{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":21298,"path":"integrate-applications/integration-hub/microsoft-azure-ad-spoke.md","title":"Microsoft Entra ID Spoke \\(formerly Microsoft Azure Active Directory spoke\\)","bundle":null,"doc_type":null,"release":"australia","body":"\n# Microsoft Entra ID Spoke \\(formerly Microsoft Azure Active Directory spoke\\)\n\nManage users, applications, groups, devices, tenants, service principals, and passwords. Apply licenses and provision users in Office 365.\n\n## Integration Hub subscription\n\nThis spoke requires an Integration Hub subscription. For more information, see [Legal schedules - IntegrationHub overview](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/legal/snc-addendum-integrationhub.pdf).\n\n## Spoke version\n\nMicrosoft Entra ID spoke \\(formerly known as Microsoft Azure Active Directory spoke\\) v4.8.2 is the latest version. For version history of the spoke, see [Microsoft Entra ID Spoke release notes](https://www.servicenow.com/docs/r/store-release-notes/store-integrationhub-rn-ms-azure-ad-spoke.html).\n\n## Spoke dependencies\n\nIf you’re having trouble installing the app, ensure that these dependent plugins are installed:\n\n- Complex Object \\(com.glide.cobject\\)\n- ServiceNow IntegrationHub Runtime \\(com.glide.hub.integration.runtime\\)\n- IHUB Spoke Util Pack \\(com.snc.ihub\\_spoke\\_util\\_pack\\)\n- ServiceNow IntegrationHub Action Step - PowerShell \\(com.glide.hub.action\\_step.powershell\\)\n- ServiceNow IntegrationHub Action Template - Data Stream \\(com.glide.hub.action\\_type.datastream\\)\n- ServiceNow IntegrationHub Action Step - REST \\(com.glide.hub.action\\_step.rest\\)\n- Remote Directory Sync\n\n## Spoke flows\n\nThe Microsoft Entra ID spoke provides sample flows in the draft state to demonstrate automating Microsoft Entra tasks. To customize a sample flow, copy it to a new application scope. Available sample flows include:\n\n|Flow|Description|\n|----|-----------|\n|User Offboarding|Disables an Entra ID user account and removes the user from the Entra ID groups when a ServiceNow user record is deactivated.|\n|User Onboarding|Creates and enables an Entra ID user account when a ServiceNow user record is activated.|\n\n## Spoke subflows\n\nThe Microsoft Entra ID spoke provides sample subflows in the draft state to demonstrate automating Entra tasks. To customize a sample subflow, copy it to a new application scope. Available sample subflows include:\n\n|Subflow|Description|\n|-------|-----------|\n|Add User to Group|Looks up the groups that a ServiceNow User record belongs to, and adds the associated Entra ID user account to the same Entra ID groups.|\n\n## Available sample conversational subflows\n\nInstall Now Assist for Conversational Spokes and start using the conversational ability of Integration Hub spokes. For more information, see [ServiceNow Otto for Conversational Spokes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/integrate-applications/integration-hub/conv-spokes-na.md).\n\n|Conversational subflow|Description|\n|----------------------|-----------|\n|Look up Groups - Sample|Retrieves information about the specified groups in the Entra ID.|\n|Look up Group Members - Sample|Retrieves information about the specified group members in the Entra ID.|\n|Look up Users - Sample|Retrieves information about users in the Entra ID.|\n|Look up Direct Reports - Sample|Retrieves information about the direct reports in the Entra ID.|\n|Add User to Group using Email Address - Sample|Adds the specified Entra ID user to the specified Entra ID group using the user's email address.|\n|Add User to a group - Sample|Adds the specified Entra ID user to the specified Entra ID group.|\n\n## Spoke actions\n\nThe Microsoft Entra ID spoke provides actions to automate Entra tasks when events occur in ServiceNow. Available actions include:\n\n**Note:**\n\n- One of the mentioned permissions is required to call the API.\n- Ensure that you are aware of these considerations:\n - Select the Delegated permission if you intend to use the **Authorization Code** grant type while registering Entra ID as an OAuth provider.\n - Select the Application permission if you intend to use the **Client Credentials** grant type while registering Entra ID as an OAuth provider.\n\n\n
\n\nCategory\n\n\n\nAction\n\n\n\nDescription\n\n\n\nPermissions Required \\(from least to most privileged\\)\n\n
\n\nAudit Logs\n\n\n\nLook up Sign Ins Stream\n\n\n\nRetrieve the list of sign ins.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nAuditLog.Read.All, Directory.Read.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported\n\n
\n\nApplication\n\n\n\nAuditLog.Read.All , Directory.Read.All\n\n
