Microsoft Active Directory
Microsoft Active Directory and Microsoft Entra ID provide identity and access management for organizations of all sizes. Microsoft Graph API is the unified REST API gateway for accessing and managing Microsoft Entra ID (formerly Azure Active Directory), including users, groups, applications, devices, conditional access policies, identity governance, and directory administration. Legacy on-premises Active Directory is managed through LDAP, Kerberos, and PowerShell protocols; cloud identity is managed through Microsoft Graph.
Reference-quality API operations across every facet — a rich contract, published governance, transparent operations, and machine-readable commercial terms.
API Evangelist profiles Microsoft Active Directory the way a machine reads it — 76 machine-readable artifacts across 14 APIs, pulled from the provider's own public surface and indexed so a developer, an analyst, or an AI agent can evaluate it against every other provider on the network.
Every provider in the network is reduced to the same set of machine-readable artifacts — OpenAPI contracts, event specifications, GraphQL schemas, runnable collections, pricing and rate-limit signals, security posture, OAuth scopes, and the agent surfaces (MCP servers and skills) that let software drive the API on its own. We profile them because the interface is the part of a company you can actually inspect: it is a truer signal of what a provider does than any marketing page. From those artifacts we compute the Kin Score — Microsoft Active Directory scores 76.3/100 (exemplar), with a separate agent-readiness read of 48/100 (agent ready). The full breakdown is below, followed by every artifact we hold — each card links through to its machine-readable definition on apis.io.
Kin Score
This is the API Evangelist rating — a single, repeatable read computed from the artifacts on this page. Green fill is points earned; the red track is points possible, so every bar shows earned-versus-possible at a glance.
Kin Score
How this is scored →scored 2026-07-27 · rubric v0.5
How we profile Microsoft Active Directory
Each block below is one kind of artifact we hold for Microsoft Active Directory. For each we say what it is and why it earns a place in the profile, then list every one we've indexed — capped at two rows, scroll within the panel for the rest.
APIs 14
Each API is captured as its own OpenAPI definition — every operation, parameter, and response. This is the single most useful machine-readable description of what an API does, and it's what lets us score, lint, mock, and generate against it without asking the provider for anything.
Individual APIs this provider publishes, each with its own machine-readable definition.
Microsoft Graph Devices API
Manage devices registered or joined to Microsoft Entra ID, including Entra joined, Entra registered, and hybrid Azure AD joined devices. Retrieve BitLocker recovery keys and Loc...
Microsoft Graph Directory Roles and Administrative Units API
Manage Microsoft Entra built-in and custom directory roles, role assignments, and role-scoped administrative units. Assign administrator roles to users, groups, or service princ...
Microsoft Graph Conditional Access API
Create and manage Microsoft Entra Conditional Access policies that enforce access controls based on user, location, device, and risk signals. Configure named locations, authenti...
Microsoft Graph Identity Governance API
Manage Microsoft Entra ID Governance features including access reviews, entitlement management (access packages, catalogs, and policies), Privileged Identity Management (PIM) fo...
Microsoft Graph Identity Protection API
Detect, investigate, and remediate identity-based risks using Microsoft Entra ID Protection. Access risk detections, risky users, risky service principals, and risk events, and ...
Microsoft Graph Authentication Methods API
Manage authentication methods registered for users in Microsoft Entra ID, including FIDO2 security keys, Microsoft Authenticator, phone (SMS/voice call), email OTP, Windows Hell...
Microsoft Graph Identity and Access Reports API
Access audit logs, sign-in logs, provisioning logs, and identity-related reports for monitoring, compliance, and troubleshooting. Stream logs to Azure Monitor and Log Analytics ...
Microsoft Active Directory App Role Assignments API
The App Role Assignments API from Microsoft Active Directory — 1 operation(s) for app role assignments.
Microsoft Active Directory Applications API
The Applications API from Microsoft Active Directory — 2 operation(s) for applications.
Microsoft Active Directory Groups API
The Groups API from Microsoft Active Directory — 6 operation(s) for groups.
Microsoft Active Directory Members API
The Members API from Microsoft Active Directory — 2 operation(s) for members.
Microsoft Active Directory Owners API
The Owners API from Microsoft Active Directory — 1 operation(s) for owners.
Microsoft Active Directory Service Principals API
The Service Principals API from Microsoft Active Directory — 3 operation(s) for service principals.
Microsoft Active Directory Users API
The Users API from Microsoft Active Directory — 5 operation(s) for users.
