Microsoft Entra ID (formerly Azure AD)

Microsoft Entra ID (formerly Azure AD) Directory.administrative Unit API

The directory.administrativeUnit API from Microsoft Entra ID (formerly Azure AD) — 32 operation(s) for directory.administrativeunit.

GitHub OpenAPI
Business capability
Identity & Access Management BC-620.20

Operations 44

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /directory/administrativeUnits List administrative units in the directory · List administrativeUnits #
Ask an LLM
“What administrative units exist in my Microsoft Entra tenant?”
“Can I see every administrative unit we use to delegate admin scope?”
Tell an agent
List all administrative units in the directory.
Show me every administrative unit with its display name and visibility.
POST /directory/administrativeUnits Create an administrative unit · Create administrativeUnit #
Ask an LLM
“How do I set up a new administrative unit to scope admin rights to one region?”
“Can a new administrative unit use a dynamic membership rule?”
Tell an agent
Create an administrative unit named {name}.
Create an administrative unit called {name} described as {description}.
GET /directory/administrativeUnits/{administrativeUnit-id} Get an administrative unit's details · Get administrativeUnit #
Ask an LLM
“What are the properties of a specific administrative unit?”
“Is a given administrative unit restricted management or hidden membership?”
Tell an agent
Show the details of administrative unit {unit_id}.
Get the membership rule and visibility of administrative unit {unit_id}.
PATCH /directory/administrativeUnits/{administrativeUnit-id} Update an administrative unit · Update administrativeUnit #
Ask an LLM
“How do I rename an existing administrative unit?”
“Can I change the membership rule on an administrative unit that already exists?”
Tell an agent
Rename administrative unit {unit_id} to {name}.
Change the membership rule of administrative unit {unit_id} to {rule}.
DELETE /directory/administrativeUnits/{administrativeUnit-id} Delete an administrative unit · Delete administrativeUnit #
Ask an LLM
“How do I remove an administrative unit we no longer need?”
“Can I delete an administrative unit outright?”
Tell an agent destructive · confirm first
Delete administrative unit {unit_id}.
Remove the administrative unit {unit_id} from the directory entirely.
GET /directory/administrativeUnits/{administrativeUnit-id}/extensions List open extensions on an administrative unit · Get extensions from directory #
Ask an LLM
“What custom open extensions are attached to an administrative unit?”
“Can I read the custom data we stored on an administrative unit?”
Tell an agent
List the open extensions on administrative unit {unit_id}.
Show all custom extension data stored on administrative unit {unit_id}.
POST /directory/administrativeUnits/{administrativeUnit-id}/extensions Add an open extension to an administrative unit · Create new navigation property to extensions for directory #
Ask an LLM
“How do I attach custom data to an administrative unit as an open extension?”
“Can I add a new extension to an administrative unit?”
Tell an agent
Add an open extension to administrative unit {unit_id}.
Create extension {extension_id} on administrative unit {unit_id}.
GET /directory/administrativeUnits/{administrativeUnit-id}/extensions/{extension-id} Get one open extension on an administrative unit · Get extensions from directory #
Ask an LLM
“What's stored in a particular open extension on an administrative unit?”
“Can I fetch a single extension by its id from an administrative unit?”
Tell an agent
Get extension {extension_id} on administrative unit {unit_id}.
Show the contents of open extension {extension_id} for administrative unit {unit_id}.
PATCH /directory/administrativeUnits/{administrativeUnit-id}/extensions/{extension-id} Update an open extension on an administrative unit · Update the navigation property extensions in directory #
Ask an LLM
“How do I change the custom data in an existing extension on an administrative unit?”
“Can I edit an open extension that's already on an administrative unit?”
Tell an agent
Update extension {extension_id} on administrative unit {unit_id}.
Modify the existing open extension {extension_id} stored on administrative unit {unit_id}.
DELETE /directory/administrativeUnits/{administrativeUnit-id}/extensions/{extension-id} Delete an open extension from an administrative unit · Delete navigation property extensions for directory #
Ask an LLM
“How do I remove custom extension data from an administrative unit?”
“Can I delete one open extension without touching the administrative unit itself?”
