Microsoft 365 Admin

An n8n node for managing users, groups, authentication methods and licenses in Microsoft Entra ID through the Microsoft Graph API.

It authenticates as an application rather than a user, so it runs unattended: no browser sign-in, no redirect URI, and no refresh token to expire.

Operations

User — Create · Get · Get Many · Update · Delete · Add to Group · Remove From Group · Get Groups · Get Manager · Set Manager · Revoke Sessions

Group — Create · Get · Get Many · Update · Delete · Get Members · Get Owners · Add Owner · Remove Owner

Authentication — Get Many Methods · Get Password Method · Delete Method · Create Temporary Access Pass · Reset Password

License — Query Tenant Licenses · Query User Licenses · Query License Holders · Assign · Assign to Group · Unassign

Install

In n8n, go to Settings → Community nodes → Install and enter @synergyconsulting/n8n-nodes-microsoft-365-admin.

To install it manually instead, run this in your n8n user folder and restart n8n:

cd ~/.n8n/nodes
npm install @synergyconsulting/n8n-nodes-microsoft-365-admin

n8n 1.81 or newer is required: the license write operations run as custom operations, which older versions do not execute.

Setup

1. Register an application

In the Entra admin center go to Applications → App registrations → New registration. Choose Single tenant and leave the redirect URI blank — this node never uses one.

From the Overview page copy the Application (client) ID and the Directory (tenant) ID. Under Certificates & secrets create a client secret and copy its Value straight away; it is only shown once.

2. Grant permissions

Under API permissions → Add a permission → Microsoft Graph, choose Application permissions. Not Delegated — delegated permissions do nothing for an app-only connection and every call comes back 403.

| Permission | Covers | |---|---| | Organization.Read.All | the connection test and tenant license queries | | User.ReadWrite.All | all user operations and user licensing | | Group.ReadWrite.All | all group operations, including members and owners | | UserAuthenticationMethod.ReadWrite.All | Authentication → Get Many Methods, Get Password Method, Delete Method and Create Temporary Access Pass | | User-PasswordProfile.ReadWrite.All | Authentication → Reset Password through passwordProfile |

Then click Grant admin consent. This needs Global Administrator or Privileged Role Administrator — Application Administrator is not enough.

Reset Password additionally requires the application's service principal to hold at least the User Administrator Microsoft Entra role. Resetting privileged administrators is subject to the Entra role hierarchy and can require Privileged Authentication Administrator. These directory roles are separate from Microsoft Graph application permissions.

3. Add the credential

In n8n create a Microsoft 365 Admin (Service Principal) API credential and fill in the tenant ID, client ID and secret. Leave the Graph base URL on Global unless your tenant is in a sovereign cloud.

Save to run the connection test.

Things worth knowing

Recreate the credential after changing permissions. The access token is cached on the credential. Graph replies 403 to a valid token that lacks a permission, and n8n only fetches a new token on a 401 — so a token minted before you granted consent keeps failing forever. Deleting and re-adding the credential is the fix; editing and saving is not.

Entra ID applies one license change per tenant at a time. A second assignLicense write arriving while the first is still being processed is rejected outright — "Error due to concurrent requests being made to the tenant" — and the tenant can stay busy for the better part of a minute. Assign, Assign to Group and Unassign therefore behave differently from every other operation in this node: they send one request at a time rather than one per input item in parallel, and a rejected write is retried with a growing delay instead of failing the run. Three things make a bulk change finish quickly:

• Pick every SKU in one item. The License SKU field is a multi-select, and one request carries any number of licenses for the same tenant-processing time. Ten licenses on one user is one request, not ten.
• Swap in place. Options → License SKU Names or IDs to Remove on Assign removes licenses in the same request that adds the new ones, so an E3 → E5 move costs one round of processing instead of two.
• Let items collapse. Options → Combine Items for the Same Target (on by default) merges every input item aimed at the same user into a single request, so a workflow that emits one item per license change still sends one request per user.

For hundreds of users, license through a group instead: Assign to Group is a single write that Entra fans out to the members itself, in the background.

Options also carries Max Retries (default 5) and Wait Between Requests, for tenants where something outside the workflow — an admin in the portal, another automation — is competing for the same lock.