Scroll within the panel for all 14 ·
Postman Collections 3
A runnable collection turns the contract into something a developer can execute in seconds. We profile them because the fastest way to trust an API is to make a real call against it.
Ready-to-run Postman collections for exercising this provider's APIs.
Arazzo Workflows 13
Real integrations are rarely a single call. Arazzo describes the multi-step sequences — auth, then create, then confirm — so both a human and an agent can follow the choreography, not just the endpoints.
Multi-step API workflows described with the Arazzo specification.
Active Directory Audit User Group Memberships
Resolve a user by UPN, read their full profile, then list their group memberships and manager.
ARAZZOActive Directory Create Group And Add Two Members
Create a security group, then add two existing users to it by their object IDs.
ARAZZOActive Directory Create Microsoft 365 Group With Owner
Create a user, create a Microsoft 365 group owned by that user, and add the user as a member.
ARAZZOActive Directory Decommission Application
Resolve an application by name, read its details, and soft-delete the registration.
ARAZZOActive Directory Find User And Update Profile
Look up a user by principal name, then patch their job title and department.
ARAZZOActive Directory Offboard User From Group
Resolve a user by UPN, remove them from a named group, then disable the account.
ARAZZOActive Directory Onboard User To Existing Group
Find an existing group by name, create a user, and add the user to that group.
ARAZZOActive Directory Provision Application With Service Principal
Register an application, then locate and read its service principal and app role assignments.
ARAZZOActive Directory Provision User Into New Group
Create a user, create a security group, and add the user as a member of that group.
ARAZZOActive Directory Rename Group And List Members
Resolve a group by name, update its display name and description, then list its members and owners.
ARAZZOActive Directory Self-Service Profile Review
Read the signed-in user's profile, then list their group memberships and look up their manager.
ARAZZOActive Directory Transfer User Between Groups
Resolve a user and two groups by name, remove the user from one group and add them to another.
ARAZZOActive Directory Update Application Redirect URIs
Resolve an application by name, read it, then patch its web redirect URIs and description.
ARAZZOScroll within the panel for all 13 ·
Pricing Plans 1
Pricing is part of the interface. Machine-readable plans tell you what a tier costs and includes before you commit — one of the six things the Kin Score reads for commercial clarity.
Published pricing tiers and plan structures.
Rate Limits 1
Rate limits are the difference between a demo that works and a production integration that doesn't fall over. Publishing them is an operational-transparency signal — and a hard requirement for any agent that plans its own throughput.
Documented rate limits and quota policies.
Active Directory Rate Limits
RATE LIMITSFinOps 1
Cost, billing, and metering signals let a buyer model the financial operations of an API before it's live. We profile them for the same reason we profile pricing: the money is part of the contract.
Cost, billing, and metering signals for API financial operations.
Active Directory Finops
FINOPSFeatures 10
The notable capabilities this provider advertises, captured as structured features so they can be searched and compared instead of read one landing page at a time.
Notable capabilities this provider offers.
Unified Identity API
Single REST endpoint (graph.microsoft.com) for all Microsoft Entra identity and directory operations.
User Lifecycle Management
Full CRUD operations for user accounts including bulk operations, license assignment, and guest management.
Group Management
Create and manage security groups, Microsoft 365 groups, and dynamic membership groups.
Application Registration
Programmatic app registration, permission configuration, and service principal management.
Conditional Access Automation
Create, update, and evaluate Conditional Access policies via API for Zero Trust enforcement.
Privileged Identity Management
Just-in-time role activation, time-bound access, and PIM policy management via API.
Identity Protection
Access risk signals, risky users, and risk detections for automated threat response.
Authentication Method Management
Manage MFA and passwordless authentication methods registered for users.
Audit and Sign-in Logs
Programmatic access to audit logs, sign-in logs, and provisioning logs for SIEM integration.
Identity Governance
Access reviews, entitlement management, and lifecycle workflows for automated IAM.
Scroll within the panel for all 10 ·
Semantic Vocabularies 1
JSON-LD contexts give the data shared meaning across APIs. We profile them because semantics are what let a machine reconcile 'customer' here with 'customer' somewhere else.
JSON-LD contexts and semantic vocabularies used across these APIs.
Active Directory Context
JSON-LDSpectral Rules 2
Governance rulesets we run against this provider's specs — the automated checks behind parts of the score. Profiling them makes the quality bar explicit and re-runnable, not a matter of opinion.
