Skip to content

Integration · Developer tools

microsoft.com

Connect Claude & ChatGPT to Microsoft Entra ID

Ask your AI who is in a group, who a person reports to, or which licences are still free, and get the answer from your Microsoft Entra ID directory. It can read users, groups, admin roles, devices, sign-ins and audit logs. It can also update profiles, add and remove group members, assign licences, invite guests and sign a user out everywhere, with your approval if you want it.

Connect Microsoft Entra ID free

Free plan, no credit card. Takes about a minute.

Try asking

  • “Who is in the Sales group, and who owns it?”

    The AI finds the group and lists its members and owners.

  • “Anna in Finance leaves today. Block her sign-in and sign her out everywhere.”

    It updates her account so sign-in is blocked and signs her out of all sessions on every device.

  • “How many licences of each type are still free?”

    It lists your licence products with how many are assigned and how many are available.

What your AI can do

Users and managers

Search and read users, update job title, department and other profile fields, set managers, list direct reports and block sign-in.

Groups and licences

Create and update groups, add and remove members, list owners, and see and assign licences per user.

Roles, devices and logs

List admin roles and their members, registered devices, guest invitations, sign-ins and directory audit logs.

  • “Invite [email protected] as a guest and email him the invitation.”

    It creates a guest invitation with the page he lands on after accepting, and sends the invitation email.

  • “Who holds the Global Administrator role?”

    It lists the activated admin roles and the members of the one you ask about.

  • “Who changed the Marketing group yesterday?”

    It reads the directory audit log filtered by date and shows who changed what.

125 tools for Microsoft Entra ID

These tools are switched on when you connect. You can switch any of them off, or require your approval before it runs.

