feat(microsoft_ad): licensing, security, audit, role, and device operations

Deepens the Microsoft Entra ID block from 12 to 36 tools against the Microsoft
Graph v1.0 reference: license assignment and tenant SKUs, password set/reset,
sign-in session revocation, authentication methods, sign-in and directory audit
logs, app role and directory role assignments, service principals, device reads,
and conditional access policy reads.

Device write (device-update, device-delete) is deliberately excluded. Both
document Directory.AccessAsUser.All as their only delegated scope, with the
higher-privileged read documented as unavailable, so supporting them would mean
requesting tenant-wide act-as-the-user directory access for two operations that
additionally require the caller to hold Intune Administrator.

Also drops an undocumented ?$select= from create_user that was silently nulling
department and accountEnabled in the response.

Author: waleedlatif1

apps/docs/content/docs/en/integrations/microsoft_ad.mdx

@@ -1,5 +1,5 @@
 {
-  "updatedAt": "2026-08-14",
+  "updatedAt": "2026-08-15",
   "integrations": [
     {
       "type": "onepassword",
@@ -2169,8 +2169,8 @@
       "type": "microsoft_ad",
       "slug": "azure-ad",
       "name": "Azure AD",
-      "description": "Manage users and groups in Azure AD (Microsoft Entra ID)",
-      "longDescription": "Integrate Azure Active Directory into your workflows. List, create, update, and delete users and groups. Manage group memberships programmatically.",
+      "description": "Manage identities, licenses, roles, and access in Azure AD (Microsoft Entra ID)",
+      "longDescription": "Integrate Azure Active Directory into your workflows. Create, update, and delete users and groups, manage group memberships, assign and remove licenses, reset passwords, revoke sign-in sessions, read sign-in and directory audit logs, grant and revoke app and directory roles, and read registered devices and conditional access policies. Device writes are not supported.",
       "bgColor": "#0078D4",
       "iconName": "AzureIcon",
       "docsUrl": "https://docs.sim.ai/integrations/microsoft_ad",
@@ -2226,9 +2226,101 @@
         {
           "name": "Remove Group Member",
           "description": "Remove a member from a group in Azure AD (Microsoft Entra ID)"
+        },
+        {
+          "name": "Assign License",
+          "description": "Add or remove subscription licenses (SKUs) on a user in Microsoft Entra ID. Removing a license immediately revokes the access it granted to the associated services."
+        },
+        {
+          "name": "List User Licenses",
+          "description": "List the subscription licenses assigned to a user in Microsoft Entra ID"
+        },
+        {
+          "name": "List Subscribed SKUs",
+          "description": "List the subscription SKUs the tenant owns, including how many license units are prepaid and how many are consumed"
+        },
+        {
+          "name": "Revoke Sign-In Sessions",
+          "description": "Invalidate every refresh token and session cookie issued to a user, forcing them to sign in again on all applications and devices. Revocation can take a few minutes to take effect and does not apply to external users."
+        },
+        {
+          "name": "Set Password",
+          "description": "Set a specific password on a user by updating their password profile. Cannot be used for federated users. Requires an administrator role in Microsoft Entra ID."
+        },
+        {
+          "name": "Reset Password",
+          "description": "Reset another user's password through their password authentication method. Leave the new password empty to have Microsoft generate one and return it. The user is prompted to change the password at their next sign-in. Cannot be run against your own account."
+        },
+        {
+          "name": "List Authentication Methods",
+          "description": "List the authentication methods a user has registered, such as passwords, phone numbers, FIDO2 keys, and authenticator apps"
+        },
+        {
+          "name": "List Sign-Ins",
+          "description": "List sign-in events from the Microsoft Entra ID sign-in logs, newest first. Requires a Microsoft Entra ID P1 or P2 license. Apply a date filter to keep large queries from timing out."
+        },
+        {
+          "name": "List Directory Audits",
+          "description": "List directory audit records showing who changed what in Microsoft Entra ID, such as user creation, group membership changes, and role assignments"
+        },
+        {
+          "name": "List User App Role Assignments",
+          "description": "List the application role assignments granted to a user, including assignments the user inherits from groups they are a direct member of"
+        },
+        {
+          "name": "Grant App Role To User",
+          "description": "Grant a user an application role on a service principal, giving them access to that application"
+        },
+        {
+          "name": "Revoke App Role From User",
+          "description": "Revoke an application role assignment from a user, removing their access to that application. Takes the assignment's own ID, not the app role ID."
+        },
+        {
+          "name": "List Service Principals",
+          "description": "List the enterprise applications and service principals in the tenant, including the app roles each one exposes"
+        },
+        {
+          "name": "List Application Assignments",
+          "description": "List every user, group, and service principal assigned to an application, by reading the app role assignments on its service principal. Recently granted or removed assignments can take time to appear."
+        },
+        {
+          "name": "List Directory Roles",
+          "description": "List the administrator roles that are activated in the tenant, such as Global Administrator and User Administrator. Roles that have never been activated are not returned."
+        },
+        {
+          "name": "List Directory Role Members",
+          "description": "List the principals holding an administrator role. Returns up to 1000 members; this endpoint does not support paging."
+        },
+        {
+          "name": "Add Directory Role Member",
+          "description": "Grant a user an administrator role in Microsoft Entra ID. This is a privileged change that expands what the user can do across the tenant."
+        },
+        {
+          "name": "Remove Directory Role Member",
+          "description": "Revoke an administrator role from a user in Microsoft Entra ID. Removes only the role membership; the user account itself is not deleted."
+        },
+        {
+          "name": "List Devices",
+          "description": "List the devices registered in Microsoft Entra ID"
+        },
+        {
+          "name": "Get Device",
+          "description": "Get a registered device by its object ID from Microsoft Entra ID"
+        },
+        {
+          "name": "List User Devices",
+          "description": "List the devices a user has registered or owns. Devices the caller cannot read are returned with only their ID and the remaining fields null."
+        },
+        {
+          "name": "List Conditional Access Policies",
+          "description": "List the conditional access policies configured in the tenant, including their state and the conditions and controls they enforce. Read-only."
+        },
+        {
+          "name": "Get Conditional Access Policy",
+          "description": "Get a single conditional access policy by ID, including the conditions it matches and the controls it enforces. Read-only."
         }
       ],
-      "operationCount": 13,
+      "operationCount": 36,
       "triggers": [],
       "triggerCount": 0,
       "authType": "oauth",

