Microsoft Entra ID logo

Integrate Microsoft Entra ID with your AI CRM

Manage Microsoft Entra ID directory resources through Microsoft Graph v1.0, including users, groups, applications, roles, devices, policies, and audit data.

Automate your first taskSign up with Google

Explore Triggers and Actions

Add Administrative Unit Member

Add one existing user, group, or device to an assigned-membership Microsoft Entra administrative unit, bringing that object into the unit's delegated administration scope. Dynamic administrative units are managed only by their membership rule and reject manual changes. In a restricted-management unit, a group must be a nonunified, security-enabled, non-mail-enabled group that is not synchronized from on-premises. For delegated access, Privileged Role Administrator is the least-privileged supported role. App-only callers that need directory reads also require a supported directory-reader role or an application permission such as Directory.Read.All.

ActionTry it

Add Application Owner

Add an existing user or service principal as an owner of an application registration, granting authority to administer it. For delegated access, the signed-in user must also hold Application Administrator, Cloud Application Administrator, Hybrid Identity Administrator, or a supported custom Microsoft Entra role.

ActionTry it

Add Directory Role Member

Assign a principal to an activated Microsoft Entra directory role, granting that role's tenant-wide administrative access. This is an access-elevation operation. For delegated access, the signed-in user must be a Privileged Role Administrator (the least-privileged supported role) or hold a custom role that grants the permissions required for this operation. Prefer unified role assignments when scoped access is required.

ActionTry it

Add Group Member

Add an existing directory object as a direct member of an assigned-membership Microsoft Entra group. Dynamic group membership cannot be changed manually. Role-assignable groups additionally require RoleManagement.ReadWrite.Directory and an eligible Entra role. Adding a device, service principal, or organizational contact can require an additional permission for that member type.

ActionTry it

Add Group Owner

Add an existing user or service principal as an owner of a Microsoft 365 or security group, granting authority to modify the group. Delegated callers must also be a group owner or hold a supported Microsoft Entra role; some roles can add only user owners or are limited to particular group types.

ActionTry it

Add Service Principal Owner

Add an existing user or service principal as an owner of an enterprise application/service principal, granting authority to administer it. For delegated access, the signed-in user must also hold Application Administrator, Cloud Application Administrator, Hybrid Identity Administrator, or a supported custom Microsoft Entra role. With app-only Application.ReadWrite.OwnedBy access, the calling application must already own the target service principal.

ActionTry it

Assign User Licenses

Add and remove Microsoft product licenses for one Entra user in a single request. Both add and remove lists are required and either can be empty. Removing a license revokes the user's entitlement to that product's services and can immediately prevent access; data retention depends on the affected Microsoft product.

ActionTry it

Create Administrative Unit

Create an assigned or dynamic Microsoft Entra administrative unit for scoping directory administration. Restricted member management can be set only during creation and is immutable afterward.

ActionTry it

Create App Role Assignment

Assign an application role to a user, group, or client service principal. This grants the principal the application access represented by that role; for client service principals, the grant is an application permission.

ActionTry it

Create Application

Create a Microsoft Entra application registration with allowlisted platform, role, and API permission settings, without creating or accepting password or key credentials.

ActionTry it

Create Group

Create a Microsoft 365, assigned security, or dynamic-membership group. Optionally bind up to 20 total initial owners and members by directory object ID; dynamic groups cannot have initial members.

ActionTry it

Create Role Assignment

Grant a user, role-assignable group, or service principal a Microsoft Entra directory role, conferring the role's administrative access at the explicit tenant, administrative-unit, resource-application, or app-specific scope. This is an access-elevation operation. For delegated access, the signed-in user must be a Privileged Role Administrator (the least-privileged supported role) or hold a custom role that grants the required permissions.

ActionTry it

Create Service Principal

Create an enterprise application (service principal) for an existing application ID without accepting or creating password or key credentials. Delegated callers also need a supported Microsoft Entra role. With app-only Application.ReadWrite.OwnedBy, the calling application must own the backing application.

ActionTry it

Create User

Create a Microsoft Entra tenant user with the required sign-in profile and an initial password. This action only sets the password required during creation; it does not reset passwords or modify authentication methods.

ActionTry it

Delete Administrative Unit

Delete a Microsoft Entra administrative unit and remove its administrative scope. This is irreversible from this toolkit because restoration is not supported here.

ActionTry it

Delete Application

Delete a Microsoft Entra application registration by its directory Object ID. This is irreversible from this toolkit because restoration is not supported here. Deleting the registration can break dependent user or workload sign-in and integrations that rely on its Application (client) ID, permissions, roles, or redirect configuration.

ActionTry it

Delete Group

Delete a Microsoft Entra group and its associated group resources. This is irreversible from this toolkit: Microsoft 365 and security groups can be restored for 30 days only through recovery outside this toolkit, while distribution groups are permanently deleted immediately.

ActionTry it

Delete Service Principal

Delete a Microsoft Entra enterprise application/service principal. This is irreversible from this toolkit because restoration is not supported here. Deletion removes the enterprise application's tenant identity and can break sign-in, resource access, and app-role assignments that depend on it.

ActionTry it

Delete User

Delete a tenant user and remove the directory identity. This deletion is irreversible from this toolkit; restoration is outside this toolkit.

ActionTry it

Disable User

Disable a Microsoft Entra user without deleting the directory object. This sets accountEnabled=false and blocks future sign-ins; already-issued access tokens or sessions can remain usable until they expire or are separately revoked.

ActionTry it

Get Administrative Unit

Get one Microsoft Entra administrative unit by directory object ID.

ActionTry it

Get Application

Get one application registration by its directory Object ID, not its Application (client) ID, returning only credential-safe properties.

ActionTry it

Get Conditional Access Policy

Get one Microsoft Entra Conditional Access policy by object ID. This is a read-only paid-tier capability; delegated callers also need a supported Entra role such as Security Reader, Global Reader, or Conditional Access Administrator.

ActionTry it

Get Device

Get one Microsoft Entra device by its directory Object ID, not its distinct Device Registration Service deviceId value.

ActionTry it

Get Directory Audit

Get one Microsoft Entra directory audit event by its event ID.

ActionTry it

Get Directory Role

Get one Microsoft Entra directory role that is activated in the tenant by its activated role object ID. Inactive role definitions are not available.

ActionTry it

Get Domain

Get one tenant domain by its fully qualified domain name.

ActionTry it

Get Group

Get one tenant group by directory object ID.

ActionTry it

Get Organization

Get the connected Microsoft Entra tenant's organization record by tenant organization ID. The keyed Graph route returns one organization entity.

ActionTry it

Get Role Assignment

Get one unified Microsoft Entra directory role assignment by its assignment ID, including its principal, role definition, and directory or application scope identifiers.

ActionTry it

Get Service Principal

Get one Microsoft Entra enterprise application/service principal by its directory Object ID, not its Application (client) ID, returning only credential-safe properties.

ActionTry it

Get Sign In

Get one retained Microsoft Entra sign-in event by event ID. Availability is limited by the tenant's sign-in data retention policy; downloading sign-in logs requires Microsoft Entra ID P1 or P2, and delegated callers need a supported Entra role such as Reports Reader or Security Reader. P2-only risk details can be hidden.

ActionTry it

Get Subscribed SKU

Get one commercial product subscription acquired by the Microsoft Entra tenant using its subscribed-SKU object ID.

ActionTry it

Get User

Get one tenant user by directory object ID or user principal name.

ActionTry it

Get User Manager

Get the directory object recorded as a user's manager. Returns not found when no manager is assigned.

ActionTry it

List Administrative Unit Members

List users, groups, and devices directly assigned to a Microsoft Entra administrative unit. Hidden membership requires the additional Member.Read.Hidden grant, so hidden members can otherwise be omitted. Properties other than id and type can be null when the connection lacks permission to read a member's concrete object type.

ActionTry it

List Administrative Unit Scoped Role Members

List the legacy scoped-role memberships that grant users administrative access within one Microsoft Entra administrative unit. This action is read-only; create new scoped grants with unified role assignments instead.

ActionTry it

List Administrative Units

List Microsoft Entra administrative units with optional OData filtering, search, field selection, relationship expansion, and cursor pagination.

ActionTry it

List App Role Assignments

List users, groups, and client service principals granted application roles on a resource service principal, with OData filtering, field selection, and cursor pagination. Recently added or removed assignments can be delayed by Microsoft Entra replication.

ActionTry it

List Application Owners

List the users and service principals that own an application registration. Properties other than id and type can be null when the connection lacks permission to read an owner's concrete object type.

ActionTry it

List Applications

List Microsoft Entra application registrations with OData filtering, search, ordering, and cursor pagination. Selection and output schemas structurally exclude password and key credential collections.

ActionTry it

List Conditional Access Policies

List read-only Microsoft Entra Conditional Access policy definitions, including conditions, grant controls, and session controls, with OData queries and cursor pagination. Conditional Access is license-dependent; delegated callers also need a supported Microsoft Entra role.

ActionTry it

List Devices

List devices registered in the Microsoft Entra tenant with optional advanced OData queries and cursor pagination. Results distinguish each device's directory object ID from its registration-service deviceId.

ActionTry it

List Directory Audits

List retained Microsoft Entra directory audit events with documented OData filtering, activity-time ordering, and opaque cursor pagination. Availability is limited by the tenant's Microsoft Entra data-retention policy. For delegated access, the signed-in user must have Reports Reader, Security Reader, Security Administrator, or a supported custom role.

ActionTry it

List Directory Role Members

List principals currently assigned to one activated Microsoft Entra directory role. Microsoft Graph returns up to 1,000 objects by default and this operation does not support $top pagination, so the result is a single bounded collection. Concrete-type properties can be null when the connection has limited permission.

ActionTry it

List Directory Roles

List Microsoft Entra directory roles that are activated in the tenant. Inactive built-in roles and other available role definitions are not returned.

ActionTry it

List Domains

List verified and unverified domains configured for the Microsoft Entra tenant, with documented OData query controls and cursor pagination.

ActionTry it

List Group Members

List a group's direct members; transitive members are not included. Hidden membership requires the additional Member.Read.Hidden grant and, for delegated access, an eligible Entra role, so hidden members can otherwise be omitted. Properties other than id and type can be null when the connection lacks permission to read a member's concrete object type.

ActionTry it

List Group Owners

List the users and service principals that own a group. Microsoft Graph can omit service-principal owners during its staged v1.0 rollout. Properties other than id and type can be null when the connection lacks permission to read an owner's concrete object type.

ActionTry it

List Groups

List tenant groups with general OData options, or list only dynamic-membership groups with a fixed safe filter and membership-rule fields.

ActionTry it

List Organizations

Return the connected Microsoft Entra tenant's organization record. Microsoft Graph exposes it as a collection containing exactly one organization.

ActionTry it

List Role Assignments

List unified Microsoft Entra directory role assignments, including the assigned principal, role definition, and directory or application scope.

ActionTry it

List Service Principal Owners

List directory objects that own an enterprise application/service principal. Properties other than id and type can be null when the connection lacks permission to read an owner's concrete object type.

ActionTry it

List Service Principals

List Microsoft Entra enterprise applications and service principals with OData filtering, search, ordering, and cursor pagination. Selection and output schemas structurally exclude password credentials, key credentials, and token-encryption key identifiers.

ActionTry it

List Sign Ins

List retained Microsoft Entra sign-in events, newest first. Prefer a createdDateTime range filter to avoid timeouts. Results are limited by the tenant's retention policy; downloading sign-in logs requires Microsoft Entra ID P1 or P2, and delegated callers need a supported Entra role such as Reports Reader or Security Reader. P2-only risk details can be hidden.

ActionTry it

List Subscribed SKUs

List commercial product subscriptions acquired by the Microsoft Entra tenant, including assigned-license counts, prepaid-unit availability, and included service plans.

ActionTry it

List User Direct Reports

List directory objects that directly report to one user, with optional OData filtering, search, ordering, field selection, and safe cursor pagination.

ActionTry it

List User License Details

List one tenant user's assigned product licenses and the provisioning state of their included service plans.

ActionTry it

List User Memberships

List groups, directory roles, and administrative units a user directly belongs to. This is not transitive. Hidden memberships require the additional Member.Read.Hidden grant and otherwise might be omitted. Advanced OData queries use an eventually consistent index, so recent membership changes might not appear immediately.

ActionTry it

List Users

List tenant users with optional OData filtering, search, ordering, field selection, and a safe continuation cursor.

ActionTry it

Remove Administrative Unit Member

Remove a user, group, or device from a Microsoft Entra administrative unit, ending administration scoped through that membership. This is irreversible from this toolkit because the prior membership is not restored automatically. The request retains the mandatory /$ref suffix, so it removes only the membership reference and never deletes the member directory object.

ActionTry it

Remove App Role Assignment

Remove an app-role assignment from a Microsoft Entra resource service principal. This revokes the user, group, or client service principal's application access granted by that role. The removal is irreversible from this toolkit because the prior assignment is not restored automatically.

ActionTry it

Remove Application Owner

Remove an owner from a Microsoft Entra application registration, revoking that principal's authority to administer the application. This is irreversible from this toolkit because prior ownership and administration access are not restored automatically. Microsoft recommends retaining at least two owners; verify that another valid owner will retain access before removal. The request preserves the required /$ref suffix, so it removes only the ownership reference and never deletes the owner directory object. With app-only authentication, the target application must be owned by the calling application when using Application.ReadWrite.OwnedBy.

ActionTry it

Remove Directory Role Member

Remove a principal from an activated Microsoft Entra directory role, revoking the role's tenant-wide administrative access. This is irreversible from this toolkit because the prior role membership is not restored automatically. The request retains the mandatory /$ref suffix, so it removes only the membership reference and never deletes the principal directory object.

