Can AI agents automate Microsoft Entra ID?

Microsoft Entra ID is automatable today through Microsoft Graph. The public REST endpoint at graph.microsoft.com covers tenant users, groups, applications, devices, and related directory operations with create, read, update, and delete. OAuth supports delegated access on behalf of a signed-in admin and unattended app-only client-credentials access. Application permissions always need admin consent. Entra RBAC and sensitive-action role locks still apply to passwords, UPN, enable or disable, and delete. Official Graph SDKs cover C#, Go, Java, JavaScript, PHP, PowerShell, and Python. Graph PowerShell is the strongest command path and is Microsoft's replacement for Azure AD PowerShell and MSOnline. The first-party Microsoft MCP Server for Enterprise is a public-preview, read-only, delegated, global-cloud remote MCP at https://mcp.svc.cloud.microsoft/enterprise. It translates natural language into Graph GETs, is capped at 100 calls per minute per user, and cannot write directory objects. This identity is not on-prem Active Directory Domain Services and not the Microsoft 365 Admin Center. Computer-use viability is unassessed. API scores 9 and is the best path because writes and unattended app-only live there, not on MCP.

Best path today: api · Overall automatability: 9/10