# Microsoft Entra ID connector thinklet

Configure Microsoft Entra ID connector thinklets to take specific actions in your workflow.

{% hint style="info" %}
Configure API credentials to connect Microsoft Graph API with the Nexthink platform. For detailed instructions, refer to the [Entra ID integration](https://docs.nexthink.com/library/entra-id-integration-for-workflows) documentation for Workflows.

Refer to the [Permissions](https://learn.microsoft.com/en-gb/graph/api/user-list-memberof?view=graph-rest-1.0\&tabs=http#permissions) section in the Microsoft documentation to view the required authorizations.
{% endhint %}

## Action: Get user UUID <a href="#microsoftentraidconnectorthinklet-action-getuseruuid" id="microsoftentraidconnectorthinklet-action-getuseruuid"></a>

**Get user UUID** retrieves a user Universally Unique Identifier (UUID).

The Microsoft Entra ID connector thinklet relies on the [Get a User](https://learn.microsoft.com/en-us/graph/api/user-get?view=graph-rest-1.0\&tabs=http) API endpoint provided by Microsoft Graph.

<figure><img src="/files/drYXewQZWqulfVBBPu4Y" alt="image-20240531-134603.png" width="457"><figcaption></figcaption></figure>

* **Parameters:** Configure the data used as parameters for this action. Hover over the tooltip icon for more information on how the parameter is mapped and what data is required.
  * **Username**: Active Directory username
* **Outputs:** View the outputs of the connector thinklet.
  * **UUID** (`uuid`): User ID

The table below shows the API Service connector details needed when recreating the connector:

<table><thead><tr><th width="272">Field</th><th>Value</th><th data-hidden></th></tr></thead><tbody><tr><td>Resource Path</td><td><code>/users/{{adUsername}}</code></td><td></td></tr><tr><td>Method</td><td>GET</td><td></td></tr><tr><td>Payload</td><td></td><td></td></tr><tr><td>Outputs</td><td><code>UUID $.id</code></td><td></td></tr></tbody></table>

## Action: Check if a user is in a group <a href="#microsoftentraidconnectorthinklet-action-checkifauserisinagroup" id="microsoftentraidconnectorthinklet-action-checkifauserisinagroup"></a>

**Check if a user is in the group** verifies whether a user belongs to the Entra ID group. If the system finds the user within the group, the **Outputs** field remains empty. If the user is absent from the group or you submit an unsupported query, the **Outputs** field produces either the `Request_ResourceNotFound` or `Request_UnsupportedQuery` error accordingly.

The Microsoft Entra ID connector thinklet relies on the [List a user's direct memberships](https://learn.microsoft.com/en-gb/graph/api/user-list-memberof?view=graph-rest-1.0\&tabs=http) API endpoint provided by Microsoft Graph.

<figure><img src="/files/BU54dNipx9pwAasjl2cF" alt="image-20240531-140301.png" width="425"><figcaption></figcaption></figure>

* **Parameters:** Configure the data used as parameters for this action. Hover over the tooltip icon for more information on how the parameter is mapped and what data is required.
  * **Group UUID**: Active Directory group ID
  * **User UUID**: Entra ID user UUID
* **Outputs:** View the outputs of the connector thinklet.
  * **Error code** (`groupPresenceErrorCode`): Error code

The table below shows the API Service connector details needed when recreating the connector:

<table><thead><tr><th width="272">Field</th><th>Value</th><th data-hidden></th></tr></thead><tbody><tr><td>Resource Path</td><td>/users/{{userUuid}}//memberOf?$filter=id+eq+'{{groupUuid}}'&#x26;$select=id</td><td></td></tr><tr><td>Method</td><td>GET</td><td></td></tr><tr><td>Payload</td><td></td><td></td></tr><tr><td>Outputs</td><td>groupPresenceErrorCode $.error.code</td><td></td></tr></tbody></table>

## Action: Check if a device is member of a group <a href="#microsoftentraidconnectorthinklet-action-checkifadeviceismemberofagroup" id="microsoftentraidconnectorthinklet-action-checkifadeviceismemberofagroup"></a>

**Check if a device is member of a group** verifes whether a device belongs to the Entra ID group. If the system finds the user within the group, the **Outputs** field remains empty. If the user is absent from the group or you submit an unsupported query, the **Outputs** field produces either the Request\_ResourceNotFound or Request\_UnsupportedQuery error accordingly.