\n\nGroup Management\n\n\n\nAdd Owner to Group\n\n\n\nAdd an owner to an existing group in Microsoft Entra ID.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nGroup.ReadWrite.All, Directory.ReadWrite.All, Directory.AccessAsUser.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nGroup.ReadWrite.All, Directory.ReadWrite.All\n\n
\n\nAdd User to Group\n\n\n\nAdd an existing user to a group in Microsoft Entra ID.**Note:** Adding a user to a mail-enabled security group is not supported by the Microsoft Graph Security API. For more information, see [https://learn.microsoft.com/en-us/graph/api/resources/groups-overview?view=graph-rest-1.0&tabs=http](https://learn.microsoft.com/en-us/graph/api/resources/groups-overview?view=graph-rest-1.0&tabs=http).\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nGroupMember.ReadWrite.All, Group.ReadWrite.All, Directory.ReadWrite.All, Directory.AccessAsUser.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nGroupMember.ReadWrite.All, Group.ReadWrite.All and Directory.ReadWrite.All\n\n
\n\nCreate Office 365 Group\n\n\n\nCreates an Office 365 group that can be shared with the other members in the group.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nGroup.ReadWrite.All, Directory.ReadWrite.All, Directory.AccessAsUser.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nGroup.Create, Group.ReadWrite.All, Directory.ReadWrite.All\n\n
\n\nLook up Group Membership Stream by Directory\n\n\n\nRetrieve the list of group membership.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nGroupMember.Read.All, Directory.Read.All, Group.Read.All, Group.ReadWrite.All, GroupMember.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nGroupMember.Read.All, Directory.Read.All, Group.Read.All, Group.ReadWrite.All, GroupMember.ReadWrite.All\n\n
\n\nCreate Security Group\n\n\n\nCreates a security group when you want to grant access permissions to a group of users.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nGroup.ReadWrite.All, Directory.ReadWrite.All, Directory.AccessAsUser.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nGroup.Create, Group.ReadWrite.All, Directory.ReadWrite.All\n\n
\n\nLook up Group\n\n\n\nReturns the Group information found based on the search criteria.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nGroupMember.Read.All, Group.Read.All, Directory.Read.All, Group.ReadWrite.All, Directory.ReadWrite.All, Directory.AccessAsUser.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nGroupMember.Read.All, Group.Read.All, Directory.Read.All, Group.ReadWrite.All, Directory.ReadWrite.All\n\n
\n\nLook up Group Members Stream\n\n\n\nRetrieves the list of members of the specified group.\n\n\n\nApplication\n\n\n\nGroupMember.Read.All, Group.Read.All, GroupMember.ReadWrite.All, Group.ReadWrite.All, Directory.Read.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nDelegated \\(work or school account\\)\n\n\n\nGroupMember.Read.All, Group.Read.All, GroupMember.ReadWrite.All, Group.ReadWrite.All, Directory.Read.All\n\n
\n\nLook up Group Membership Stream\n\n\n\nRetrieves the list of groups for the specified user as a complex object.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nUser.Read, GroupMember.Read.All, Directory.Read.All, Directory.ReadWrite.All, Directory.AccessAsUser.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nDirectory.Read.All, Directory.ReadWrite.All\n\n
\n\nLook up Group Transitive Membership Stream\n\n\n\nRetrieves list of groups for the specified user as a complex object.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nNot supported.\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nGroups.Read.All, User.Read.All, Sites.FullControl.All, Sites.Selected\n\n
\n\nDelete Group\n\n\n\nDeletes the specified group from Entra ID.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nGroup.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nGroup.ReadWrite.All\n\n
\n\nAdd Owners to Group\n\n\n\nAdds the specified users as owners to the specified group in the Entra ID.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nGroup.ReadWrite.All, Directory.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nGroup.ReadWrite.All, Directory.ReadWrite.All\n\n
\n\nRemove Owner from Group\n\n\n\nRemoves the owner from a group in Microsoft Entra ID.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nGroup.ReadWrite.All, Directory.ReadWrite.All, Directory.AccessAsUser.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nGroup.ReadWrite.All, Directory.ReadWrite.All\n\n
\n\nRemove User from Group\n\n\n\nRemoves an existing user from a group in Microsoft Entra ID.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nGroupMember.ReadWrite.All, Group.ReadWrite.All, Directory.ReadWrite.All, Directory.AccessAsUser.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nGroupMember.ReadWrite.All, Group.ReadWrite.All, Directory.ReadWrite.All\n\n
