Microsoft Entra ID (formerly Azure AD)

Microsoft Entra ID (formerly Azure AD) Directory.directory Object API

The directory.directoryObject API from Microsoft Entra ID (formerly Azure AD) — 29 operation(s) for directory.directoryobject.

GitHub OpenAPI
Business capability
Identity & Access Management BC-620.20

Operations 30

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /directory/deletedItems List recently deleted directory objects · Get deleted item (directory object) #
Ask an LLM
“What directory objects have been deleted recently in my Entra tenant?”
“Can I search the deleted items bin across every object type at once?”
Tell an agent
List everything currently sitting in the directory's deleted items.
Search all deleted directory objects for {term}.
GET /directory/deletedItems/{directoryObject-id} Get a deleted directory object · Get deleted item (directory object) #
Ask an LLM
“What did a soft-deleted directory object look like before it was removed?”
“Can I look up one deleted object by ID without knowing whether it was a user or a group?”
Tell an agent
Show deleted directory object {object_id}.
Fetch the properties of recently deleted item {object_id} regardless of its type.
DELETE /directory/deletedItems/{directoryObject-id} Permanently delete an object from deleted items · Permanently delete item (directory object) #
Ask an LLM
“How do I purge something from deleted items so it can never be restored?”
“Can I hard-delete a soft-deleted application right now?”
Tell an agent destructive · confirm first
Permanently delete {object_id} from deleted items.
Purge soft-deleted object {object_id} for good so nobody can bring it back.
GET /directory/deletedItems/{directoryObject-id}/microsoft.graph.administrativeUnit Get a deleted administrative unit · Get the item of type microsoft.graph.directoryObject as… #
Ask an LLM
“What were the settings of an administrative unit someone removed?”
“Can I read a deleted item typed as an administrative unit?”
Tell an agent
Show the removed administrative unit {object_id}.
Get deleted item {object_id} cast as an administrative unit.
GET /directory/deletedItems/{directoryObject-id}/microsoft.graph.application Get a deleted app registration · Get the item of type microsoft.graph.directoryObject as… #
Ask an LLM
“What was configured on an app registration that got deleted?”
“Can I see the application properties of one soft-deleted app before restoring it?”
Tell an agent
Show the deleted app registration {object_id}.
Get deleted item {object_id} as an application object.
POST /directory/deletedItems/{directoryObject-id}/microsoft.graph.checkMemberGroups Check a deleted object's membership in given groups · Invoke action checkMemberGroups #
Ask an LLM
“Which of a handful of groups was a deleted object a member of?”
“Can I test a soft-deleted object against a specific list of group IDs?”
Tell an agent
Check whether deleted object {object_id} belongs to any of the groups {group_ids}.
Tell me which of these groups deleted item {object_id} was in: {group_ids}.
POST /directory/deletedItems/{directoryObject-id}/microsoft.graph.checkMemberObjects Check a deleted object against directory object IDs · Invoke action checkMemberObjects #
Ask an LLM
“Was a deleted object a member of certain groups, admin units or directory roles?”
“Can I check a deleted item against a mixed list of object IDs, not just groups?”
Tell an agent
Check deleted object {object_id} for membership in the objects {ids}.
Run checkMemberObjects on deleted item {object_id}.
GET /directory/deletedItems/{directoryObject-id}/microsoft.graph.device Get a deleted device · Get the item of type microsoft.graph.directoryObject as microsoft.graph.device #
Ask an LLM
“What do I know about a device record that was removed from the directory?”
“Can I read a soft-deleted item as a device object?”
Tell an agent
Show the deleted device {object_id}.
Get deleted item {object_id} cast as a device.
POST /directory/deletedItems/{directoryObject-id}/microsoft.graph.getMemberGroups List every group a deleted object belonged to · Invoke action getMemberGroups #
Ask an LLM
“What groups was a deleted user or service principal a member of?”
“Can I limit a deleted object's group memberships to security groups only?”
Tell an agent
Get all group IDs that deleted object {object_id} is a member of.
List groups for deleted item {object_id} with security-enabled only set to {security_only}.
POST /directory/deletedItems/{directoryObject-id}/microsoft.graph.getMemberObjects List groups, admin units and roles of a deleted object · Invoke action getMemberObjects #
Ask an LLM
“Which groups, administrative units and directory roles did a deleted object hold?”
“Can I recover a full membership picture for a soft-deleted account before restoring it?”
Tell an agent
Get the member objects of deleted item {object_id}, including admin units and directory roles.
List memberships of deleted object {object_id} with security-enabled only {security_only}.
GET /directory/deletedItems/{directoryObject-id}/microsoft.graph.group Get a deleted group · List deletedItems (directory objects) #
Ask an LLM
“What were the details of a Microsoft 365 or security group that was deleted?”
“Can I read a soft-deleted item as a group object?”
Tell an agent
Show the deleted group {object_id}.
Get deleted item {object_id} cast as a group.
POST /directory/deletedItems/{directoryObject-id}/microsoft.graph.restore Restore a deleted directory object · Invoke action restore #
Ask an LLM
“How do I undelete a user or group that was removed by mistake?”
“Can I bring back an app registration from deleted items?”
Tell an agent
Restore deleted object {object_id}.
Undo the deletion of {object_id} and put it back in the directory.
GET /directory/deletedItems/{directoryObject-id}/microsoft.graph.servicePrincipal Get a deleted service principal · Get the item of type microsoft.graph.directoryObject as… #
Ask an LLM
“What was set on an enterprise app's service principal that got deleted?”
“Can I read a soft-deleted item as a service principal?”
Tell an agent
Show the deleted service principal {object_id}.
Get deleted item {object_id} cast as a service principal.
GET /directory/deletedItems/{directoryObject-id}/microsoft.graph.user Get a deleted user · Get the item of type microsoft.graph.directoryObject as microsoft.graph.user #
Ask an LLM
“What were the account details of an employee who was deleted?”
“Can I read a soft-deleted item as a user object?”
Tell an agent
Show the deleted user {object_id}.
Get deleted item {object_id} cast as a user.
GET /directory/deletedItems/$count Count all deleted directory objects · Get the number of the resource #
Ask an LLM
“How many objects of any kind are in the deleted items bin?”
“What's the total number of soft-deleted objects matching a filter?”
Tell an agent
Count all deleted directory objects.
Count deleted items that match {filter}.
GET /directory/deletedItems/microsoft.graph.administrativeUnit List deleted administrative units · Get the items of type microsoft.graph.administrativeUnit in the… #
Ask an LLM
“Which administrative units have been deleted lately?”
“Can I see only the administrative units in the recycle bin?”
Tell an agent
List deleted administrative units.
Find deleted administrative units named like {term}.
GET /directory/deletedItems/microsoft.graph.administrativeUnit/$count Count deleted administrative units · Get the number of the resource #
Ask an LLM
“How many administrative units are waiting in deleted items?”
“What number of removed admin units match a given filter?”
Tell an agent
Count the deleted administrative units.
Count deleted admin units matching {filter}.
GET /directory/deletedItems/microsoft.graph.application List deleted app registrations · Get the items of type microsoft.graph.application in the… #
Ask an LLM
“Which app registrations were deleted and can still be restored?”
“Can I filter the deleted applications by display name?”
Tell an agent
List deleted app registrations.
Show deleted applications matching {filter}.
GET /directory/deletedItems/microsoft.graph.application/$count Count deleted app registrations · Get the number of the resource #
Ask an LLM
“How many app registrations are sitting in deleted items?”
“What's the count of soft-deleted applications that match a search?”
Tell an agent
Count the deleted applications.
Count deleted app registrations that match {term}.
GET /directory/deletedItems/microsoft.graph.device List deleted devices · Get the items of type microsoft.graph.device in the… #
Ask an LLM
“Which device records have been removed from the directory recently?”
“Can I narrow the deleted devices down with a filter?”
Tell an agent
List deleted devices.
Show deleted devices matching {filter}.
GET /directory/deletedItems/microsoft.graph.device/$count Count deleted devices · Get the number of the resource #
Ask an LLM
“How many devices are in the deleted items bin right now?”
“What number of deleted device records match a filter?”
Tell an agent
Count the deleted devices.
Count deleted device records matching {filter}.