The Microsoft Entra ID connector thinklet relies on the [List device memberships](https://learn.microsoft.com/en-gb/graph/api/device-list-memberof?view=graph-rest-1.0\&tabs=http) API endpoint provided by Microsoft Graph.

<figure><img src="/files/IU2IXLpMelZ3B6RqLhlY" alt="image-20240531-142406.png" width="415"><figcaption></figcaption></figure>

* **Parameters:** Configure the data used as parameters for this action. Hover over the tooltip icon for more information on how the parameter is mapped and what data is required.
  * **Device object ID**: Device Azure ID
  * **Group UUID**: Active Directory group ID
* **Outputs:** View the outputs of the connector thinklet.
  * **Error code** (`groupPresenceErrorCode`): Error code

The table below shows the API Service connector details needed when recreating the connector:

<table><thead><tr><th width="272">Field</th><th>Value</th><th data-hidden></th></tr></thead><tbody><tr><td>Resource Path</td><td>/devices/{{DeviceObjectID}}//member<code>Of?$filter=id+eq+'{{groupUuid}}'&#x26;$select=id</code></td><td></td></tr><tr><td>Method</td><td>GET</td><td></td></tr><tr><td>Payload</td><td></td><td></td></tr><tr><td>Outputs</td><td><code>groupPresenceErrorCode $.error.code</code></td><td></td></tr></tbody></table>

## Action: Add user to group <a href="#microsoftentraidconnectorthinklet-action-addusertogroup" id="microsoftentraidconnectorthinklet-action-addusertogroup"></a>

**Add user to group** adds a user to the Entra ID group.

The Microsoft Entra ID connector thinklet relies on the [Add members](https://learn.microsoft.com/en-gb/graph/api/group-post-members?view=graph-rest-1.0\&tabs=http) API endpoint provided by Microsoft Graph.

<figure><img src="/files/RJqQBEmLGoNkfJjP6382" alt="image-20240531-144444.png" width="473"><figcaption></figcaption></figure>

* **Parameters:** Configure the data used as parameters for this action. Hover over the tooltip icon for more information on how the parameter is mapped and what data is required.
  * **User UUID**: User Azure ID
  * **Group UUID**: UUID of the Entra ID group to which you want to add the user
* **Outputs:** View the outputs of the connector thinklet.

The table below shows the API Service connector details needed when recreating the connector:

<table><thead><tr><th width="272">Field</th><th>Value</th><th data-hidden></th></tr></thead><tbody><tr><td>Resource Path</td><td><code>/groups/{{groupUuid}}/members/$ref</code></td><td></td></tr><tr><td>Method</td><td>POST</td><td></td></tr><tr><td>Payload</td><td></td><td></td></tr><tr><td>Outputs</td><td><code>{ "@odata.id": "https://graph.microsoft.com/v1.0/directoryObjects/{{userUuid}}"}</code></td><td></td></tr></tbody></table>

## Action: Remove a user from a group <a href="#microsoftentraidconnectorthinklet-action-removeauserfromagroup" id="microsoftentraidconnectorthinklet-action-removeauserfromagroup"></a>

**Remove a user from a group** removes the user from the Entra ID group.

The Microsoft Entra ID connector thinklet relies on the [Remove member](https://learn.microsoft.com/en-gb/graph/api/group-delete-members?view=graph-rest-1.0\&tabs=http) API endpoint provided by Microsoft Graph.

