Fetch one user by object id or userPrincipalName.

List users with optional $top, $filter, $select, and $orderby.

List tenant subscribed SKUs for license lookup and seat availability.

List groups with optional $top, $filter, $select, and $orderby.

Fetch one group by object id.

List the members of a group.

List the licenses currently assigned to a user.

Create a user with a generated temporary password. Returns the temporary password; store it securely and share out-of-band.

Assign a license to a user. Sets usageLocation first when provided; fails clearly if the user has no usageLocation.

Remove a license from a user.

Add a user to a group. Idempotent when the user is already a member.

Remove a user from a group. Idempotent when the user is not a member.

Set a user usageLocation (required before license assignment).

Update attributes on an existing user (PATCH). Use accountEnabled to enable/disable an existing account (e.g. activate a pre-created hire or disable a leaver). Only provided fields are changed.

Set a user's manager. Provide the manager's object id or userPrincipalName.

Create a Temporary Access Pass (TAP) for passwordless first sign-in / MFA setup. Multi-use by default; regenerated until the passcode is alphanumeric so it is easy to relay. lifetimeInMinutes is bounded by the tenant TAP policy. Returns the passcode; deliver it out-of-band.

Delete a user's Temporary Access Pass. With methodId deletes that pass; otherwise deletes every TAP on the user.

Just-in-time PIM elevation: the delegated caller self-activates one of their own ELIGIBLE directory roles (e.g. Authentication Administrator, needed for Temporary Access Pass) for a bounded window. Requires a delegated token; fails if the caller is not eligible.