feat(microsoft-ad): add Azure AD (Entra ID) integration

[waleedlatif1]

Summary

• Adds complete Azure AD (Microsoft Entra ID) integration with 13 tools for user and group management via Microsoft Graph API v1.0
• Tools: list/get/create/update/delete users, list/get/create/update/delete groups, list/add/remove group members
• Block with conditional subBlocks, OAuth config with PKCE, scope descriptions, and auth.ts provider entry
• Generated docs with manual intro section

Details

• All endpoints validated against Microsoft Graph API v1.0 documentation
• OAuth scopes centralized in oauth.ts using getScopesForService() / getCanonicalScopesForProvider()
• Net new scopes required on Azure app registration: User.Read.All, User.ReadWrite.All, GroupMember.ReadWrite.All, Directory.Read.All
• Group.ReadWrite.All already existed from Teams/Planner
• Uses errorExtractor: 'nested-error-object' for Microsoft Graph error format
• ConsistencyLevel: 'eventual' header on search-capable endpoints
• $ref suffix on add/remove member endpoints (prevents accidental user object deletion)

Test plan

• Verify OAuth flow connects successfully with Microsoft account
• Test list users operation returns expected user data
• Test create user with required fields (displayName, mailNickname, UPN, password)
• Test group CRUD operations
• Test add/remove group member operations
• Verify block conditional fields show/hide correctly per operation
• Verify advanced mode fields (filter, search, top) work correctly

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Mar 19, 2026 10:35pm

[cursor]

PR Summary

Medium Risk
Adds a new OAuth provider/service with broad Microsoft Graph directory scopes and tools that can create/update/delete users and groups, which raises operational and security risk if misconfigured. Changes are largely additive but touch auth provider configuration and global tool/block registries.

Overview
Adds an Azure AD (Microsoft Entra ID) integration end-to-end: a new microsoft_ad block, docs page, and 13 Microsoft Graph tools to list/get/create/update/delete users and groups plus add/remove/list group members.

Wires the integration through the platform by registering a new microsoft-ad OAuth provider/service (PKCE) with directory-related scopes and scope descriptions, and exposing the new tools/blocks in the corresponding registries and docs icon/type mappings.

^{Written by Cursor Bugbot for commit 44b9431. Configure here.}

[greptile-apps]

Greptile Summary

This PR adds a complete Azure AD (Microsoft Entra ID) integration with 13 tools covering the full user and group management lifecycle via Microsoft Graph API v1.0. The implementation is well-structured and follows the existing patterns in the codebase — OAuth config centralized in oauth.ts, scope descriptions in utils.ts, PKCE-enabled auth provider in auth.ts, shared type definitions, and a conditional block UI that shows/hides fields per operation.

Key observations:

• All previously raised issues (search/filter mutual exclusion, $count=true with $search, memberId validation) are correctly addressed in the current revision.
• forceChangePasswordNextSignIn in create_user.ts is hardcoded to true, which prevents service-account/headless provisioning scenarios — this should be an optional configurable param.
• update_user.ts and update_group.ts will silently return updated: true when called with no fields to change (empty PATCH body), giving false confidence to the caller.
• The microsoft-ad OAuth entry includes all required Graph API scopes and is correctly wired into the Microsoft provider's token refresh machinery.

Confidence Score: 4/5

• Safe to merge with minor caveats — no critical bugs, two style-level improvements worth tracking.
• The integration is thorough: all 13 Graph API endpoints are correctly implemented with proper input validation, OAuth scoping, error extraction, and conditional block UI. Previously flagged issues are resolved. The two remaining points (hardcoded flag in create_user, silent no-op in update_user/group) are style suggestions that don't cause data loss or broken flows, but do limit utility for automation scenarios.
• apps/sim/tools/microsoft_ad/create_user.ts (hardcoded flag), apps/sim/tools/microsoft_ad/update_user.ts and update_group.ts (empty-body silent success)