POST /directory/deletedItems/microsoft.graph.getAvailableExtensionProperties List registered directory extension properties · Invoke action getAvailableExtensionProperties #
Ask an LLM
“What directory extension attributes are registered in my tenant, including by multitenant apps?”
“Can I see only the extension properties synced from on-premises?”
Tell an agent
List all available directory extension properties via deleted items.
Get extension property definitions where synced from on-premises is {synced}.
POST /directory/deletedItems/microsoft.graph.getByIds Fetch directory objects by a list of IDs · Invoke action getByIds #
Ask an LLM
“How can I resolve a batch of object IDs to users, groups or devices in one request?”
“Can I restrict an ID lookup to certain object types?”
Tell an agent
Look up the directory objects with IDs {ids}.
Resolve IDs {ids} but only return objects of types {types}.
GET /directory/deletedItems/microsoft.graph.group List deleted groups · List deletedItems (directory objects) #
Ask an LLM
“Which groups have been deleted and are still recoverable?”
“Can I search deleted groups by name?”
Tell an agent
List deleted groups.
Search deleted groups for {term}.
GET /directory/deletedItems/microsoft.graph.group/$count Count deleted groups · Get the number of the resource #
Ask an LLM
“How many groups are in deleted items?”
“What's the number of deleted groups that match a filter?”
Tell an agent
Count the deleted groups.
Count deleted groups matching {filter}.
GET /directory/deletedItems/microsoft.graph.servicePrincipal List deleted service principals · Get the items of type microsoft.graph.servicePrincipal in the… #
Ask an LLM
“Which enterprise app service principals were deleted recently?”
“Can I filter deleted service principals by app ID?”
Tell an agent
List deleted service principals.
Show deleted service principals matching {filter}.
GET /directory/deletedItems/microsoft.graph.servicePrincipal/$count Count deleted service principals · Get the number of the resource #
Ask an LLM
“How many service principals are waiting in the recycle bin?”
“What number of deleted service principals match a search term?”
Tell an agent
Count the deleted service principals.
Count deleted service principals that match {term}.
GET /directory/deletedItems/microsoft.graph.user List deleted users · Get the items of type microsoft.graph.user in the… #
Ask an LLM
“Which user accounts were deleted in the last few weeks?”
“Can I search deleted users by display name or email?”
Tell an agent
List deleted users.
Search deleted user accounts for {term}.
GET /directory/deletedItems/microsoft.graph.user/$count Count deleted users · Get the number of the resource #
Ask an LLM
“How many user accounts are in deleted items?”
“What's the count of deleted users that match a filter?”
Tell an agent
Count the deleted users.
Count deleted user accounts matching {filter}.
POST /directory/deletedItems/microsoft.graph.validateProperties Check a group name against naming policy · Invoke action validateProperties #
Ask an LLM
“Will a Microsoft 365 group display name pass my tenant's naming policy?”
“Can I check whether a mail nickname contains blocked words before creating the group?”
Tell an agent
Validate display name {display_name} and mail nickname {nickname} for a group.
Check {display_name} against the group naming policy on behalf of user {user_id}.

Documentation

📖
Documentation
https://learn.microsoft.com/en-us/graph/api/overview
📖
Authentication
https://learn.microsoft.com/en-us/graph/auth/
📖
Documentation
https://learn.microsoft.com/en-us/graph/change-notifications-overview

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/azure-ad/refs/heads/main/openapi/azure-ad-directory-directoryobject-api-openapi.yml

Other Resources

🔗
SDKs
https://learn.microsoft.com/en-us/graph/sdks/sdks-overview
🔗
ChangeLog
https://developer.microsoft.com/en-us/graph/changelog
🔗
Webhooks
https://raw.githubusercontent.com/api-evangelist/azure-ad/refs/heads/main/asyncapi/azure-ad-change-notifications-webhooks.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/azure-ad:azure-ad-directory-directoryobject-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

azure-ad-directory-directoryobject-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Identity.DirectoryManagement Directory.directory Object API
  version: v1.0
servers:
- url: https://graph.microsoft.com/v1.0/
  description: Core
security:
- azureaadv2: []
tags:


# --- truncated at 32 KB (887 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/azure-ad/refs/heads/main/openapi/azure-ad-directory-directoryobject-api-openapi.yml