Manage directory groups, users and membership through an authorized work or school account.
Explore 12 workflow actions for Microsoft Entra ID, including account permissions and operation limits.
4 read actions8 write actions
WORKFLOW ACTIONS
What you can configure.
Choose an action in the workflow builder, connect an account, and map its inputs. These actions are available in the catalog; your account access and a successful test determine whether they work for your setup.
Add user to group
Write
Add user to group
Permissions and limits
Account permissions
Group.ReadWrite.All
GroupMember.ReadWrite.All
User.ReadWrite.All
Operation limits
The write is sent once. If Microsoft Graph replies are lost, the result is uncertain and NodeHub does not retry automatically.
The signed-in Microsoft account must also hold the directory role required by its tenant.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Create security group
Write
Create an assigned-membership security group. This does not create a Microsoft 365 group or a Team.
Permissions and limits
Account permissions
Group.ReadWrite.All
GroupMember.ReadWrite.All
User.ReadWrite.All
Operation limits
The write is sent once. If Microsoft Graph replies are lost, the result is uncertain and NodeHub does not retry automatically.
The signed-in Microsoft account must also hold the directory role required by its tenant.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Create user
Write
Create a work or school user with an initial password stored as a business workflow secret.
Permissions and limits
Account permissions
Group.ReadWrite.All
GroupMember.ReadWrite.All
User.ReadWrite.All
Operation limits
The initial password is read from an encrypted business workflow secret only at dispatch. Microsoft may reject a password that does not meet the tenant policy.
The write is sent once. If Microsoft Graph replies are lost, the result is uncertain and NodeHub does not retry automatically.
The signed-in Microsoft account must also hold the directory role required by its tenant.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Delete group
Write
Delete group
Permissions and limits
Account permissions
Group.ReadWrite.All
GroupMember.ReadWrite.All
User.ReadWrite.All
Operation limits
The write is sent once. If Microsoft Graph replies are lost, the result is uncertain and NodeHub does not retry automatically.
The signed-in Microsoft account must also hold the directory role required by its tenant.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Delete user
Write
Delete user
Permissions and limits
Account permissions
Group.ReadWrite.All
GroupMember.ReadWrite.All
User.ReadWrite.All
Operation limits
The write is sent once. If Microsoft Graph replies are lost, the result is uncertain and NodeHub does not retry automatically.
The signed-in Microsoft account must also hold the directory role required by its tenant.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Get group
Read
Get one get group by object ID.
Permissions and limits
Account permissions
Group.ReadWrite.All
GroupMember.ReadWrite.All
User.ReadWrite.All
Get user
Read
Get one get user by object ID.
Permissions and limits
Account permissions
Group.ReadWrite.All
GroupMember.ReadWrite.All
User.ReadWrite.All
List groups
Read
List one page of list groups from the connected directory.
Permissions and limits
Account permissions
Group.ReadWrite.All
GroupMember.ReadWrite.All
User.ReadWrite.All
List users
Read
List one page of list users from the connected directory.
Permissions and limits
Account permissions
Group.ReadWrite.All
GroupMember.ReadWrite.All
User.ReadWrite.All
Remove user from group
Write
Remove user from group
Permissions and limits
Account permissions
Group.ReadWrite.All
GroupMember.ReadWrite.All
User.ReadWrite.All
Operation limits
The write is sent once. If Microsoft Graph replies are lost, the result is uncertain and NodeHub does not retry automatically.
The signed-in Microsoft account must also hold the directory role required by its tenant.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Update group
Write
Update group
Permissions and limits
Account permissions
Group.ReadWrite.All
GroupMember.ReadWrite.All
User.ReadWrite.All
Operation limits
The write is sent once. If Microsoft Graph replies are lost, the result is uncertain and NodeHub does not retry automatically.
The signed-in Microsoft account must also hold the directory role required by its tenant.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Update user
Write
Update user
Permissions and limits
Account permissions
Group.ReadWrite.All
GroupMember.ReadWrite.All
User.ReadWrite.All
Operation limits
The write is sent once. If Microsoft Graph replies are lost, the result is uncertain and NodeHub does not retry automatically.
The signed-in Microsoft account must also hold the directory role required by its tenant.
A repeated request may repeat the external action. Review the previous result before retrying a write.
SETUP
Start with a controlled test.
01Connect the intended account
Use the account and permissions required for your process. Review the connection check before configuring a workflow action.
02Review inputs and access
Select a listed operation and map its required inputs. Use test records and add a human approval before writes that need review.
03Confirm the result
Inspect step outputs and confirm the result in Microsoft Entra ID. A saved workflow is not a completed provider action.
Security & Identity · CONNECTION
