improvement(microsoft-ad): add pagination support and fill BlockMeta gaps

[waleedlatif1]

Summary

• Ran a full validate-integration pass on Azure AD (microsoft_ad) against live Microsoft Graph API docs — endpoints, HTTP methods, required/optional params, response mappings, and OAuth scopes were all already correct, no critical bugs found
• List Users/Groups/Group Members had no way to page past the default Graph page size (100, max 999 via $top) — added a nextLink input/output to all three, following the same convention already used by microsoft_dataverse
• Create Group's visibility dropdown was missing HiddenMembership, a valid Microsoft 365-only value that can only be set at creation time
• Rounded out BlockMeta skills (3 -> 5) with two more tool-grounded use cases: directory search and ad hoc group membership changes

Type of Change

• Bug fix / improvement

Testing

Tested manually (tsc + biome clean, verified query construction and Graph docs alignment)

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 6, 2026 10:20pm

[cursor]

PR Summary

Medium Risk
Touches Entra ID provisioning and directory listing; nextLink is origin-restricted to graph.microsoft.com, but search/filter behavior and optional groupId on paged member lists could surprise existing workflows.

Overview
Azure AD list operations can now walk past the default Graph page size via a Next Page (nextLink) input on List Users, List Groups, and List Group Members. Responses expose nextLink for chaining; continuation URLs are validated with assertGraphNextPageUrl before use. List Group Members no longer requires Group ID when paging with a prior nextLink.

Create Group adds Hidden Membership visibility (M365-only, creation-time). Create User requests selected profile fields on the POST so the created user payload is populated without a follow-up GET.

List search queries now use Graph’s displayName/mail (or description) search syntax with escaping; the prior client-side error when both search and filter were set was removed (Graph still rejects incompatible combinations).

Block UI, tool params, and BlockMeta skills were updated for pagination and two new skills: directory user search and ad hoc group membership management.

^{Reviewed by Cursor Bugbot for commit a4d76a6. Configure here.}

[greptile-apps]

Greptile Summary

This PR adds pagination support (nextLink input/output) to the three Azure AD list tools (List Users, List Groups, List Group Members), fixes the $search KQL format to use property-scoped queries, adds HiddenMembership to the group visibility dropdown, and enriches the BlockMeta with two new tool-grounded skills. The assertGraphNextPageUrl helper from SharePoint utils is reused to validate continuation URLs before forwarding the Bearer token, addressing the previously flagged SSRF/token-exfiltration concern.

• Pagination: nextLink is now an optional parameter and output on all three list tools; the assertGraphNextPageUrl guard enforces the URL origin is https://graph.microsoft.com before use.
• Search format: The $search query string is updated from a bare free-text value to the proper KQL property-scoped syntax ("displayName:term" OR "mail:term"), which is the correct format for Azure AD Graph directory queries.
• Create User: The POST URL now includes $select to request only the fields the tool actually maps in transformResponse, avoiding reliance on default field inclusion.

Confidence Score: 5/5

Safe to merge — the pagination plumbing is correct, the continuation URL security guard is in place, and the block UI changes are coherent.

The changes are well-scoped and consistent: pagination is added uniformly across all three list tools, assertGraphNextPageUrl prevents Bearer-token forwarding to untrusted hosts, the KQL search format is a net improvement over the old encoding, groupId is shown but made optional in the block with runtime validation preserving correctness for the initial call, and the HiddenMembership addition is a valid Microsoft Graph value. No data-correctness or auth-boundary issues were found.

No files require special attention.

Important Files Changed

Filename	Overview
apps/sim/tools/microsoft_ad/list_users.ts	Adds nextLink pagination support; switches $search to KQL property-scoped format; removes early $search+$filter mutual-exclusion guard; uses assertGraphNextPageUrl to validate continuation URLs.
apps/sim/tools/microsoft_ad/list_groups.ts	Adds nextLink pagination support and KQL-scoped $search; mirrors list_users changes; removes mutual-exclusion guard for $search+$filter.
apps/sim/tools/microsoft_ad/list_group_members.ts	Adds nextLink pagination; makes groupId optional at schema level (runtime throws if neither nextLink nor groupId is supplied); correctly bypasses groupId check when nextLink is present.
apps/sim/tools/microsoft_ad/create_user.ts	Appends $select to the POST URL so the create-user response includes all fields the transformResponse maps; Microsoft Graph supports $select on POST for users.
apps/sim/blocks/blocks/microsoft_ad.ts	Adds nextLink UI field in advanced mode; removes list_group_members from groupId required array (correct, since pagination calls don't need it); adds HiddenMembership dropdown option; enriches BlockMeta with two new skills.
apps/sim/tools/microsoft_ad/types.ts	Adds nextLink?: string to all three list params interfaces and nextLink: string

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
participant LLM
participant Tool as AD List Tool
participant Guard as assertGraphNextPageUrl
participant Graph as Microsoft Graph API
LLM->>Tool: call with filter/search/top params
Tool->>Graph: GET /v1.0/users with KQL search and select
Graph-->>Tool: value array plus odata.nextLink
Tool-->>LLM: users array plus nextLink string
LLM->>Tool: call with nextLink from previous response
Tool->>Guard: validate nextLink origin
Note over Guard: Throws if origin is not graph.microsoft.com
Guard-->>Tool: validated URL
Tool->>Graph: GET validated nextLink URL
Graph-->>Tool: next page of results
Tool-->>LLM: users array, nextLink null when exhausted

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
participant LLM
participant Tool as AD List Tool
participant Guard as assertGraphNextPageUrl
participant Graph as Microsoft Graph API
LLM->>Tool: call with filter/search/top params
Tool->>Graph: GET /v1.0/users with KQL search and select
Graph-->>Tool: value array plus odata.nextLink
Tool-->>LLM: users array plus nextLink string
LLM->>Tool: call with nextLink from previous response
Tool->>Guard: validate nextLink origin
Note over Guard: Throws if origin is not graph.microsoft.com
Guard-->>Tool: validated URL
Tool->>Graph: GET validated nextLink URL
Graph-->>Tool: next page of results
Tool-->>LLM: users array, nextLink null when exhausted

Loading

_{Reviews (4): Last reviewed commit: "fix(microsoft-ad): allow $search+$filter..." | Re-trigger Greptile}

[waleedlatif1]

@greptile review

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 9e00f2d. Configure here.}

[waleedlatif1]

@greptile review

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile review

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit a4d76a6. Configure here.}