ActionTry it

Remove Group Member

Remove a direct member from an assigned-membership Microsoft Entra group, revoking access inherited through that membership. This is irreversible from this toolkit because the prior membership is not restored automatically. Dynamic groups do not support manual membership changes. Role-assignable groups additionally require RoleManagement.ReadWrite.Directory and a supported Microsoft Entra role. The request retains the required /$ref suffix so it removes only the membership reference and never deletes the member object.

ActionTry it

Remove Group Owner

Remove a user or service principal as an owner of a Microsoft Entra group, revoking that principal's authority to administer the group. This is irreversible from this toolkit because prior ownership is not restored automatically. Verify that another valid owner remains before removing the current owner; removing the last owner can leave ownership-dependent groups without an administrator. The owner directory object itself is not deleted.

ActionTry it

Remove Role Assignment

Remove a unified Microsoft Entra directory role assignment and revoke the principal's administrative access at that assignment's scope. This is irreversible from this toolkit because the prior assignment is not restored automatically.

ActionTry it

Remove Service Principal Owner

Remove an owner from a Microsoft Entra enterprise application/service principal, revoking that principal's authority to administer it. This is irreversible from this toolkit because prior ownership and administration access are not restored automatically. Microsoft recommends retaining at least two owners; verify that another valid owner will retain access before removal. The request preserves the required /$ref suffix, so it removes only the ownership reference and never deletes the owner directory object. With app-only authentication, the target service principal must be owned by the calling application when using Application.ReadWrite.OwnedBy.

ActionTry it

Update Administrative Unit

Update explicitly supplied profile or dynamic-membership properties of one Microsoft Entra administrative unit. The immutable restricted-member-management property is not accepted.

ActionTry it

Update Application

Update explicitly supplied, allowlisted settings of one Microsoft Entra application registration. Password credentials, key credentials, and token encryption key selection are structurally unavailable. With app-only OAuth, the least-privilege grant can update only applications owned by the calling app.

ActionTry it

Update Group

Update explicitly supplied, allowlisted properties of one Microsoft Entra group, including its dynamic membership rule or processing state. Properties that require separate permissions or delegated-only support are unavailable.

ActionTry it

Update Service Principal

Update explicitly supplied, allowlisted settings of one Microsoft Entra enterprise application/service principal. Password credentials, key credentials, and token-encryption-key selection are structurally unavailable. With app-only OAuth, the least-privilege grant applies only to service principals owned by the calling application.

ActionTry it

Update User

Update allowlisted, non-credential profile properties for one Microsoft Entra user. Only explicitly supplied fields are changed; use null only on fields whose description permits clearing. Account status, passwords, authentication methods, identities, phone properties, lifecycle data, and custom security attributes are intentionally unavailable.

ActionTry it

How the Microsoft Entra ID integration works

The Microsoft Entra ID integration connects your Dench AI CRM directly to Microsoft Entra ID, so agents can read and act on your Microsoft Entra ID data as part of everyday work — answering questions in chat, keeping your CRM in sync, and running automations without anyone copying data between tools.

73 actions are available for agents to invoke on your behalf. Every call runs through Microsoft Entra ID's own authorization, scoped to the account you connect.

Set up Microsoft Entra ID in Dench

  1. 1

    Sign in to your Dench workspace and open Integrations.

  2. 2

    Find Microsoft Entra ID and click Connect — you'll authorize access through Microsoft Entra ID's own sign-in flow. No API keys or code required.

  3. 3

    Ask an agent to use Microsoft Entra ID in chat, or call it from an automation.

  4. 4

    Manage or disconnect the connection any time from workspace settings.

Frequently asked questions

How does the Microsoft Entra ID integration work with Dench?

The Dench Microsoft Entra ID integration connects your AI CRM to Microsoft Entra ID, so AI agents can work with your Microsoft Entra ID data as part of chats, automations, and CRM workflows. You connect your account once, and every agent in your workspace can use it — governed by your workspace permissions.

What actions can AI agents perform with Microsoft Entra ID via Dench?

The Microsoft Entra ID integration currently exposes 73 actions, including Add Administrative Unit Member, Add Application Owner, Add Directory Role Member, Add Group Member, Add Group Owner, and Add Service Principal Owner. Agents invoke them on your behalf from chat or from automations.

Do I need to write code to connect Microsoft Entra ID to Dench?

No. You connect Microsoft Entra ID from your Dench workspace using Microsoft Entra ID's own sign-in and authorization flow — no API keys to copy, no glue code to maintain.

Is the Microsoft Entra ID integration secure?

Connections are authorized through Microsoft Entra ID's own authentication flow, and Dench stores only the authorization needed to act on your behalf. You can review and disconnect the Microsoft Entra ID connection from your workspace settings at any time.

Microsoft Entra ID | Dench AI CRM