Use Microsoft Entra ID actions in Siit

Before you start

• Microsoft Entra ID is connected to your workspace. If it is not, follow Connect Microsoft Entra ID with Siit first.
• Your Siit role is allowed to run Entra actions. This is set on the integration, see "Who can run these actions?" below.
• The person you are acting on has a matching Entra account in Siit. Siit resolves the account on the person's primary email.

Which actions are available?

All of them except Open profile in Entra ID can also run inside a Workflow or an AI agent playbook.

How do I run an action from a request?

1. Open the request in the admin console.
2. In the side panel, find the Microsoft Entra ID block for the requester.
3. Open the Actions menu.
4. Pick your action, for example Clear user sessions.
5. Confirm.

The action runs straight away against your tenant, and the request timeline records what was done and by whom. That timeline entry is your audit trail, so there is no separate log to keep.

How do I use Entra actions in a Workflow?

1. Go to Workflows and create or edit a workflow.
2. Click + on the canvas to add a step.
3. In the action panel on the right, open the Microsoft Entra section.
4. Pick the action you need.
5. Fill in the configuration. Group actions ask which groups to target.
6. Save, then set the workflow live.

Example: close the account on the last working day

1. Trigger: People trigger, End date.
2. Action: Microsoft Entra, Clear user sessions.
3. Action: Microsoft Entra, Remove user from groups.
4. Action: Microsoft Entra, Suspend user.
5. Action: send a message to the manager confirming the account is closed.

Nobody opens the Microsoft admin center, and the leaver's access is gone on the day it should be.

Example: handle a compromised account

1. Trigger: Request submitted, on your "Report a compromised account" service.
2. Action: Microsoft Entra, Clear user sessions.
3. Action: Microsoft Entra, Force password change.
4. Action: set the request priority to Urgent and assign it to your security inbox.

Clear sessions first, then force the password change. The other way round leaves the attacker's existing session alive until it expires.

How do I use them with an AI agent?

Reference the actions as steps in your playbook, and gate the sensitive ones behind an approval:

Step 1: Confirm with the requester that they no longer have access to their account
Step 2: Clear user sessions in Microsoft Entra ID
Step 3: Force password change in Microsoft Entra ID (Approval required)
Step 4: Tell the requester to sign in again and set a new password

The agent asks for approval in Slack or Teams and only continues once it is granted.

Who can run these actions?

Access is controlled on the integration itself, in Settings → Workspace → Integration library → Microsoft Entra ID. Pick which Siit roles are allowed to run Entra actions. Anyone outside those roles will not see the actions in the request side panel.

Treat this like any other privileged access. Suspending an account and clearing sessions are real changes in your directory, and they take effect immediately.

Frequently asked questions

Does suspending a user delete their account or their data?
No. The account is disabled, not deleted. Mailbox, files and group memberships stay as they are, and Unsuspend user brings the account straight back.

What is the difference between clearing sessions and forcing a password change?
Clearing sessions signs the person out of everything they are currently signed in to. Forcing a password change only takes effect the next time they sign in. For a suspected compromise, run both, sessions first.

Will the user be notified?
Siit does not message them on its own. If you want them to know, add a message step in your Workflow or send one from the request. Microsoft may still show its own prompts, for example when a new password is required at sign-in.

Can I undo an action?
Suspend user is reversible with Unsuspend user. Group changes are reversible by adding or removing the user again. Cleared sessions and a forced password change cannot be undone, the user simply signs in again.

Do these actions work on external or guest accounts?
They work on any account Siit has synced from your Entra tenant. Guest accounts are excluded from the sync by default, so they will not appear.

Do I need to reconnect the integration to get these actions?
No. If Entra ID is already connected with the standard permission set, the actions appear on their own.

Is this available on my plan?
Yes, Microsoft Entra ID actions are available on all plans.

Troubleshooting

I don't see the Actions menu on the Entra ID block.
Check that Microsoft Entra ID is connected in Settings → Workspace → Integration library, and that your Siit role is one of the roles allowed to run Entra actions.

The action failed with a permissions error.
A Microsoft Graph permission is missing from the consent granted at install. Reconnect Microsoft Entra ID with a Global Administrator account and grant the full permission set.

The action ran in Siit but nothing changed in Entra.
Check the request timeline for the failure reason. The usual cause is an account protected in Entra, for example a user holding a privileged directory role, which Microsoft blocks from being modified by an application.

I can't find a group in the picker.
The group may be out of the synced scope, or it may be a distribution group, which Microsoft does not allow to be managed programmatically. Check the group type in Entra, and the group scope on the integration.

The person has no Entra ID block in the side panel.
Siit could not match them to an Entra account. Check their primary email in Siit against the account's work email in Entra.