  • add_group_memberChanges dataAdd a user or device to a group: `group_id` plus the member as `odata_id` set to https://graph.microsoft.com/v1.0/directoryObjects/{id}. This may grant them access to the group's resources.
  • add_ownersChanges dataCreate a new ref. Search refs first to avoid duplicates. API summary: Add owners.
  • assign_user_licenseChanges dataAdd or remove licences for a user by `user_id`: `add_licenses` (list of {skuId}) and/or `remove_licenses` (list of SKU IDs). May change billing seats.
  • attach_group_licenseChanges dataAssign a group (group id). API summary: Invoke action assignLicense.
  • create_applicationChanges dataCreate a new application. Required: body. Search applications first to avoid duplicates. API summary: Create application.
  • create_companyChanges dataCreate a new company. Search companies first to avoid duplicates. API summary: Add new entity to organization.
  • create_deviceChanges dataCreate a new device. Search devices first to avoid duplicates. API summary: Create device.
  • create_directory_auditChanges dataCreate a new directory audit. Search directory audits first to avoid duplicates. API summary: Create new navigation property to directoryAudits for auditLogs.
  • create_directory_roleDeletesCreate a new directory role. Search directory roles first to avoid duplicates. Destructive action; may require approval. API summary: Activate directoryRole.
  • create_directory_role_templateDeletesCreate a new directory role template. Search directory role templates first to avoid duplicates. Destructive action; may require approval. API summary: Add new entity to directoryRoleTemplates.
  • create_domainChanges dataCreate a new domain. Search domains first to avoid duplicates. API summary: Create domain.
  • create_domain_service_configuration_recordChanges dataCreate a new service configuration record for a domain. Search service configuration records first to avoid duplicates. API summary: Create new navigation property to serviceConfigurationRecords for domains.
  • create_domain_verification_dns_recordChanges dataCreate a new verification dns record for a domain. Search verification dns records first to avoid duplicates. API summary: Create new navigation property to verificationDnsRecords for domains.
  • create_groupChanges dataCreate a group with fields in `body`: `displayName`, `mailNickname`, `mailEnabled`, `securityEnabled`, and `groupTypes` ["Unified"] for a Microsoft 365 group.
  • create_group_check_member_groupChanges dataCreate a new check member group for a group. API summary: Invoke action checkMemberGroups.
  • create_group_renewChanges dataCreate a new renew for a group. API summary: Invoke action renew.
  • create_license_detailChanges dataCreate a new license detail. Search license details first to avoid duplicates. API summary: Create new navigation property to licenseDetails for me.
  • create_methodChanges dataCreate a new method. Search methods first to avoid duplicates. API summary: Create new navigation property to methods for users.
  • create_productChanges dataCreate a new product. Search products first to avoid duplicates. API summary: Add new entity to subscribedSkus.
  • create_refDeletesCreate a new ref. Search refs first to avoid duplicates. Destructive action; may require approval. API summary: Add directory role member.
  • create_service_principalChanges dataCreate a new service principal. Search service principals first to avoid duplicates. API summary: Create servicePrincipal.
  • create_service_principal_app_role_assigned_toDeletesCreate a new app role assigned to for a service principal. Search app role assigned tos first to avoid duplicates. Destructive action; may require approval. API summary: Grant an appRoleAssignment for a service principal.
  • create_service_principal_app_role_assignmentDeletesCreate a new app role assignment for a service principal. Search app role assignments first to avoid duplicates. Destructive action; may require approval. API summary: Grant an appRoleAssignment to a service principal.
  • create_sign_inChanges dataCreate a new sign in. Search sign ins first to avoid duplicates. API summary: Create new navigation property to signIns for auditLogs.
  • create_userChanges dataCreate a new user. Required: body. Search users first to avoid duplicates. API summary: Create User.
  • create_user_app_role_assignmentDeletesCreate a new app role assignment for a user. Search app role assignments first to avoid duplicates. Destructive action; may require approval. API summary: Create appRoleAssignment (for agentUser).
  • create_user_check_member_groupChanges dataCreate a new check member group for a user. API summary: Invoke action checkMemberGroups.
  • create_user_license_detailChanges dataCreate a new license detail for a user. Search license details first to avoid duplicates. API summary: Create new navigation property to licenseDetails for users.
  • create_user_reprocess_license_assignmentChanges dataCreate a new reprocess license assignment for a user. API summary: Invoke action reprocessLicenseAssignment.
  • delete_applicationDeletesPermanently delete a application by application id. Destructive action; may require approval. API summary: Delete application.
  • delete_companyDeletesPermanently delete a company by company id. Destructive action; may require approval. API summary: Delete entity from organization.
  • delete_deviceDeletesPermanently delete a device by device id. Destructive action; may require approval. API summary: Delete device.
  • delete_directory_auditDeletesPermanently delete a directory audit by directory audit id. Destructive action; may require approval. API summary: Delete navigation property directoryAudits for auditLogs.
  • delete_directory_roleDeletesPermanently delete a directory role by directory role id. Destructive action; may require approval. API summary: Delete entity from directoryRoles.
  • delete_domainDeletesPermanently delete a domain by domain id. Destructive action; may require approval. API summary: Delete domain.
  • delete_entity_from_subscribedskusDeletesPermanently delete a product by product id. Destructive action; may require approval. API summary: Delete entity from subscribedSkus.
  • delete_groupDeletesPermanently delete a group by group id. Destructive action; may require approval. API summary: Delete group.
  • delete_member_refsMoves moneyPermanently delete a ref by directory object id. Financial or irreversible action; may require approval. API summary: Remove directory role member.
  • delete_owner_refsMoves moneyPermanently delete a ref by directory object id. Financial or irreversible action; may require approval. API summary: Remove group owner.
  • delete_productDeletesPermanently delete a product by directory object id. Destructive action; may require approval. API summary: Permanently delete item (directory object).