apps/sim/blocks/blocks/microsoft_ad.ts

@@ -339,6 +339,14 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderConfig> = {
           'Group.ReadWrite.All',
           'GroupMember.ReadWrite.All',
           'Directory.Read.All',
+          'LicenseAssignment.ReadWrite.All',
+          'UserAuthenticationMethod.ReadWrite.All',
+          'AuditLog.Read.All',
+          'Application.Read.All',
+          'AppRoleAssignment.ReadWrite.All',
+          'RoleManagement.ReadWrite.Directory',
+          'Device.Read.All',
+          'Policy.Read.All',
           'offline_access',
         ],
       },

apps/sim/lib/integrations/integrations.json

@@ -260,6 +260,15 @@ export const SCOPE_DESCRIPTIONS: Record<string, string> = {
   'User.ReadWrite.All': 'Read and write all user profiles',
   'GroupMember.ReadWrite.All': 'Read and write all group memberships',
   'Directory.Read.All': 'Read directory data',
+  'LicenseAssignment.ReadWrite.All': 'Assign and remove user licenses',
+  'UserAuthenticationMethod.ReadWrite.All':
+    'Read and reset authentication methods and passwords for all users',
+  'AuditLog.Read.All': 'Read sign-in and directory audit logs',
+  'Application.Read.All': 'Read all applications and service principals',
+  'AppRoleAssignment.ReadWrite.All': 'Grant and revoke application role assignments',
+  'RoleManagement.ReadWrite.Directory': 'Read and manage directory role assignments',
+  'Device.Read.All': 'Read all devices',
+  'Policy.Read.All': 'Read conditional access and other policies',
 