Important Files Changed

Filename	Overview
apps/sim/blocks/blocks/microsoft_ad.ts	New block config with 13 operations, conditional subBlocks, and a params transformer that correctly merges with base inputs. Minor UX concern: separate accountEnabledCreate/accountEnabled dropdowns for create/update paths are a bit complex but functional.
apps/sim/tools/microsoft_ad/create_user.ts	Correct Graph API POST with required fields. forceChangePasswordNextSignIn is hardcoded to true, which blocks automation/service-account creation scenarios. Password field correctly uses visibility: 'user-only'.
apps/sim/tools/microsoft_ad/update_user.ts	PATCH with conditional body building. Empty body silently returns updated: true without any actual change, which may confuse callers. Logic for boolean accountEnabled conversion is handled correctly at the block layer.
apps/sim/tools/microsoft_ad/list_users.ts	Guard for mutually exclusive $search/$filter and $count=true conditional on $search are both correctly implemented. ConsistencyLevel: eventual header is always sent.
apps/sim/tools/microsoft_ad/list_groups.ts	Same guards and patterns as list_users.ts. Correctly implements $search/$filter mutual exclusion and $count=true on search.
apps/sim/tools/microsoft_ad/add_group_member.ts	Correct $ref endpoint for member addition. Both groupId and memberId are trimmed and validated before use. @odata.id reference uses directoryObjects as recommended.
apps/sim/tools/microsoft_ad/remove_group_member.ts	Correct DELETE on /members/{memberId}/$ref. Both IDs validated. No request body needed for DELETE on $ref.
apps/sim/lib/oauth/oauth.ts	New microsoft-ad service entry with correct scopes (User.Read.All, User.ReadWrite.All, GroupMember.ReadWrite.All, Directory.Read.All, Group.ReadWrite.All). Correctly nested under the existing microsoft provider.
apps/sim/lib/auth/auth.ts	microsoft-ad provider correctly added to the provider allowlist and configured with PKCE, shared client credentials, and getCanonicalScopesForProvider.
apps/sim/tools/microsoft_ad/types.ts	Well-structured type definitions for all 13 operations. Shared USER_OUTPUT_PROPERTIES and GROUP_OUTPUT_PROPERTIES constants reduce duplication. Union type MicrosoftAdResponse covers all response variants.
apps/sim/tools/microsoft_ad/update_group.ts	PATCH body builder with the same empty-body silent-success issue as update_user.ts. All fields use truthy guards so clearing a field to empty string is not possible, but this is consistent with the rest of the codebase.

Sequence Diagram

sequenceDiagram
participant UI as Block UI
participant Executor as GenericBlockHandler
participant Tool as microsoft_ad_* Tool
participant OAuth as OAuth Token Layer
participant Graph as Microsoft Graph API v1.0
UI->>Executor: inputs (operation, userId, displayName, ...)
Executor->>Executor: blockConfig.tools.config.params(inputs)<br/>transforms types & remaps group fields
Executor->>Executor: merge(inputs, transformedParams) → finalInputs
Executor->>Tool: executeTool(toolId, finalInputs)
Tool->>OAuth: resolve accessToken for microsoft-ad
OAuth-->>Tool: Bearer token
Tool->>Graph: HTTP request (GET/POST/PATCH/DELETE)<br/>with Authorization + ConsistencyLevel headers
Graph-->>Tool: 200/201/204 response
Tool->>Tool: transformResponse → { success, output }
Tool-->>Executor: result
Executor-->>UI: block output

Loading

_{Last reviewed commit: "fix(microsoft-ad): p..."}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

Fixed in 44b9431. Both issues addressed:

1. accountEnabledCreate bleed-through: Replaced params.accountEnabled || params.accountEnabledCreate with operation-aware checks — update_user only reads params.accountEnabled, create_user only reads params.accountEnabledCreate. No more cross-contamination.

2. Empty-string PATCH body values: Changed tool body guards from !== undefined to truthy checks (if (params.displayName)) in both update_user.ts and update_group.ts. Empty strings from unfilled subBlocks are now omitted. accountEnabled keeps !== undefined since false is a valid boolean value that must be sent.

Same operation-aware pattern applied to visibility/visibilityCreate — update_group only reads params.visibility, create_group only reads params.visibilityCreate.

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR