - `m365_graph_identity_governance.entitlement_roles_role_assignments_get` Get entitlement roles role assignments read - `m365_graph_identity_governance.entitlement_roles_role_assignments_list` List entitlement roles role assignments read - `m365_graph_identity_governance.entitlement_roles_role_definitions_get` Get entitlement roles role definitions read - `m365_graph_identity_governance.entitlement_roles_role_definitions_list` List entitlement roles role definitions read Questions ## The Microsoft Entra ID Governance (Graph) MCP server, answered. **Is there a Microsoft Entra ID Governance (Graph) MCP server for Claude?** Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 250 Microsoft Entra ID Governance (Graph) actions across entitlement management, lifecycle workflows, access reviews and pim groups, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Microsoft Entra ID Governance (Graph). **What do I need to connect Microsoft Entra ID Governance (Graph)?** Entra application (client) id and Entra client secret. Plus your tenant id. The free call account { op: "connections.requirements", service: "m365_graph_identity_governance" } lists exactly what to paste. **Can an AI agent delete or change things in Microsoft Entra ID Governance (Graph)?** Only if its key allows it, and only with an explicit confirmation. 36 Microsoft Entra ID Governance (Graph) actions are destructive, including delete entitlement assignment policies, entitlement assignment requests cancel and delete access reviews definitions. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it. **Will an AI agent use up my Microsoft Entra ID Governance (Graph) API limit?** actionlake paces every call to the limits in the Microsoft Entra ID Governance (Graph) service file: 10,000 calls per 10 minutes per connection. Repeated reads are answered from cache (154 Microsoft Entra ID Governance (Graph) actions can be), which never reaches Microsoft Entra ID Governance (Graph). **What does a Microsoft Entra ID Governance (Graph) action cost?** One upstream call, the only unit actionlake bills. A list that pages bills one call per page (94 Microsoft Entra ID Governance (Graph) actions page). Cache hits, searches, dry runs and calls Microsoft Entra ID Governance (Graph) refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. **Which Microsoft Entra ID Governance (Graph) API does it cover?** The Microsoft Entra ID Governance (Graph) API v1.0 at graph.microsoft.com/v1.0. It is built from Microsoft Entra ID Governance (Graph)'s documentation as read on 23 October 2026. 250 actions in 9 areas, each one in the signed service file (version 1.0.0). **Does actionlake keep my Microsoft Entra ID Governance (Graph) data, and where?** actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to an hour, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Microsoft Entra ID Governance (Graph) credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models. **Which AI clients can use it?** Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names. ## More connectors like Microsoft Entra ID Governance (Graph) Shares the most action names with - [Lumos 15](https://actionlake.com/connectors/lumos) - [Microsoft 365 Users 12](https://actionlake.com/connectors/microsoft-365-users) - [Opal Security 9](https://actionlake.com/connectors/opal-security) - [PingOne Platform API 9](https://actionlake.com/connectors/pingone-platform-api) - [SailPoint Identity Security Cloud 7](https://actionlake.com/connectors/sailpoint-identity-security-cloud) - [ConductorOne 2](https://actionlake.com/connectors/conductorone) Joins with, on shared entities - [HaloPSA 1](https://actionlake.com/connectors/halopsa) - [Fortinet FortiGate 1](https://actionlake.com/connectors/fortinet-fortigate) - [Genesys Cloud CX 1](https://actionlake.com/connectors/genesys-cloud-cx) - [Harness Platform 1](https://actionlake.com/connectors/harness-platform) - [Commvault Cloud 1](https://actionlake.com/connectors/commvault-cloud) - [Delinea Secret Server 1](https://actionlake.com/connectors/delinea-secret-server) Browse - [All Identity & security connectors](https://actionlake.com/connectors/category/identity-and-security) - [All connectors](https://actionlake.com/connectors) - [How actionlake compares](https://actionlake.com/compare) actionlake is independent. It is not made or endorsed by Microsoft Entra ID Governance (Graph); the name is the vendor's own. Counts are from the Microsoft Entra ID Governance (Graph) service file, version 1.0.0. ## Give your agent Microsoft Entra ID Governance (Graph) today. [Connect Microsoft Entra ID Governance (Graph) free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free. --- Source: https://actionlake.com/connectors/microsoft-entra-id-governance-graph More: https://actionlake.com/llms.txt