<figure><img src="/files/GSHoklX2e1V4VS60y478" alt="image-20240531-145251.png" width="453"><figcaption></figcaption></figure>

* **Parameters:** Configure the data used as parameters for this action. Hover over the tooltip icon for more information on how the parameter is mapped and what data is required.
  * **User UUID**: User Azure ID
  * **Group UUID**: UUID of the Entra ID group from which you want the user removed
* **Outputs:** View the outputs of the connector thinklet.

The table below shows the API Service connector details needed when recreating the connector:

<table><thead><tr><th width="272">Field</th><th>Value</th><th data-hidden></th></tr></thead><tbody><tr><td>Resource Path</td><td><code>/groups/{{groupUuid}}/members/{{userUuid}}/$ref</code></td><td></td></tr><tr><td>Method</td><td>DELETE</td><td></td></tr><tr><td>Payload</td><td></td><td></td></tr><tr><td>Outputs</td><td></td><td></td></tr></tbody></table>

## Action: Get user manager <a href="#microsoftentraidconnectorthinklet-action-getusermanager" id="microsoftentraidconnectorthinklet-action-getusermanager"></a>

**Get user manager** retrieves the user manager information.

The Microsoft Entra ID connector thinklet relies on the [List manager](https://learn.microsoft.com/en-gb/graph/api/user-list-manager?view=graph-rest-1.0\&tabs=http) API endpoint provided by Microsoft Graph.

{% hint style="warning" %}
Please note that this action does not support application-type permissions and requires delegated permissions.\
For more information on the required permissions and their types, please refer to the API endpoint's documentation for this connector action.
{% endhint %}

<figure><img src="/files/cbaJTtl6ihoY5njhmvTv" alt="image-20240531-145852.png" width="435"><figcaption></figcaption></figure>

* **Parameters:** Configure the data used as parameters for this action. Hover over the tooltip icon for more information on how the parameter is mapped and what data is required.
  * **AD user name**: Active Directory username
* **Outputs:** View the outputs of the connector thinklet.
  * **Manager user UUID** (`ManagerUserUUID`): Manager user UUID
  * **Manager UPN** (**User Principal Name**) (`ManagerUPN`): Manager User Principal Name (UPN)
  * **Manager email address** (`ManagerEmailAddress`): Manager email address

The table below shows the API Service connector details needed when recreating the connector:

<table><thead><tr><th width="272">Field</th><th>Value</th><th data-hidden></th></tr></thead><tbody><tr><td>Resource Path</td><td><code>/users/{{adUsername}}/manager</code></td><td></td></tr><tr><td>Method</td><td>GET</td><td></td></tr><tr><td>Payload</td><td></td><td></td></tr><tr><td>Outputs</td><td><p><code>ManagerUserUUID $.id</code></p><p><code>ManagerEmailAddress $.mail</code></p><p><code>ManagerUPN $.userPrincipalName</code></p></td><td></td></tr></tbody></table>

## Action: Check user license <a href="#microsoftentraidconnectorthinklet-action-checkuserlicense" id="microsoftentraidconnectorthinklet-action-checkuserlicense"></a>

**Check user license** verifies whether a specific user has a particular license assigned in Azure.

The Microsoft Entra ID connector thinklet relies on the [List licenseDetails](https://learn.microsoft.com/en-us/graph/api/user-list-licensedetails?view=graph-rest-1.0\&tabs=http) API endpoint provided by Microsoft Graph.

