Skip to main content

Microsoft Entra Admin

Microsoft Entra Admin is a dedicated Willow connector for directory administration through the Microsoft Graph API. It provides tools to list users, block sign-in, revoke sessions, and assign or reclaim Microsoft 365 license seats — the core operations needed for user lifecycle and offboarding automations.

This connector is separate from productivity connectors (SharePoint, Teams, Outlook) so regular users are never asked to consent to highly privileged admin scopes.

Authentication Types​

Microsoft Entra Admin supports 1 authentication method:

  • OAuth - Create your own Microsoft Entra OAuth app. Every user connects with their Microsoft work or school account.
    • Pros: Full control, per-user tracking, least-privilege delegated permissions, production-ready
    • Cons: Requires Entra app registration and admin consent (~5 min setup)

Setting up OAuth​

Step 1: Register an application in Microsoft Entra admin center​

  1. Go to https://entra.microsoft.com/ or https://portal.azure.com/

  2. Navigate to Microsoft Entra ID

  3. In the left sidebar, select App registrations

  4. Click New registration

  5. Configure your application:

    • Name: Enter a descriptive name (e.g., "Willow Entra Admin Integration")
    • Supported account types: Select Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant)
    • Redirect URI: Select Web and enter:
      • For SaaS deployments: https://{org}.mcp-s.com/{org}/api/auth/callback
      • For On-Premise deployments: {connectUrl}/{org}/api/auth/callback

  6. Click Register

Step 2: Configure API permissions​

  1. In your app registration, go to API permissions

  2. Click Add a permission → Microsoft Graph → Delegated permissions

  3. Add the following permissions:

    PermissionPurpose
    User.ReadSign in and read the connecting admin's profile
    User.Read.AllList and read user directory objects
    User.EnableDisableAccount.AllBlock or restore user sign-in (accountEnabled)
    User.RevokeSessions.AllInvalidate refresh tokens and browser sessions
    LicenseAssignment.ReadWrite.AllList SKUs and assign/revoke licenses

  4. Click Grant admin consent for [your tenant] — an Entra administrator must approve these scopes.

note

The account that connects must hold an Entra admin role with the required directory permissions, such as User Administrator, License Administrator, or Global Administrator.

Step 3: Create a client secret​

  1. Go to Certificates & secrets

  2. Click New client secret, add a description, and set an expiration

  3. Copy the secret Value immediately — it is only shown once

Step 4: Connect in Willow​

  1. From the app's Overview page, copy the Application (client) ID

  2. In Willow, paste the Client ID and Client Secret

  3. Click Connect and sign in with an Entra admin account

  4. Approve the requested permissions

For a typical user offboarding automation, run these tools in order:

  1. List Users or Get User — confirm the target account and current licenses
  2. Revoke License — reclaim M365 seats
  3. Disable User — set accountEnabled to false
  4. Revoke Sign-In Sessions — force immediate sign-out

Troubleshooting​

Cause: The app permissions were added but admin consent was not granted.

Solution: In Entra → App registrations → your app → API permissions, click Grant admin consent for [tenant].

Insufficient privileges​

Cause: The connecting user lacks an Entra admin role for the requested operation (e.g., license assignment requires License Administrator or User Administrator).

Solution: Connect with an account that has the appropriate role, or assign the role in Microsoft Entra ID → Roles and administrators.

User not found by email​

Cause: The user_id parameter accepts either an object ID (GUID) or userPrincipalName — some tenants use a UPN that differs from the user's primary SMTP address.

Solution: Use List Users with a $filter on mail or userPrincipalName to find the correct identifier.

On this page