   // Reddit scopes
   identity: 'Access Reddit identity',

apps/sim/lib/oauth/oauth.ts

@@ -0,0 +1,78 @@
+import type {
+  MicrosoftAdAddDirectoryRoleMemberParams,
+  MicrosoftAdAddDirectoryRoleMemberResponse,
+} from '@/tools/microsoft_ad/types'
+import type { ToolConfig } from '@/tools/types'
+
+export const addDirectoryRoleMemberTool: ToolConfig<
+  MicrosoftAdAddDirectoryRoleMemberParams,
+  MicrosoftAdAddDirectoryRoleMemberResponse
+> = {
+  id: 'microsoft_ad_add_directory_role_member',
+  name: 'Add Microsoft Entra ID Directory Role Member',
+  description:
+    'Grant a user an administrator role in Microsoft Entra ID. This is a privileged change that expands what the user can do across the tenant.',
+  version: '1.0.0',
+  errorExtractor: 'nested-error-object',
+  oauth: {
+    required: true,
+    provider: 'microsoft-ad',
+  },
+  params: {
+    accessToken: {
+      type: 'string',
+      required: true,
+      visibility: 'hidden',
+      description: 'Microsoft Graph API access token',
+    },
+    directoryRoleId: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'Object ID of the directory role. Use List Directory Roles to find it.',
+    },
+    memberId: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'Object ID of the user to grant the role to',
+    },
+  },
+  request: {
+    url: (params) => {
+      const directoryRoleId = params.directoryRoleId?.trim()
+      if (!directoryRoleId) throw new Error('Directory role ID is required')
+      return `https://graph.microsoft.com/v1.0/directoryRoles/${encodeURIComponent(directoryRoleId)}/members/$ref`
+    },
+    method: 'POST',
+    headers: (params) => ({
+      Authorization: `Bearer ${params.accessToken}`,
+      'Content-Type': 'application/json',
+    }),
+    body: (params) => {
+      const memberId = params.memberId?.trim()
+      if (!memberId) throw new Error('Member ID is required')
+      return {
+        '@odata.id': `https://graph.microsoft.com/v1.0/directoryObjects/${memberId}`,
+      }
+    },
+  },
+  transformResponse: async (
+    _response: Response,
+    params?: MicrosoftAdAddDirectoryRoleMemberParams
+  ) => {
+    return {
+      success: true,
+      output: {
+        added: true,
+        directoryRoleId: params?.directoryRoleId ?? '',
+        memberId: params?.memberId ?? '',
+      },
+    }
+  },
+  outputs: {
+    added: { type: 'boolean', description: 'Whether the member was added successfully' },
+    directoryRoleId: { type: 'string', description: 'ID of the directory role' },
+    memberId: { type: 'string', description: 'ID of the member that was added' },
+  },
+}

apps/sim/lib/oauth/utils.ts

@@ -0,0 +1,95 @@
+import type {
+  MicrosoftAdAddUserAppRoleAssignmentParams,
+  MicrosoftAdAddUserAppRoleAssignmentResponse,
+} from '@/tools/microsoft_ad/types'
+import { APP_ROLE_ASSIGNMENT_OUTPUT_PROPERTIES } from '@/tools/microsoft_ad/types'
+import type { ToolConfig } from '@/tools/types'
+
+export const addUserAppRoleAssignmentTool: ToolConfig<
+  MicrosoftAdAddUserAppRoleAssignmentParams,
+  MicrosoftAdAddUserAppRoleAssignmentResponse
+> = {
+  id: 'microsoft_ad_add_user_app_role_assignment',
+  name: 'Grant Microsoft Entra ID App Role To User',
+  description:
+    'Grant a user an application role on a service principal, giving them access to that application',
+  version: '1.0.0',
+  errorExtractor: 'nested-error-object',
+  oauth: {
+    required: true,
+    provider: 'microsoft-ad',
+  },
+  params: {
+    accessToken: {
+      type: 'string',
+      required: true,
+      visibility: 'hidden',
+      description: 'Microsoft Graph API access token',
+    },
+    userId: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'User ID or user principal name to grant the app role to',
+    },
+    resourceId: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description:
+        'Object ID of the resource service principal that defines the app role. Use List Service Principals to find it.',
+    },
+    appRoleId: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description:
+        'ID of the app role to grant. Use the all-zero GUID 00000000-0000-0000-0000-000000000000 to assign access without a specific role.',
+    },
+  },
+  request: {
+    url: (params) => {
+      const userId = params.userId?.trim()
+      if (!userId) throw new Error('User ID is required')
+      return `https://graph.microsoft.com/v1.0/users/${encodeURIComponent(userId)}/appRoleAssignments`
+    },
+    method: 'POST',
+    headers: (params) => ({
+      Authorization: `Bearer ${params.accessToken}`,
+      'Content-Type': 'application/json',
+    }),
+    body: (params) => {
+      const resourceId = params.resourceId?.trim()
+      const appRoleId = params.appRoleId?.trim()
+      const principalId = params.userId?.trim()
+      if (!resourceId) throw new Error('Resource ID is required')
+      if (!appRoleId) throw new Error('App role ID is required')
+      return { principalId, resourceId, appRoleId }
+    },
+  },
+  transformResponse: async (response: Response) => {
+    const assignment = await response.json()
+    return {
+      success: true,
+      output: {
+        assignment: {
+          id: assignment.id ?? null,
+          appRoleId: assignment.appRoleId ?? null,
+          createdDateTime: assignment.createdDateTime ?? null,
+          principalId: assignment.principalId ?? null,
+          principalDisplayName: assignment.principalDisplayName ?? null,
+          principalType: assignment.principalType ?? null,
+          resourceId: assignment.resourceId ?? null,
+          resourceDisplayName: assignment.resourceDisplayName ?? null,
+        },
+      },
+    }
+  },
+  outputs: {
+    assignment: {
+      type: 'object',
+      description: 'The created app role assignment',
+      properties: APP_ROLE_ASSIGNMENT_OUTPUT_PROPERTIES,
+    },
+  },
+}