{% hint style="warning" %}
Please note that this action does not support application-type permissions and requires delegated permissions.\
For more information on the required permissions and their types, please refer to the API endpoint's documentation for this connector action.
{% endhint %}

<figure><img src="/files/ac1LP47dY1ooMuqgJWF0" alt="image-20240320-082519.png" width="457"><figcaption></figcaption></figure>

* **Parameters:** Configure the data used as parameters for this action. Hover over the tooltip icon for more information on how the parameter is mapped and what data is required.
  * **AD user name**: Active Directory username
  * **Software license SKU Part Number**: skuPartNumber property of global workflow parameter [SKU Part Number](https://learn.microsoft.com/en-us/graph/api/resources/licensedetails?view=graph-rest-1.0#properties)
* **Outputs:** View the outputs of the connector thinklet.
  * **Software license SKU part number** (`outputSkuPartNumber`): Software license SKU part number
  * **SKU ID** (`skuId`): SKU internal ID

The table below shows the API Service connector details needed when recreating the connector:

<table><thead><tr><th width="272">Field</th><th>Value</th><th data-hidden></th></tr></thead><tbody><tr><td>Resource Path</td><td><code>/users/{{adUsername}}/licenseDetails</code></td><td></td></tr><tr><td>Method</td><td>GET</td><td></td></tr><tr><td>Payload</td><td></td><td></td></tr><tr><td>Outputs</td><td><p><code>skuId $.value[?(@.skuPartNumber=="{{skuPartNumber}}")].skuId</code></p><p><code>outputSkuPartNumber $.value[?(@.skuPartNumber=="{{skuPartNumber}}")].skuPartNumber</code></p></td><td></td></tr></tbody></table>

## Action: Get user details <a href="#microsoftentraidconnectorthinklet-action-getuserdetails" id="microsoftentraidconnectorthinklet-action-getuserdetails"></a>

**Get user details** retrieves user details such as job title, mobile phone number and office location.

The Microsoft Entra ID connector thinklet relies on the [Get user](https://learn.microsoft.com/en-gb/graph/api/intune-mam-user-get?view=graph-rest-1.0\&tabs=http) API endpoint provided by Microsoft Graph.

<figure><img src="/files/9KdbVD6acrYNKsRp9EW9" alt="image-20240531-151328.png" width="419"><figcaption></figcaption></figure>

* **Parameters:** Configure the data used as parameters for this action. Hover over the tooltip icon for more information on how the parameter is mapped and what data is required.
  * **AD user name**: Active Directory username
* **Outputs:** View the outputs of the connector thinklet.
  * **User job title** (`UserJobTitle`): User job title
  * **User mobile phone** (`UserMobilePhone`): User mobile phone
  * **User office location** (`UserOfficeLocation`): User office location

The table below shows the API Service connector details needed when recreating the connector:

<table><thead><tr><th width="272">Field</th><th>Value</th><th data-hidden></th></tr></thead><tbody><tr><td>Resource Path</td><td>/users/{{adUsername}}</td><td></td></tr><tr><td>Method</td><td>GET</td><td></td></tr><tr><td>Payload</td><td></td><td></td></tr><tr><td>Outputs</td><td><p><code>UserJobTitle $.jobTitle</code></p><p><code>UserMobilePhone $.mobilePhone</code></p><p><code>UserOfficeLocation $.officeLocation</code></p></td><td></td></tr></tbody></table>

## Action: Get device object ID <a href="#microsoftentraidconnectorthinklet-action-getdeviceobjectid" id="microsoftentraidconnectorthinklet-action-getdeviceobjectid"></a>

**Get device object ID** retrieves the device UUID.

The Microsoft Entra ID connector thinklet relies on the [List devices](https://learn.microsoft.com/en-us/graph/api/device-list?view=graph-rest-1.0\&tabs=http) API endpoint provided by Microsoft Graph.

