entra-id-admin

name	entra-id-admin
description	Use when managing Microsoft Entra ID (Azure AD). Covers user/group lifecycle, Conditional Access policies, MFA setup, SSO configuration, Privileged Identity Management, app registrations, B2B guest access, and directory sync.
user-invocable	true
disable-model-invocation	true
context	fork
allowed-tools	["Read","Write","Bash"]
argument-hint	identity action (e.g., create conditional access policy, configure SSO)
hooks	{"PreToolUse":[{"matcher":"Bash","hooks":"[Truncated]"}]}

Microsoft Entra ID Administration

Overview

Identity and access management using Microsoft Entra ID (formerly Azure AD) via Microsoft Graph API and PowerShell. Covers user lifecycle, Conditional Access, SSO, MFA, PIM, and directory synchronization.

User & Group Management

Create Security Group

curl -X POST https://graph.microsoft.com/v1.0/groups \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "displayName": "SG-Engineering-Developers",
    "description": "Security group for engineering developers",
    "mailEnabled": false,
    "mailNickname": "sg-eng-devs",
    "securityEnabled": true,
    "groupTypes": []
  }'

PowerShell Group Management

Connect-MgGraph -Scopes "Group.ReadWrite.All","GroupMember.ReadWrite.All"

# Create dynamic group (auto-membership by department)
$params = @{
    DisplayName = "DG-Engineering-All"
    Description = "Dynamic group for all Engineering staff"
    MailEnabled = $false
    MailNickname = "dg-eng-all"
    SecurityEnabled = $true
    GroupTypes = @("DynamicMembership")
    MembershipRule = '(user.department -eq "Engineering")'
    MembershipRuleProcessingState = "On"
}
New-MgGroup @params

# Add member to static group
New-MgGroupMember -GroupId $groupId -DirectoryObjectId $userId

# List group members
Get-MgGroupMember -GroupId $groupId | ForEach-Object {
    Get-MgUser -UserId $_.Id | Select-Object DisplayName, UserPrincipalName
}

Conditional Access Policies

Require MFA for Admins

Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess"

$params = @{
    DisplayName = "CA001 - Require MFA for Admins"
    State = "enabledForReportingButNotEnforced"  # Test first!
    Conditions = @{
        Users = @{
            IncludeRoles = @(
                "62e90394-69f5-4237-9190-012177145e10"  # Global Administrator
                "f28a1f50-f6e7-4571-818b-6a12f2af6b6c"  # SharePoint Administrator
                "fe930be7-5e62-47db-91af-98c3a49a38b1"  # User Administrator
            )
        }
        Applications = @{ IncludeApplications = @("All") }
    }
    GrantControls = @{
        BuiltInControls = @("mfa")
        Operator = "OR"
    }
}
New-MgIdentityConditionalAccessPolicy @params

Block Legacy Authentication

$params = @{
    DisplayName = "CA002 - Block Legacy Authentication"
    State = "enabledForReportingButNotEnforced"
    Conditions = @{
        Users = @{ IncludeUsers = @("All") }
        Applications = @{ IncludeApplications = @("All") }
        ClientAppTypes = @("exchangeActiveSync", "other")
    }
    GrantControls = @{
        BuiltInControls = @("block")
        Operator = "OR"
    }
}
New-MgIdentityConditionalAccessPolicy @params