Tell an agent destructive · confirm first
Delete extension {extension_id} from administrative unit {unit_id}.
Remove the open extension {extension_id} on administrative unit {unit_id}.
GET /directory/administrativeUnits/{administrativeUnit-id}/extensions/$count Count open extensions on an administrative unit · Get the number of the resource #
Ask an LLM
“How many open extensions does an administrative unit have?”
“Is there any custom extension data on this administrative unit at all?”
Tell an agent
Count the open extensions on administrative unit {unit_id}.
Tell me the number of extensions attached to administrative unit {unit_id}.
GET /directory/administrativeUnits/{administrativeUnit-id}/members List all members of an administrative unit · List members #
Ask an LLM
“Which users, groups and devices belong to an administrative unit?”
“Can I see the full member objects of an administrative unit, not just references?”
Tell an agent
List every member of administrative unit {unit_id} with full details.
Show the users, groups and devices in administrative unit {unit_id}.
POST /directory/administrativeUnits/{administrativeUnit-id}/members Create a new member inside an administrative unit · Add a member #
Ask an LLM
“Can I create a brand-new user or group directly inside an administrative unit?”
“How do I add a new directory object as a member of an administrative unit in one step?”
Tell an agent
Create a new member object inside administrative unit {unit_id}.
Add directory object {object_id} as a new member object of administrative unit {unit_id}.
DELETE /directory/administrativeUnits/{administrativeUnit-id}/members/{directoryObject-id}/$ref Remove a specific member from an administrative unit · Remove a member #
Ask an LLM
“How do I take one user out of an administrative unit by their object id?”
“Does removing someone from an administrative unit delete their account?”
Tell an agent destructive · confirm first
Remove member {member_id} from administrative unit {unit_id}.
Take directory object {member_id} out of administrative unit {unit_id} using its path id.
GET /directory/administrativeUnits/{administrativeUnit-id}/members/{directoryObject-id}/microsoft.graph.application Get an administrative unit member as an application · Get the item of type microsoft.graph.directoryObject as… #
Ask an LLM
“Can I read a member of an administrative unit as an application object?”
“What application details does a given administrative unit member have?”
Tell an agent
Get member {member_id} of administrative unit {unit_id} cast as an application.
Show the application properties of member {member_id} in administrative unit {unit_id}.
GET /directory/administrativeUnits/{administrativeUnit-id}/members/{directoryObject-id}/microsoft.graph.device Get an administrative unit member as a device · Get the item of type microsoft.graph.directoryObject as microsoft.graph.device #
Ask an LLM
“Can I read a member of an administrative unit as a device?”
“What device details does a particular administrative unit member have?”
Tell an agent
Get member {member_id} of administrative unit {unit_id} cast as a device.
Show the device properties of member {member_id} in administrative unit {unit_id}.
GET /directory/administrativeUnits/{administrativeUnit-id}/members/{directoryObject-id}/microsoft.graph.group Get an administrative unit member as a group · Get the item of type microsoft.graph.directoryObject as microsoft.graph.group #
Ask an LLM
“Can I read a member of an administrative unit as a group object?”
“What group details does a specific administrative unit member have?”
Tell an agent
Get member {member_id} of administrative unit {unit_id} cast as a group.
Show the group properties of member {member_id} in administrative unit {unit_id}.
GET /directory/administrativeUnits/{administrativeUnit-id}/members/{directoryObject-id}/microsoft.graph.orgContact Get an administrative unit member as an org contact · Get the item of type microsoft.graph.directoryObject as… #
Ask an LLM
“Can I read a member of an administrative unit as an organizational contact?”
“What contact details does an org contact in an administrative unit have?”
Tell an agent
Get member {member_id} of administrative unit {unit_id} cast as an org contact.
Show the organizational contact properties of member {member_id} in administrative unit {unit_id}.
GET /directory/administrativeUnits/{administrativeUnit-id}/members/{directoryObject-id}/microsoft.graph.servicePrincipal Get an administrative unit member as a service principal · Get the item of type microsoft.graph.directoryObject as… #
Ask an LLM
“Can I read a member of an administrative unit as a service principal?”
“What service principal details does a given administrative unit member have?”
Tell an agent
Get member {member_id} of administrative unit {unit_id} cast as a service principal.
Show the service principal properties of member {member_id} in administrative unit {unit_id}.
GET /directory/administrativeUnits/{administrativeUnit-id}/members/{directoryObject-id}/microsoft.graph.user Get an administrative unit member as a user · Get the item of type microsoft.graph.directoryObject as microsoft.graph.user #
Ask an LLM
“Can I read a member of an administrative unit as a user with their user properties?”
“What user profile details does a specific administrative unit member have?”
Tell an agent
Get member {member_id} of administrative unit {unit_id} cast as a user.
Show the user profile of member {member_id} in administrative unit {unit_id}.
GET /directory/administrativeUnits/{administrativeUnit-id}/members/$count Count all members of an administrative unit · Get the number of the resource #
Ask an LLM
“How many members of any type are in an administrative unit?”
“What's the total headcount of an administrative unit?”
Tell an agent
Count all members of administrative unit {unit_id}.
Tell me the total number of objects in administrative unit {unit_id}.
GET /directory/administrativeUnits/{administrativeUnit-id}/members/$ref List member references of an administrative unit · List members #
Ask an LLM
“Can I get just the reference links to the members of an administrative unit?”
“Which object ids are members of an administrative unit, without their full properties?”
Tell an agent
List the member references ($ref) of administrative unit {unit_id}.
Give me only the member object links for administrative unit {unit_id}.
POST /directory/administrativeUnits/{administrativeUnit-id}/members/$ref Add an existing object to an administrative unit · Add a member #
Ask an LLM
“How do I add an existing user, group or device to an administrative unit?”
“Can I add more than one member to an administrative unit per request?”
Tell an agent
Add the existing object at {object_ref} to administrative unit {unit_id}.
Link directory object reference {object_ref} as a member of administrative unit {unit_id}.
DELETE /directory/administrativeUnits/{administrativeUnit-id}/members/$ref Remove a member from an administrative unit by reference · Remove a member #
Ask an LLM
“Can I remove a member from an administrative unit by passing its reference URL as a query parameter?”
“What's the query-string way to unlink someone from an administrative unit?”
Tell an agent destructive · confirm first
Remove the member referenced by {member_ref} from administrative unit {unit_id} using the @id query parameter.
Unlink the object at reference {member_ref} from administrative unit {unit_id}.
GET /directory/administrativeUnits/{administrativeUnit-id}/members/microsoft.graph.application List application members of an administrative unit · Get the items of type microsoft.graph.application in the… #
Ask an LLM
“Which applications are members of an administrative unit?”
“Can I filter an administrative unit's members down to applications only?”
Tell an agent
List only the applications in administrative unit {unit_id}.
Show the app registrations that belong to administrative unit {unit_id}.
GET /directory/administrativeUnits/{administrativeUnit-id}/members/microsoft.graph.application/$count Count application members of an administrative unit · Get the number of the resource #
Ask an LLM
“How many applications are in an administrative unit?”
“Does this administrative unit contain any applications at all?”
Tell an agent
Count the applications in administrative unit {unit_id}.
Tell me how many app members administrative unit {unit_id} has.
GET /directory/administrativeUnits/{administrativeUnit-id}/members/microsoft.graph.device List device members of an administrative unit · Get the items of type microsoft.graph.device in the… #
Ask an LLM
“Which devices are members of an administrative unit?”
“Can I list only the laptops and phones scoped into an administrative unit?”
Tell an agent
List only the devices in administrative unit {unit_id}.
Show the device members that belong to administrative unit {unit_id}.
GET /directory/administrativeUnits/{administrativeUnit-id}/members/microsoft.graph.device/$count Count device members of an administrative unit · Get the number of the resource #
Ask an LLM
“How many devices are in an administrative unit?”
“Does an administrative unit have any devices assigned?”
Tell an agent
Count the devices in administrative unit {unit_id}.
Tell me how many device members administrative unit {unit_id} has.
GET /directory/administrativeUnits/{administrativeUnit-id}/members/microsoft.graph.group List group members of an administrative unit · Get the items of type microsoft.graph.group in the… #
Ask an LLM
“Which groups are members of an administrative unit?”
“Can I see only the groups scoped into an administrative unit?”
Tell an agent
List only the groups in administrative unit {unit_id}.
Show the group members that belong to administrative unit {unit_id}.
GET /directory/administrativeUnits/{administrativeUnit-id}/members/microsoft.graph.group/$count Count group members of an administrative unit · Get the number of the resource #
Ask an LLM
“How many groups are in an administrative unit?”
“Does an administrative unit include any groups?”
Tell an agent
Count the groups in administrative unit {unit_id}.
Tell me how many group members administrative unit {unit_id} has.
GET /directory/administrativeUnits/{administrativeUnit-id}/members/microsoft.graph.orgContact List org contact members of an administrative unit · Get the items of type microsoft.graph.orgContact in the… #
Ask an LLM
“Which organizational contacts are members of an administrative unit?”
“Can I list only the external contacts in an administrative unit?”
Tell an agent
List only the org contacts in administrative unit {unit_id}.
Show the organizational contact members of administrative unit {unit_id}.
GET /directory/administrativeUnits/{administrativeUnit-id}/members/microsoft.graph.orgContact/$count Count org contact members of an administrative unit · Get the number of the resource #
Ask an LLM
“How many organizational contacts are in an administrative unit?”
“Are there any org contacts in this administrative unit?”
Tell an agent
Count the org contacts in administrative unit {unit_id}.
Tell me how many organizational contact members administrative unit {unit_id} has.
GET /directory/administrativeUnits/{administrativeUnit-id}/members/microsoft.graph.servicePrincipal List service principal members of an administrative unit · Get the items of type microsoft.graph.servicePrincipal in the… #
Ask an LLM
“Which service principals are members of an administrative unit?”
“Can I list only the enterprise apps scoped into an administrative unit?”
Tell an agent
List only the service principals in administrative unit {unit_id}.
Show the service principal members of administrative unit {unit_id}.
GET /directory/administrativeUnits/{administrativeUnit-id}/members/microsoft.graph.servicePrincipal/$count Count service principal members of an administrative unit · Get the number of the resource #
Ask an LLM
“How many service principals are in an administrative unit?”
“Does an administrative unit hold any service principals?”
Tell an agent
Count the service principals in administrative unit {unit_id}.
Tell me how many service principal members administrative unit {unit_id} has.
GET /directory/administrativeUnits/{administrativeUnit-id}/members/microsoft.graph.user List user members of an administrative unit · Get the items of type microsoft.graph.user in the… #
Ask an LLM
“Which people are members of an administrative unit?”
“Can I list only the user accounts in an administrative unit, leaving out groups and devices?”
Tell an agent
List only the users in administrative unit {unit_id}.
Show the user accounts that belong to administrative unit {unit_id}.
GET /directory/administrativeUnits/{administrativeUnit-id}/members/microsoft.graph.user/$count Count user members of an administrative unit · Get the number of the resource #
Ask an LLM
“How many users are in an administrative unit?”
“What's the number of people assigned to an administrative unit?”
Tell an agent
Count the users in administrative unit {unit_id}.
Tell me how many user members administrative unit {unit_id} has.
GET /directory/administrativeUnits/{administrativeUnit-id}/scopedRoleMembers List role assignments scoped to an administrative unit · List scopedRoleMembers #
Ask an LLM
“Who has an admin role scoped to a particular administrative unit?”
“Which Microsoft Entra role assignments are limited to an administrative unit?”
Tell an agent
List the scoped role members of administrative unit {unit_id}.
Show every role assignment scoped to administrative unit {unit_id}.
POST /directory/administrativeUnits/{administrativeUnit-id}/scopedRoleMembers Assign a role scoped to an administrative unit · Add a scopedRoleMember #
Ask an LLM