<figure><img src="/files/0aKh1drhjgLGuGaiwDOR" alt="image-20240531-152149.png" width="425"><figcaption></figcaption></figure>

* **Parameters:** Configure the data used as parameters for this action. Hover over the tooltip icon for more information on how the parameter is mapped and what data is required.
  * **Device name**: Active Directory device name
* **Outputs:** View the outputs of the connector thinklet.
  * **Device object ID** (`DeviceObjectID`): Device object ID

The table below shows the API Service connector details needed when recreating the connector:

<table><thead><tr><th width="272">Field</th><th>Value</th><th data-hidden></th></tr></thead><tbody><tr><td>Resource Path</td><td><code>/devices?$filter=displayName+eq+'{{DeviceName}}'</code></td><td></td></tr><tr><td>Method</td><td>GET</td><td></td></tr><tr><td>Payload</td><td></td><td></td></tr><tr><td>Outputs</td><td><code>DeviceObjectID $.value[0].id</code></td><td></td></tr></tbody></table>

## Action: Add device to the group <a href="#microsoftentraidconnectorthinklet-action-adddevicetothegroup" id="microsoftentraidconnectorthinklet-action-adddevicetothegroup"></a>

**Add device to the group** adds the device to the group.

The Microsoft Entra ID connector thinklet relies on the [Add members](https://learn.microsoft.com/en-gb/graph/api/group-post-members?view=graph-rest-1.0\&tabs=http) API endpoint provided by Microsoft Graph.

<figure><img src="/files/vqgYsZA3cOCeIqB1N1E0" alt="image-20240604-105948.png" width="448"><figcaption></figcaption></figure>

* **Parameters:** Configure the data used as parameters for this action. Hover over the tooltip icon for more information on how the parameter is mapped and what data is required.
  * **Device object ID**: Entra ID device ID
  * **Group UUID**: UUID of the Entra ID group to which you want to add the device
* **Outputs:** View the outputs of the connector thinklet.

The table below shows the API Service connector details needed when recreating the connector:

<table><thead><tr><th width="272">Field</th><th>Value</th><th data-hidden></th></tr></thead><tbody><tr><td>Resource Path</td><td><code>/groups/{{groupUuid}}/members/$ref</code></td><td></td></tr><tr><td>Method</td><td>POST</td><td></td></tr><tr><td>Payload</td><td><code>{"@odata.id": "https://graph.microsoft.com/v1.0/directoryObjects/{{DeviceObjectID}}"}</code></td><td></td></tr><tr><td>Outputs</td><td></td><td></td></tr></tbody></table>

## Action: Remove device from the group <a href="#microsoftentraidconnectorthinklet-action-removedevicefromthegroup" id="microsoftentraidconnectorthinklet-action-removedevicefromthegroup"></a>

**Remove device from the group** removes the device from the group.

The Microsoft Entra ID connector thinklet relies on the [Remove member](https://learn.microsoft.com/en-gb/graph/api/group-delete-members?view=graph-rest-1.0\&tabs=http) API endpoint provided by Microsoft Graph.

<figure><img src="/files/dAQYAUtUsdIuSpFW30Mj" alt="image-20240604-110920.png" width="415"><figcaption></figcaption></figure>

* **Parameters:** Configure the data used as parameters for this action. Hover over the tooltip icon for more information on how the parameter is mapped and what data is required.
  * **Device object ID**: Entra ID device ID
  * **Group UUID**: UUID of the Entra ID group from which you want to remove the device

The table below shows the API Service connector details needed when recreating the connector:

<table><thead><tr><th width="272">Field</th><th>Value</th><th data-hidden></th></tr></thead><tbody><tr><td>Resource Path</td><td><code>/groups/{{GroupUUID}}/members/{{DeviceObjectID}}/$ref</code></td><td></td></tr><tr><td>Method</td><td>DELETE</td><td></td></tr><tr><td>Payload</td><td></td><td></td></tr><tr><td>Outputs</td><td></td><td></td></tr></tbody></table>

Refer to the [Configuring connector thinklets](/platform/user-guide/workflows/creating-workflows/configuring-connector-thinklet.md) documentation for more information about connector thinklets.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.nexthink.com/platform/user-guide/workflows/creating-workflows/configuring-connector-thinklet/microsoft-entra-id-connector-thinklet.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.