  • delete_refsMoves moneyPermanently delete a ref by directory role id. Financial or irreversible action; may require approval. API summary: Remove directory role member.
  • delete_refs_groups_delete_ref_membersMoves moneyPermanently delete a ref by group id. Financial or irreversible action; may require approval. API summary: Remove member.
  • delete_service_principalDeletesPermanently delete a service principal by service principal id. Destructive action; may require approval. API summary: Delete servicePrincipal.
  • delete_sign_inDeletesPermanently delete a sign in by sign in id. Destructive action; may require approval. API summary: Delete navigation property signIns for auditLogs.
  • delete_userDeletesPermanently delete a user by user id. Destructive action; may require approval.
  • get_applicationGet one application by application id. API summary: Get application.
  • get_companyGet one company by company id. API summary: Get organization.
  • get_deviceGet one device by device id. API summary: Get device.
  • get_directory_auditGet one directory audit by directory audit id. API summary: Get directoryAudit.
  • get_directory_roleGet one directory role by directory role id. API summary: Get directoryRole.
  • get_domainGet one domain by domain id. API summary: Get domain.
  • get_groupGet one group by `group_id`.
  • get_group_member_groupsChanges dataGet one group by group id. API summary: Invoke action getMemberGroups.
  • get_meGet the signed-in user's own profile (name, email, job title, department).
  • get_organizationGet your organisation (tenant) details: name, verified domains and contact info.
  • get_productGet one product by directory object id. API summary: Get deleted item (directory object).
  • get_service_principalGet one service principal by service principal id. API summary: Get servicePrincipal.
  • get_sign_inGet one sign in by sign in id. API summary: Get signIn.
  • get_subscribedskuGet one product by product id. API summary: Get subscribedSku.
  • get_userGet one user by `user_id` (object ID or sign-in name such as [email protected]), optionally choosing fields with `select`.
  • get_user_managerGet a user's manager by `user_id`.
  • get_user_member_groupsChanges dataGet one user by user id. API summary: Invoke action getMemberGroups.
  • invite_guest_userChanges dataInvite an external guest by `invited_user_email_address` with `invite_redirect_url` (where they land after accepting). Set `send_invitation_message` true to email them the invitation.
  • list_audit_logsList directory audit log entries (who changed what), with `filter` by activity or date.
  • list_devicesList or search devices registered in your directory, with `filter` and `select`.
  • list_direct_reportsList the people who report to a user by `user_id`.
  • list_directory_rolesList the activated admin roles in your directory (e.g. Global Administrator).
  • list_group_membersList the members of a group by `group_id`.
  • list_group_members_2Search refs by search, filter, count or orderby. Use this to find existing refs before creating a new ref. Results are paginated. API summary: List group members.
  • list_group_ownersList the owners of a group by `group_id`.
  • list_group_owners_2Search refs by search, filter, count or orderby. Use this to find existing refs before creating a new ref. Results are paginated. API summary: List group owners.
  • list_group_transitive_membersSearch users for a group by search, filter, count, orderby, select or expand. Use this to find existing users before creating a new user. Results are paginated. API summary: List group transitive members.
  • list_groupsList or search groups. Use `filter` (e.g. "startswith(displayName,'Sales')"), `search`, `select` and `limit`.
  • list_invitationsList guest invitations.
  • list_licensesList the licence products (SKUs) your organisation has, with how many are assigned and available.
  • list_managersList managers. Optional filters: select or expand. API summary: Get manager from me.
  • list_refsList refs. API summary: List manager (for agentUser).
  • list_role_membersList who holds an admin role by `directory_role_id`.
  • list_sign_insList recent sign-in events, e.g. `filter` "userPrincipalName eq '[email protected]'" or by date. Requires an Entra ID P1/P2 licence.
  • list_user_devicesList the devices a user has registered, by `user_id`.
  • list_user_groupsList the groups and roles a user is a direct member of, by `user_id`.
  • list_user_licensesList the licences assigned to a user by `user_id`.
  • list_usersList or search users in the directory. Use `filter` (e.g. "department eq 'Sales'"), `search` (e.g. "\"displayName:anna\"" with `consistency_level` eventual), `select` and `limit`.
  • remove_group_memberMoves moneyRemove a member from a group by `group_id` and the member's ID (`directory_object_id`). They lose access granted through the group.
  • remove_group_ownerMoves moneyPermanently delete a ref by group id. Financial or irreversible action; may require approval. API summary: Remove group owner.
  • remove_manager_for_agentuserMoves moneyPermanently delete a ref by user id. Financial or irreversible action; may require approval. API summary: Remove manager (for agentUser).
  • restore_groupChanges dataRestore a group (group id). API summary: Invoke action restore.
  • restore_productChanges dataRestore a product (directory object id). API summary: Invoke action restore.
  • search_application_ownersSearch owners for a application by search, filter, count, orderby, select or expand. Use this to find existing owners before creating a new owner. Results are paginated. API summary: List owners of an application.
  • search_applicationsSearch applications by search, filter, count, orderby, select or expand. Use this to find existing applications before creating a new application. Results are paginated. API summary: List applications.
  • search_direct_reportsSearch direct reports by search, filter, count, orderby, select or expand. Use this to find existing direct reports before creating a new direct report. Results are paginated. API summary: List directReports.
  • search_directory_role_templatesSearch directory role templates by search, filter, count, orderby, select or expand. Use this to find existing directory role templates before creating a new directory role template. Results are paginated. API summary: List directoryRoleTemplates.
  • search_domain_service_configuration_recordsSearch service configuration records for a domain by search, filter, count, orderby, select or expand. Use this to find existing service configuration records before creating a new service configuration record. Results are paginated. API summary: List serviceConfigurationRecords.