\n\nLook up Groups Stream by Directory\n\n\n\nRetrieves the list of groups in the directory integration.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nGroupMember.Read.All, Group.Read.All, Directory.Read.All, Group.ReadWrite.All, Directory.ReadWrite.All, Directory.AccessAsUser.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nGroupMember.Read.All, Group.Read.All, Directory.Read.All, Group.ReadWrite.All, Directory.ReadWrite.All\n\n
\n\nLook up Groups Stream\n\n\n\nLists all the groups in an organization.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nGroupMember.Read.All, Group.Read.All, Directory.Read.All, Group.ReadWrite.All, Directory.ReadWrite.All, Directory.AccessAsUser.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nGroupMember.Read.All, Group.Read.All, Directory.Read.All, Group.ReadWrite.All, Directory.ReadWrite.All\n\n
\n\nAdd Users to Group\n\n\n\nAdd existing users to a group in Microsoft Entra ID.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nGroupMember.ReadWrite.All, Group.ReadWrite.All, Directory.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nGroupMember.ReadWrite.All, Group.ReadWrite.All and Directory.ReadWrite.All\n\n
\n\nUpdate Office 365 Group\n\n\n\nUpdates the specified office 365 group.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nGroup.ReadWrite.All, Directory.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nGroup.ReadWrite.All, Directory.ReadWrite.All\n\n
\n\nLicense Management\n\n\n\nLook up Subscribed SKU\n\n\n\nRetrieves the details of the specified subscribed SKU.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nOrganization.Read.All, Directory.Read.All, Directory.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nOrganization.Read.All, Directory.Read.All, Directory.ReadWrite.All, Organization.ReadWrite.All\n\n
\n\nLook up Subscribed SKUs\n\n\n\nRetrieves the list of commercial subscriptions that an organization has acquired.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nOrganization.Read.All, Directory.Read.All, Directory.ReadWrite.All, Organization.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nOrganization.Read.All, Directory.Read.All, Directory.ReadWrite.All, Organization.ReadWrite.All\n\n
\n\nAssign User License\n\n\n\nOnboards an existing user in the Microsoft Entra ID to Office 365 and grant access to services.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nUser.ReadWrite.All, Directory.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nUser.ReadWrite.All, Directory.ReadWrite.All\n\n
\n\nRemove User License\n\n\n\nRemoves a license from a user in Microsoft Entra ID.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nUser.ReadWrite.All, Directory.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nUser.ReadWrite.All, Directory.ReadWrite.All\n\n
\n\nApplication Management\n\n\n\nLook up App Roles Assignments Stream\n\n\n\nRetrieves the list of the app roles that have been assigned to a user.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nUser.ReadBasic.All, Directory.Read.All, AppRoleAssignment.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported\n\n
\n\nApplication\n\n\n\nDirectory.Read.All, AppRoleAssignment.ReadWrite.All\n\n
\n\nCreate Application Assignment\n\n\n\nCreates an assignment for a specified application in Microsoft Entra ID.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nDeviceManagementConfiguration.ReadWrite.All, DeviceManagementApps.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nDeviceManagementConfiguration.ReadWrite.All, DeviceManagementApps.ReadWrite.All\n\n
\n\nDelete Application Assignment\n\n\n\nDeletes the specified application assignment in Microsoft Entra ID.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nDeviceManagementConfiguration.ReadWrite.All, DeviceManagementApps.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nDeviceManagementConfiguration.ReadWrite.All, DeviceManagementApps.ReadWrite.All\n\n
\n\nLook up Application Assignments Stream\n\n\n\nLists all application assignments for the specified application in Microsoft Entra ID.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nDeviceManagementConfiguration.Read.All, DeviceManagementConfiguration.ReadWrite.All, DeviceManagementApps.Read.All, DeviceManagementApps.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nDeviceManagementConfiguration.Read.All, DeviceManagementConfiguration.ReadWrite.All, DeviceManagementApps.Read.All, DeviceManagementApps.ReadWrite.All\n\n
\n\nRevoke User Application Access\n\n\n\nRemoves an app role assignment that has been granted to a user.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nAppRoleAssignment.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nAppRoleAssignment.ReadWrite.All\n\n