Microsoft Active Directory API Rules
SPECTRALMicrosoft Active Directory API Rules
SPECTRALJSON Schema 5
Standalone JSON Schema definitions describe the data models behind the API. We profile them so the shapes are validatable on their own — useful long after a single request is forgotten.
Standalone JSON Schema definitions for this provider's data models.
Application
JSON SCHEMAServicePrincipal
JSON SCHEMAGroup
JSON SCHEMAPasswordProfile
JSON SCHEMAUser
JSON SCHEMAJSON Structure 3
JSON Structure captures the data shapes in a form built for tooling — a complement to JSON Schema that keeps the model machine-legible.
JSON Structure definitions describing this provider's data shapes.
Applications Application Structure
JSON STRUCTUREGroups Group Structure
JSON STRUCTUREUsers User Structure
JSON STRUCTUREExamples 3
Real request and response payloads are what turn a spec from abstract into obvious — and they're one of the twelve things an agent needs to call an API correctly on the first try.
Example request and response payloads for these APIs.
Security Posture 3
Authentication, domain security, vulnerability disclosure, and trust-center signals — the evidence that a provider takes security seriously enough to document it. We profile it because you can't govern what you can't see.
Authentication, domain security, vulnerability disclosure, and trust-center signals.
Scopes 1
OAuth scopes are the vocabulary of least-privilege access. Profiling them shows exactly what an integration — or an agent acting on a user's behalf — is allowed to do.
OAuth scopes governing access to this provider's APIs.
Agentic Access 1
An x-agentic-access contract marks which operations are safe for an agent to run on its own and which need a human in the loop. It is the difference between an API an agent can use and one it can use safely.
Recommended x-agentic-access execution contracts for AI agents.
Use Cases 7
What developers actually build with this provider — captured so the catalogue answers 'what is this for', not just 'what does this expose'.
What developers build with this provider.
User Provisioning Automation
Automate user account creation, attribute updates, and deprovisioning for HR-driven identity lifecycle.
Zero Trust Policy Enforcement
Programmatically deploy and manage Conditional Access policies across the organization.
SIEM Integration
Stream audit logs and sign-in events to security information and event management systems.
Application Access Management
Automate app registration, permission grants, and app role assignments for developer self-service.
Identity Risk Remediation
Detect and respond to risky sign-ins and compromised accounts via Identity Protection APIs.
Compliance Reporting
Generate access reviews, entitlement reports, and audit logs for regulatory compliance.
Privileged Access Governance
Enforce just-in-time privileged access and audit role assignments via PIM APIs.
Scroll within the panel for all 7 ·
Integrations 7
Pre-built integrations with other platforms tell you where this provider already fits in a stack.
Pre-built integrations with other platforms and tools.
Azure Active Directory
Microsoft Entra ID (formerly Azure AD) is the cloud identity backbone accessed via Microsoft Graph.
Microsoft 365
Microsoft Graph provides unified access to Microsoft 365 user data alongside identity operations.
Azure Monitor
Stream Microsoft Entra sign-in and audit logs to Azure Monitor Log Analytics for analysis.
Microsoft Sentinel
Feed identity risk signals and audit logs into Microsoft Sentinel SIEM for threat hunting.
Intune
Microsoft Graph Intune APIs integrate device management with identity policies.
SCIM Providers
Automate user provisioning to SaaS applications using Microsoft Entra SCIM provisioning.
SAML and OIDC Applications
Register and manage federated applications using SAML 2.0 and OpenID Connect via Microsoft Graph.
Scroll within the panel for all 7 ·
Resources
Every other property we hold for Microsoft Active Directory — documentation, portals, status pages, policies, and corporate surface — grouped by the job it does, following the integrator's arc from getting started to running in production.
Get Started 2
Portal, sign-up, and the first successful call
Documentation 2
Reference material describing how the API behaves
Agent Surfaces 1
MCP servers, agent skills, and machine-readable catalogs
Design & Contract 16
Pagination, idempotency, versioning, errors, and events
Scroll within the panel for all 16 ·
Build 5
SDKs, sample code, and the tooling you integrate with
Access & Security 5
Authentication, authorization, and security posture
Learn 1
Tutorials, courses, talks, and written guidance
Operate 5
Status, limits, changes, and where to get help
Commercial 3
Pricing, plans, and the legal terms of use
Company 1
The organization behind the API
← All providers · Data indexed from github.com/api-evangelist/active-directory · machine-readable index on apis.io