“How do I make someone a User Administrator only over one administrative unit?”
“Can I delegate a Microsoft Entra role to just the members of an administrative unit?”
Tell an agent
Assign role {role_id} scoped to administrative unit {unit_id}.
Grant role {role_id} over administrative unit {unit_id} to the member described by {member_info}.
GET /directory/administrativeUnits/{administrativeUnit-id}/scopedRoleMembers/{scopedRoleMembership-id} Get one scoped role assignment on an administrative unit · Get a scopedRoleMember #
Ask an LLM
“What role and member does a specific scoped role assignment on an administrative unit hold?”
“Can I look up one scoped role membership by its id?”
Tell an agent
Get scoped role membership {membership_id} on administrative unit {unit_id}.
Show which role and person scoped role assignment {membership_id} in administrative unit {unit_id} covers.
PATCH /directory/administrativeUnits/{administrativeUnit-id}/scopedRoleMembers/{scopedRoleMembership-id} Update a scoped role assignment on an administrative unit · Update the navigation property scopedRoleMembers in directory #
Ask an LLM
“Can I change which role an existing scoped role assignment grants?”
“How do I edit a scoped role membership that's already on an administrative unit?”
Tell an agent
Change scoped role membership {membership_id} on administrative unit {unit_id} to role {role_id}.
Update the member info of scoped role assignment {membership_id} in administrative unit {unit_id} to {member_info}.
DELETE /directory/administrativeUnits/{administrativeUnit-id}/scopedRoleMembers/{scopedRoleMembership-id} Remove a role assignment scoped to an administrative unit · Remove a scopedRoleMember #
Ask an LLM
“How do I revoke someone's admin role over a single administrative unit?”
“Can I remove a scoped role assignment without affecting their tenant-wide roles?”
Tell an agent destructive · confirm first
Remove scoped role membership {membership_id} from administrative unit {unit_id}.
Revoke the scoped role assignment {membership_id} on administrative unit {unit_id}.
GET /directory/administrativeUnits/{administrativeUnit-id}/scopedRoleMembers/$count Count scoped role assignments on an administrative unit · Get the number of the resource #
Ask an LLM
“How many scoped admin role assignments does an administrative unit have?”
“Are any roles delegated over this administrative unit?”
Tell an agent
Count the scoped role members of administrative unit {unit_id}.
Tell me how many role assignments are scoped to administrative unit {unit_id}.
GET /directory/administrativeUnits/$count Count administrative units in the directory · Get the number of the resource #
Ask an LLM
“How many administrative units does our tenant have?”
“What's the total number of administrative units in the directory?”
Tell an agent
Count the administrative units in the directory.
Tell me how many administrative units exist tenant-wide.
GET /directory/administrativeUnits/microsoft.graph.delta() Track changes to administrative units · Invoke function delta #
Ask an LLM
“Which administrative units were added, changed or deleted since my last sync?”
“Can I get incremental changes to administrative units instead of re-reading them all?”
Tell an agent
Get the delta of administrative unit changes since the last sync.
Start a delta query to track new, updated and deleted administrative units.

Documentation

📖
Documentation
https://learn.microsoft.com/en-us/graph/api/overview
📖
Authentication
https://learn.microsoft.com/en-us/graph/auth/
📖
Documentation
https://learn.microsoft.com/en-us/graph/change-notifications-overview

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/azure-ad/refs/heads/main/openapi/azure-ad-directory-administrativeunit-api-openapi.yml

Other Resources

🔗
SDKs
https://learn.microsoft.com/en-us/graph/sdks/sdks-overview
🔗
ChangeLog
https://developer.microsoft.com/en-us/graph/changelog
🔗
Webhooks
https://raw.githubusercontent.com/api-evangelist/azure-ad/refs/heads/main/asyncapi/azure-ad-change-notifications-webhooks.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/azure-ad:azure-ad-directory-administrativeunit-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

azure-ad-directory-administrativeunit-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Identity.DirectoryManagement Directory.administrative Unit…
  version: v1.0
servers:
- url: https://graph.microsoft.com/v1.0/
  description: Core
security:
- azureaadv2: []
tags:


# --- truncated at 32 KB (922 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/azure-ad/refs/heads/main/openapi/azure-ad-directory-administrativeunit-api-openapi.yml