  • search_domain_verification_dns_recordsSearch verification dns records for a domain by search, filter, count, orderby, select or expand. Use this to find existing verification dns records before creating a new verification dns record. Results are paginated. API summary: List verificationDnsRecords.
  • search_domainsSearch domains by search, filter, count, orderby, select or expand. Use this to find existing domains before creating a new domain. Results are paginated. API summary: List domains.
  • search_graph_groupsSearch graph groups by search, filter, count, orderby, select or expand. Use this to find existing graph groups before creating a new graph group. Results are paginated. API summary: List deletedItems (directory objects).
  • search_group_member_ofsSearch member ofs for a group by search, filter, count, orderby, select or expand. Use this to find existing member ofs before creating a new member of. Results are paginated. API summary: List group memberships.
  • search_license_detailsSearch license details by search, filter, count, orderby, select or expand. Use this to find existing license details before creating a new license detail. Results are paginated. API summary: List licenseDetails.
  • search_member_ofsSearch member ofs by search, filter, count, orderby, select or expand. Use this to find existing member ofs before creating a new member of. Results are paginated. API summary: Get memberOf from me.
  • search_methodsSearch methods by search, filter, count, orderby, select or expand. Use this to find existing methods before creating a new method. Results are paginated. API summary: Get methods from users.
  • search_refsSearch refs by search, filter, count or orderby. Use this to find existing refs before creating a new ref. Results are paginated. API summary: List members of a directory role.
  • search_service_principal_app_role_assigned_tosSearch app role assigned tos for a service principal by search, filter, count, orderby, select or expand. Use this to find existing app role assigned tos before creating a new app role assigned to. Results are paginated. API summary: Get appRoleAssignment.
  • search_service_principal_app_role_assignmentsSearch app role assignments for a service principal by search, filter, count, orderby, select or expand. Use this to find existing app role assignments before creating a new app role assignment. Results are paginated. API summary: Get appRoleAssignment.
  • search_service_principalsSearch service principals by search, filter, count, orderby, select or expand. Use this to find existing service principals before creating a new service principal. Results are paginated. API summary: List servicePrincipals.
  • search_transitive_member_ofsSearch transitive member ofs by search, filter, count, orderby, select or expand. Use this to find existing transitive member ofs before creating a new transitive member of. Results are paginated. API summary: Get transitiveMemberOf from me.
  • search_user_app_role_assignmentsSearch app role assignments for a user by search, filter, count, orderby, select or expand. Use this to find existing app role assignments before creating a new app role assignment. Results are paginated. API summary: List appRoleAssignments (for agentUser).
  • search_user_owned_devicesSearch owned devices for a user by search, filter, count, orderby, select or expand. Use this to find existing owned devices before creating a new owned device. Results are paginated. API summary: Get ownedDevices from users.
  • search_user_owned_objectsSearch owned objects for a user by search, filter, count, orderby, select or expand. Use this to find existing owned objects before creating a new owned object. Results are paginated. API summary: List ownedObjects (for agentUser).
  • search_user_transitive_member_ofsSearch transitive member ofs for a user by search, filter, count, orderby, select or expand. Use this to find existing transitive member ofs before creating a new transitive member of. Results are paginated. API summary: List transitiveMemberOf.
  • search_usersSearch users by search, filter, count, orderby, select or expand. Use this to find existing users before creating a new user. Results are paginated. API summary: Get the items of type microsoft.graph.user in the microsoft.graph.directoryObject collection.
  • set_user_managerVisible to othersSet a user's manager: pass the user's `user_id` and the manager as `odata_id` set to https://graph.microsoft.com/v1.0/directoryObjects/{id}.
  • sign_out_user_everywhereChanges dataSign a user out of all sessions by `user_id`, forcing them to sign in again on every device.
  • submit_domainVisible to othersVerify a domain (domain id). Has effects visible outside this system. API summary: Invoke action verify.
  • update_applicationChanges dataUpdate an existing application identified by application id. Only the fields you pass are changed. API summary: Upsert application.
  • update_companyChanges dataUpdate an existing company identified by company id. Only the fields you pass are changed. API summary: Update organization.
  • update_deviceChanges dataUpdate an existing device identified by device id. Only the fields you pass are changed. API summary: Update device.
  • update_directory_auditChanges dataUpdate an existing directory audit identified by directory audit id. Only the fields you pass are changed. API summary: Update the navigation property directoryAudits in auditLogs.
  • update_directory_roleDeletesUpdate an existing directory role identified by directory role id. Only the fields you pass are changed. Destructive action; may require approval. API summary: Update entity in directoryRoles.
  • update_domainChanges dataUpdate an existing domain identified by domain id. Only the fields you pass are changed. API summary: Update domain.
  • update_groupChanges dataUpdate a group by `group_id` with fields in `body`, such as `displayName`, `description` or `visibility`.
  • update_productChanges dataUpdate an existing product identified by product id. Only the fields you pass are changed. API summary: Update entity in subscribedSkus.
  • update_service_principalChanges dataUpdate an existing service principal identified by service principal id. Only the fields you pass are changed. API summary: Upsert servicePrincipal.
  • update_sign_inChanges dataUpdate an existing sign in identified by sign in id. Only the fields you pass are changed. API summary: Update the navigation property signIns in auditLogs.
  • update_userChanges dataUpdate a user's profile by `user_id` with fields in `body`: job title, department, office, phone or city, or `accountEnabled` false to block sign-in.
  • update_usersVisible to othersUpdate an existing user. Only the fields you pass are changed. Has effects visible outside this system. API summary: Update user.