Password reset goes through passwordProfile, not the authentication methods API. Graph's POST /users/{id}/authentication/methods/{id}/resetPassword supports delegated access only — there is no application permission for it, so an app-only credential like this one can never call it, whatever roles the app holds. Authentication → Reset Password therefore PATCHes passwordProfile instead, which is the app-only equivalent: it writes to Entra ID and, where password writeback is configured, on to on-premises AD. Leave the Password option empty and the node generates one and returns it as password on the output item — the only place a generated password exists, so capture it in the same run.

Deleting a method needs its type as well as its ID. Each method type lives in its own Graph collection, and Get Many Methods reports an @odata.type rather than the URL segment a delete needs. The node fills that gap: every method it returns carries methodType (phoneMethods, fido2Methods, …), methodName and deletable, so an MFA reset is Get Many Methods → Filter on deletable → Delete Method with {{ $json.methodType }} and {{ $json.id }}. Picking by hand works too: choose the type, and the Method list shows what that user has registered.

Some methods refuse to be deleted. Graph rejects deleting a phone number that is the user's default MFA method — the user has to change their default first — and there is no delete for a password at all. A mobile number cannot be removed while an alternateMobile one exists.

A Temporary Access Pass is returned once. The temporaryAccessPass field of the response is the passcode; it is never readable again. A user can hold only one usable pass, so issuing a second replaces the first. A multi-use pass is only accepted if the Temporary Access Pass authentication method policy allows it, and the method has to be enabled in that policy for the target user at all — otherwise Graph refuses to issue one.

Revoking sessions is under User, not Authentication — User → Revoke Sessions invalidates refresh tokens and browser sessions, which pairs well with a password reset.

Set usageLocation before licensing a user. Assigning a license to a user without one fails with an error that looks like a permissions problem. Set it first with User → Update using a two-letter country code, e.g. LT.

Licenses inherited from a group cannot be unassigned directly. Query License Holders returns licenseAssignmentStates; if assignedByGroup is set, the license comes from group-based licensing and Unassign silently does nothing. Remove the user from that group instead.

Assign to Group needs Entra ID P1 and licenses members in the background, so a successful response does not mean they are licensed yet.

Users holding admin roles need more than Graph permissions. To modify them the app also has to be assigned a directory role such as User Administrator — and Authentication Administrator for the Authentication resource, or Privileged Authentication Administrator to act on privileged accounts.

Using expressions

Any field can be driven from workflow data. Resource pickers (User, Group, Manager, Owner) take an expression once you switch them to By ID; dropdowns such as License SKU take one via the Fixed/Expression toggle.

Resource and Operation are the exceptions — n8n needs to know the operation to decide which fields to show. Use a Switch node if you need to vary it at runtime.

Development

npm install
npm run dev     # n8n with this node linked, on http://localhost:5678
npm run build
npm run lint
npm test

npm run test:coverage enforces an 80% floor on lines, statements, branches and functions.

Layout

The node follows n8n's actions/transport structure, so each operation is one file that owns its parameters and its own request:

nodes/Microsoft365Admin/
├── Microsoft365Admin.node.ts     # node description; delegates execution to the router
├── actions/
│   ├── router.ts                 # picks the operation for each input item
│   ├── node.type.ts              # the resource → operation map, as types
│   └── <resource>/
│       ├── index.ts              # the Operation dropdown, plus every operation's parameters
│       └── <operation>.operation.ts   # `properties`, `description`, `execute`
├── methods/                      # loadOptions and listSearch for the pickers
├── transport/                    # Graph requests, paging and error translation
└── helpers/                      # shared parameter shapes and per-resource logic

To add an operation: write <operation>.operation.ts exporting properties, description and execute, register it in the resource's index.ts (both the export and the dropdown), and add it to actions/node.type.ts.

Two things depart from the plain per-item pattern, both for reasons Graph forces:

• The three License write operations export executeAll instead of execute. Entra ID applies one license change per tenant at a time, so they run once for the whole input, serialise their requests and fold every item aimed at the same target into one call.
• Reset Password returns the password it generated, which is why it is programmatic rather than a declarative PATCH — Graph answers 204 with nothing in it.

License

MIT. Includes code derived from the Microsoft Entra ID node in n8n; copyright in the original work belongs to n8n GmbH. Releases up to 1.0.0 were distributed under n8n's Sustainable Use License. See LICENSE.md.