\n\nLook up Applications Stream\n\n\n\nRetrieves the list of applications.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nApplication.Read.All, Application.ReadWrite.All, Directory.Read.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nApplication.Read.All and User.Read, Application.ReadWrite.All and User.Read\n\n
\n\nApplication\n\n\n\nApplication.Read.All, Application.ReadWrite.OwnedBy, Application.ReadWrite.All, Directory.Read.All\n\n
\n\nDevice Management\n\n\n\nAdd Device to Group\n\n\n\nAdds an existing device to a group in the Entra ID.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nGroupMember.ReadWrite.All, Group.ReadWrite.All, Directory.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported\n\n
\n\nApplication\n\n\n\nGroupMember.ReadWrite.All, Group.ReadWrite.All and Directory.ReadWrite.All\n\n
\n\nIs Device in Group\n\n\n\nChecks if an existing device is a member of a group in Entra ID.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nDevice.Read.All, Directory.Read.All, Directory.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nDevice.Read.All, Device.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All\n\n
\n\nAdd Devices to Group\n\n\n\nAdds the specified devices to the specified group in Entra ID.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nGroup.ReadWrite.All, Directory.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nGroup.ReadWrite.All, Directory.ReadWrite.All\n\n
\n\nLook up Devices Stream\n\n\n\nLists all the devices in an organization or devices that satisfy the specified filter query, if any.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nDevice.Read.All, Directory.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nDevice.Read.All, Device.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All\n\n
\n\nRemove Device from Group\n\n\n\nRemove an existing device from a group in the Entra ID.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nGroupMember.ReadWrite.All, Group.ReadWrite.All, Directory.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nGroupMember.ReadWrite.All, Group.ReadWrite.All, Directory.ReadWrite.All\n\n
\n\nOrganization Management\n\n\n\nLook up Tenant\n\n\n\nRetrieves details of the currently authenticated tenant.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nDeviceManagementServiceConfig.Read.All, DeviceManagementServiceConfig.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nDeviceManagementServiceConfig.Read.All, DeviceManagementServiceConfig.ReadWrite.All\n\n
\n\nUser Authentication\n\n\n\nRevoke User SignIn Sessions\n\n\n\nRevokes the user signin sessions so that administrators can automate invalidating all the sign in session of a specified user.\n\n\n\n \n\n\n\n \n\n
\n\nService Principal Management\n\n\n\nLook up App Role Assigned to Service Principal Stream\n\n\n\nRetrieves the list of service principal assignments.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nApplication.Read.All, Directory.Read.All, Application.ReadWrite.All, Directory.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nApplication.Read.All, Directory.Read.All, Application.ReadWrite.All, Directory.ReadWrite.All\n\n
\n\nLook up Service Principals Stream\n\n\n\nRetrieves the list of service principals.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nApplication.Read.All, Application.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nApplication.Read.All, Application.ReadWrite.All, Directory.Read.All\n\n
\n\nPassword Management\n\n\n\nReset Password\n\n\n\nResets the password of the Entra ID user account.**Note:** This spoke action resets the password of users created in Entra ID only and does not reset the password of the federated users.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nUser-PasswordProfile.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nUser-PasswordProfile.ReadWrite.All\n\n
\n\nLook up Password Expiration\n\n\n\nRetrieves Password expiration details for the provided user from Microsoft Entra ID.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nUser.ReadBasic.All, User.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nUser.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All\n\n
\n\nChange Password\n\n\n\nChanges the password of a user in Microsoft Entra ID. Ensure that the password meets the Entra ID password requirements.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nUser-PasswordProfile.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nNot supported.\n\n
\n\nGenerate Random Password\n\n\n\nGenerates the random password as per the default Entra ID password policy.**Note:** You must install the KMF plugin before executing this action.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nNone.\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n
