Block Microsoft Entra ID user - Entity trigger

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Content Index


This playbook disables the selected user (account entity) in Microsoft Entra ID. If this playbook triggered from an incident context, it will add a comment to the incident. This playbook will notify the disabled user manager if available. Note: This playbook will not disable admin user!

Attribute Value
Type Playbook
Solution Microsoft Entra ID
Source View on GitHub

Logic App Connectors

This playbook uses 5 Logic App connectors / built-in actions:

Connector / Action Type Connections Actions
azuread Managed 1 2
azuresentinel Managed 1 0
microsoftsentinel Managed 0 3
office365 Managed 1 1
http Built-in 0 1
Action parameters (URLs, paths, function IDs)

azuread (Managed)

Action Method Endpoint Other
Get_user_-_details get /v1.0/users/@{encodeURIComponent(variables('AccountDetails'))}
Update_user_-_disable_user patch /v1.0/users/@{encodeURIComponent(variables('AccountDetails'))}

microsoftsentinel (Managed)

Action Method Endpoint Other
Add_comment_to_incident_-with_manager-_no_admin post /Incidents/Comment
Add_comment_to_incident_-no_manager-_no_admin post /Incidents/Comment
Add_comment_to_incident_-_error_details post /Incidents/Comment

office365 (Managed)

Action Method Endpoint Other
Send_an_email_-to_manager-_no_admin post /v2/Mail

http (Built-in)

Action Method Endpoint Other
HTTP_-_get_user_manager GET https://graph.microsoft.com/v1.0/users/@{variables('AccountDetails')}/manager

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Playbooks · Back to Microsoft Entra ID