Set up in three steps

  1. 1

    Pick the app

    Create a free HeyMyApps account and choose Microsoft Entra ID from the app list.

  2. 2

    Paste your key

    Paste the Application (client) ID and Client secret value from your own app registration, then sign in once with an admin account. In the Microsoft Entra admin center go to App registrations > New registration, choose Accounts in this organizational directory only and add the Web redirect URI https://heymyapps.com/oauth/callback. Create a client secret under Certificates & secrets, add the delegated Microsoft Graph permissions listed in HeyMyApps under API permissions, and click Grant admin consent.

  3. 3

    Add the link to your AI

    You get a personal MCP link. Add it to Claude, ChatGPT or Cursor:

    1. Click your name, then Settings › Connectors › Add custom connector.
    2. Paste your link as the Remote MCP server URL.
    3. Switch it on from the + menu in a chat.

Questions

What can the AI do in Microsoft Entra ID?

It can read users, managers, direct reports, groups, members, owners, licences, admin roles, devices, guest invitations, sign-ins and audit logs. It can update users and groups, create groups, set a manager, add and remove group members, assign or remove licences, invite guests and sign a user out of all sessions.

Does the AI see my Microsoft Entra ID credentials?

No. Your Microsoft Entra ID credentials are encrypted at rest and never shown to the AI. After you save them, they are not shown again, not even to you. The AI only sees the results of the tools it calls.

Can I control what the AI is allowed to do?

Yes. You choose which tools are switched on, so you can start read-only. Blocking sign-in, signing a user out everywhere and changing group membership affect people's access, and assigning licences can change billing seats. These can require your approval before they run. Every tool call is logged.

Does it work with ChatGPT?

Yes. In ChatGPT go to Settings › Apps & Connectors › Advanced and turn on Developer mode, then add your HeyMyApps link. Developer mode needs a paid ChatGPT plan: Plus, Pro, Business or Enterprise. The same link also works in Claude (Settings › Connectors › Add custom connector), Cursor and other MCP clients.

What does it cost?

Microsoft Entra ID connects with OAuth, and OAuth connections need the HeyMyApps Pro plan or above. HeyMyApps also has a free plan with no credit card, but it does not include this connection. Paid plans bill per completed task. You also need your own Microsoft Entra ID tenant and an admin account.

Can the AI read sign-in logs?

Yes. The sign-in tool lists recent sign-in events, for example for one user or a date range. It needs an Entra ID P1 or P2 licence in your tenant. The audit log, which shows who changed what in the directory, has its own tool.

Related integrations

Let your AI work in Microsoft Entra ID today.

Start free. Your key stays encrypted, and you decide what the AI may do.

Connect Microsoft Entra ID free

HeyMyApps is not affiliated with Microsoft Entra ID. Product names are trademarks of their owners.