\n\nApplication\n\n
\n\nUser Management\n\n\n\nLook up User\n\n\n\nRetrieves a user account from Entra.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nUser.ReadBasic.All, User.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nUser.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All\n\n
\n\nLook up Users Stream by Directory\n\n\n\nRetrieves the list of users from a directory.\n\n\n\nApplication\n\n\n\nUser.ReadBasic.All, User.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nDelegated \\(work or school account\\)\n\n\n\nGroupMember.Read.All, Group.Read.All, GroupMember.ReadWrite.All, Group.ReadWrite.All, Directory.Read.All\n\n
\n\nRevoke User SignIn Sessions\n\n\n\nInvalidates all signed in sessions of a user.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nUser.ReadWrite.All, Directory.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nNot supported.\n\n
\n\nCreate User\n\n\n\nCreates a user with the given details.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nUser.ReadWrite.All, Directory.ReadWrite.All, Directory.AccessAsUser.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nUser.ReadWrite.All, Directory.ReadWrite.All\n\n
\n\nDelete User\n\n\n\nDeletes a user from Microsoft Entra ID.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nDirectory.AccessAsUser.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nUser.ReadWrite.All\n\n
\n\nDisable User\n\n\n\nDisables a user in Microsoft Entra ID.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nUser.ReadWrite, User.ReadWrite.All, User.ManageIdentities.All, Directory.ReadWrite.All, Directory.AccessAsUser.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nUser.ReadWrite\n\n
\n\nApplication\n\n\n\nUser.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All\n\n
\n\nEnable User\n\n\n\nEnables a user account in the Microsoft Entra ID.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nUser.ReadWrite, User.ReadWrite.All, User.ManageIdentities.All, Directory.ReadWrite.All, Directory.AccessAsUser.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nUser.ReadWrite\n\n
\n\nApplication\n\n\n\nUser.ReadWrite.All, User.ManageIdentities.All, Directory.ReadWrite.All\n\n
\n\nFetch Latest Delta Token for Users\n\n\n\nReturns the latest delta token for the users.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nUser.ReadBasic.All, User.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nUser.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All\n\n
\n\nIs User Enabled\n\n\n\nChecks whether the specified user account is enabled in Microsoft Entra ID.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nUser.Read, User.ReadWrite, User.ReadBasic.All, User.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All, Directory.AccessAsUser.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nUser.Read, User.ReadWrite\n\n
\n\nApplication\n\n\n\nUser.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All\n\n
\n\nIs User in Group\n\n\n\nChecks whether the specified user account is a member of the specified group in Entra.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nUser.ReadBasic.All, User.Read.All, Directory.Read.All, User.ReadWrite.All, Directory.ReadWrite.All, Directory.AccessAsUser.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nUser.ReadBasic.All, User.Read.All, Directory.Read.All, User.ReadWrite.All, Directory.ReadWrite.All\n\n
\n\nLook up Users Stream\n\n\n\nLists all the users in an organization or users satisfying the specified search query, filter and next token if any.\n\n\n\nApplication\n\n\n\nUser.ReadBasic.All, User.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nDelegated \\(work or school account\\)\n\n\n\nGroupMember.Read.All, Group.Read.All, GroupMember.ReadWrite.All, Group.ReadWrite.All, Directory.Read.All\n\n
\n\nUpdate User\n\n\n\nUpdates user properties in Entra ID with the provided details.**Note:** Entra ID does not allow updating values to null. Null or empty values are discarded in Entra ID when null is passed as an input.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nUser.ReadWrite, User.ReadWrite.All, User.ManageIdentities.All, Directory.ReadWrite.All, Directory.AccessAsUser.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nUser.ReadWrite\n\n
\n\nApplication\n\n\n\nUser.ReadWrite.All, User.ManageIdentities.All, Directory.ReadWrite.All\n\n
\n\nDoes User owns Group\n\n\n\nChecks if an existing user is a owner of a group in Entra ID.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nGroupMember.Read.All, Group.Read.All, GroupMember.ReadWrite.All, Group.ReadWrite.All, Directory.Read.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nGroupMember.Read.All, Group.Read.All, GroupMember.ReadWrite.All, Group.ReadWrite.All, Directory.Read.All\n\n
