Entra

Provides integration with Microsoft Entra ID through Microsoft Graph v1.0 to manage users, groups, direct memberships, and enterprise applications.

Revision History

0.1.3.0 - Initial release.

Connection

This Connection stores the delegated Microsoft Graph OAuth settings used by every Entra method.

Property	Type	Description
Tenant ID	String	Microsoft Entra tenant identifier. Use common for a multi-tenant delegated sign-in.
Client ID	String	Application (client) identifier from the Microsoft Entra app registration.
Client Secret	Masked	Application secret used for delegated OAuth token exchange and refresh.
Scopes	String	Delegated Microsoft Graph scopes required by the Entra Node methods.
Access Token	Masked	Delegated OAuth access token used for Microsoft Graph requests.
Refresh Token	Masked	Delegated OAuth refresh token used to renew Microsoft Graph access.

Setup Notes

• The Entra Node is available on Cloud Runtime clusters.
• Create a Microsoft Entra registered application for delegated Microsoft Graph access.
• Configure Tenant ID, Client ID, and Client Secret. The default Tenant ID is common.
• The default Scopes value is openid profile offline_access User.Read.All User.ReadWrite.All User.EnableDisableAccount.All Group.ReadWrite.All Application.Read.All.
• Grant administrator consent for permissions that require it.
• Ensure the signed-in identity has the Microsoft Entra directory roles required for write operations. An OAuth scope does not grant a directory role by itself.
• Complete the OAuth sign-in to populate Access Token and Refresh Token, then test the Connection. The Connection test requests the first user record to verify delegated Graph access.

Methods

Select a template for the required operation. The selected template populates the stable OperationId and the operation-specific inputs.

Get

Gets one user, group, or enterprise application.

Available templates and their OperationId values:

• Get user (GetUser) - Gets a user by object ID or user principal name.
• Get group (GetGroup) - Gets a group by object ID.
• Get enterprise application (GetEnterpriseApplication) - Gets an enterprise application service principal by object ID.

Parameter	Type	Description
Connection	Connection	Entra Connection details including delegated Microsoft Graph authentication.
OperationId	String	Stable operation identifier populated by the selected template.
UserID	String	User object ID or user principal name required by GetUser.
GroupID	String	Group object ID required by GetGroup.
EnterpriseApplicationID	String	Enterprise application service-principal object ID required by GetEnterpriseApplication.

Return	Type	Description
Response	Object	The provider object returned by Microsoft Graph.

List

Lists users, groups, direct memberships, or enterprise applications. The Node follows Microsoft Graph continuation links automatically and emits one row for each result.

Available templates and their OperationId values:

• List users (ListUsers) - Searches and lists users.
• List groups (ListGroups) - Searches and lists groups.
• List group members (ListGroupMembers) - Searches and lists the direct members of a group.
• List user memberships (ListUserMemberships) - Searches and lists the direct memberships of a user.
• List enterprise applications (ListEnterpriseApplications) - Searches and lists enterprise application service principals.

Parameter	Type	Description
Connection	Connection	Entra Connection details including delegated Microsoft Graph authentication.
OperationId	String	Stable operation identifier populated by the selected template.
GroupID	String	Group object ID required by ListGroupMembers.
UserID	String	User object ID or user principal name required by ListUserMemberships.
Search	String	Optional Microsoft Graph search clause. You can reference case-sensitive placeholders defined in CustomParameters.
CustomParameters	Object	Optional string values substituted into matching @ placeholders in Search.

Return	Type	Description
Response	Array	Streamed Microsoft Graph result rows.

Create

Creates users or groups from streamed Items.

Available templates and their OperationId values:

• Create user (CreateUser) - Creates users from provider-shaped payloads.
• Create group (CreateGroup) - Creates groups from provider-shaped payloads.

Parameter	Type	Description
Connection	Connection	Entra Connection details including delegated Microsoft Graph authentication.
OperationId	String	Stable operation identifier populated by the selected template.
Items	Array	Streamed create payloads. CreateUser requires displayName, mailNickname, userPrincipalName, accountEnabled, and a passwordProfile object containing password. CreateGroup requires displayName, mailNickname, mailEnabled, and securityEnabled.

Return	Type	Description
Response	Array	One response row per input position. Successful rows include the created provider object and Flowgear result metadata.