\n\nLook up Incremental Changes for Users Stream\n\n\n\nRetrieves the list of users in Entra ID. By using Delta Token, enables you discover changes to users without having to fetch the entire set of users.\n\n\n\nDelegated \\(work or school account\\)\n\n\n\nUser.Read, User.ReadWrite, User.ReadBasic.All, User.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All\n\n
\n\nDelegated \\(personal Microsoft account\\)\n\n\n\nNot supported.\n\n
\n\nApplication\n\n\n\nUser.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All\n\n
## Available AI agents\n\nInstall Now Assist for Integration Hub and start using the available AI agents. For more information, see [ServiceNow Otto for Integration Hub](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/integrate-applications/integration-hub/now-assist-spokes.md).\n\nThis spoke provides standalone AI agents that mimic human-like intelligence to perform tasks in your ServiceNow instance.\n\n- In the ServiceNow agentic system, you can create an agentic workflow that comprises of a set of large language model \\(LLM\\) instructions along with one or more standalone AI agents to execute an objective. See [Create an agentic workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/intelligent-experiences/configure-use-case-ai-agents.md) for information about adding AI agents to create agentic workflows as per your requirement and provide the required trigger.\n\n You can also search for other available AI agents and add them to your agentic workflow. See [Find AI agents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/intelligent-experiences/find-ai-agents.md) for more information.\n\n- You can create a clone of the required spoke AI agent and customize it as per your requirement. See [Duplicate an AI agent](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/intelligent-experiences/clone-ai-agent.md) for more information about creating a clone.\n- See [AI Agent Studio \\(legacy\\)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/intelligent-experiences/na-ai-agents.md) for information about AI agents.\n\nAvailable AI agents include:\n\n|AI agent|Description|\n|--------|-----------|\n|Microsoft Entra ID user management AI agent|Automates user and group management tasks in Microsoft Entra ID. The AI agent creates, enables and disables users, manages security and office groups, and performs advanced queries such as, retrieving incremental changes or direct reports.|\n|Microsoft Entra ID group management AI agent|Automates user and group management tasks in Microsoft Entra ID. The AI agent retrieves group details, manages group memberships, creates security groups, and automates user provisioning into Office 365.|\n|Microsoft Entra ID license management AI agent|Automates the management of users, security groups, and office groups in Microsoft Entra ID. The AI agent retrieves details about the subscribed SKUs, assigns user licenses, and remove user licenses.|\n\nThere might be AI agents installed on your instance that are not used in agentic workflows. To learn how to see all agents that are available to you, see [Find AI agents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/intelligent-experiences/find-ai-agents.md).\n\n**Note:** Ensure that the user running an AI agent has the required roles and permissions to access data or perform operations on data in the table that is associated with the AI agent.\n\n## Microsoft Entra ID account requirements\n\nThe Microsoft Entra ID spoke requires creating a custom app on your Microsoft Entra account to generate OAuth 2.0 tokens. See: [Create an Microsoft Entra ID application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/integrate-applications/integration-hub/set-up-azure.md).\n\n## Connection and credential alias requirements\n\nIntegration Hub uses aliases to manage connection and credential information, and OAuth credentials. Using an alias eliminates the need to configure multiple credentials and connection information profiles when using multiple environments. If the connection or credential information changes, you don't need to update any actions that use the connection.\n\nThis spoke uses the AzureAD alias record to authorize actions on Microsoft Entra ID.\n\n|Connection alias|Description|Connection URL|\n|----------------|-----------|--------------|\n|AzureAD|Connection to Microsoft Entra ID.|https://graph.microsoft.com|\n\nFor information about setting up the spoke, see [Set up Microsoft Entra ID spoke](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/integrate-applications/integration-hub/set-up-azure.md).\n\n"}}