Update

Updates users, groups, or direct group membership from streamed Items.

Available templates and their OperationId values:

• Update user (UpdateUser) - Updates user Properties.
• Update group (UpdateGroup) - Updates group Properties.
• Add group member (AddGroupMember) - Adds a user to a group.
• Remove group member (RemoveGroupMember) - Removes a user from a group.

Parameter	Type	Description
Connection	Connection	Entra Connection details including delegated Microsoft Graph authentication.
OperationId	String	Stable operation identifier populated by the selected template.
Items	Array	Streamed update payloads. User updates require UserID; group updates require GroupID; membership changes require GroupID and the user's object ID in MemberID.

Return	Type	Description
Response	Array	One response row per input position with Flowgear result metadata.

Delete

Deletes users or groups identified by streamed Items.

Available templates and their OperationId values:

• Delete user (DeleteUser) - Deletes users identified by UserID.
• Delete group (DeleteGroup) - Deletes groups identified by GroupID.

Parameter	Type	Description
Connection	Connection	Entra Connection details including delegated Microsoft Graph authentication.
OperationId	String	Stable operation identifier populated by the selected template.
Items	Array	Streamed items containing UserID or GroupID, as required by the selected template.

Return	Type	Description
Response	Array	One response row per input position with Flowgear result metadata.

Enable

Enables user accounts identified by streamed Items. Select the Enable user template, which sets OperationId to EnableUser.

Parameter	Type	Description
Connection	Connection	Entra Connection details including delegated Microsoft Graph authentication.
OperationId	String	Stable operation identifier populated by the EnableUser template.
Items	Array	Streamed items containing the required UserID.

Return	Type	Description
Response	Array	One response row per input position with Flowgear result metadata.

Disable

Disables user accounts identified by streamed Items. Select the Disable user template, which sets OperationId to DisableUser.

Parameter	Type	Description
Connection	Connection	Entra Connection details including delegated Microsoft Graph authentication.
OperationId	String	Stable operation identifier populated by the DisableUser template.
Items	Array	Streamed items containing the required UserID.

Return	Type	Description
Response	Array	One response row per input position with Flowgear result metadata.

Usage Notes

• Get returns one provider object. List emits the contents of Microsoft Graph value arrays and follows validated @odata.nextLink URLs automatically.
• Mutation methods write the first non-null item before the invocation starts returning output. Later writes occur as the output is consumed.
• Every mutation input position produces a response row. Null entries and later items that fail local validation return failure rows without preventing later valid items from running.
• Mutation responses use Flowgear.IsSuccess, Flowgear.Message, and Flowgear.Request. The Node redacts passwordProfile.password from the CreateUser request echoed in Flowgear.Request.
• Enter string-list child Properties as comma-separated strings. For CreateGroup, e.g., enter Unified in groupTypes. The Node converts the value to the string array required by Microsoft Graph. An empty string produces an empty list, and values are not trimmed.
• Authentication is delegated OAuth only. Application-only authentication is not available.
• The Node supports Microsoft Graph v1.0 through its templates. Microsoft Graph beta endpoints, arbitrary URLs, and arbitrary query parameters are not available.
• Membership methods manage direct membership only and accept only a user object ID in MemberID.
• UpdateUser does not accept accountEnabled. Use EnableUser or DisableUser instead.
• Group create and update payloads do not accept owners@odata.bind or members@odata.bind. Use the membership templates for direct member changes.
• Microsoft Graph authorization failures stop the operation because they usually require changes to the Connection scopes, tenant consent, or the signed-in identity's directory roles.

Examples

Search with a custom parameter

Use a strict @Name placeholder in Search, then provide its string value in CustomParameters:

Search: "displayName:@DisplayName"
CustomParameters:
  @DisplayName: Ada

Placeholder names are case-sensitive. A key can include or omit one leading @. The Node rejects empty names, duplicate normalized names, missing referenced values, and referenced values that are null or not strings before calling Microsoft Graph.

Substitution applies only to Search. An @ immediately following an ASCII letter, digit, or underscore is treated as literal text, which preserves user principal names and email addresses such as alice@example.com. The Node escapes backslashes and double quotes in inserted values before encoding the complete search expression.

When Search is present, the Node requests a result count and uses eventual consistency. If the resolved search expression contains &, the Node also disables Microsoft Graph legacy search behavior.