chore: import upstream snapshot with attribution

apps/sim/tools/microsoft_ad/add_group_member.ts

@@ -0,0 +1,74 @@
+import type {
+  MicrosoftAdAddGroupMemberParams,
+  MicrosoftAdAddGroupMemberResponse,
+} from '@/tools/microsoft_ad/types'
+import type { ToolConfig } from '@/tools/types'
+
+export const addGroupMemberTool: ToolConfig<
+  MicrosoftAdAddGroupMemberParams,
+  MicrosoftAdAddGroupMemberResponse
+> = {
+  id: 'microsoft_ad_add_group_member',
+  name: 'Add Azure AD Group Member',
+  description: 'Add a member to a group in Azure AD (Microsoft Entra ID)',
+  version: '1.0.0',
+  errorExtractor: 'nested-error-object',
+  oauth: {
+    required: true,
+    provider: 'microsoft-ad',
+  },
+  params: {
+    accessToken: {
+      type: 'string',
+      required: true,
+      visibility: 'hidden',
+      description: 'Microsoft Graph API access token',
+    },
+    groupId: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'Group ID',
+    },
+    memberId: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'User ID of the member to add',
+    },
+  },
+  request: {
+    url: (params) => {
+      const groupId = params.groupId?.trim()
+      if (!groupId) throw new Error('Group ID is required')
+      return `https://graph.microsoft.com/v1.0/groups/${encodeURIComponent(groupId)}/members/$ref`
+    },
+    method: 'POST',
+    headers: (params) => ({
+      Authorization: `Bearer ${params.accessToken}`,
+      'Content-Type': 'application/json',
+    }),
+    body: (params) => {
+      const memberId = params.memberId?.trim()
+      if (!memberId) throw new Error('Member ID is required')
+      return {
+        '@odata.id': `https://graph.microsoft.com/v1.0/directoryObjects/${memberId}`,
+      }
+    },
+  },
+  transformResponse: async (_response: Response, params?: MicrosoftAdAddGroupMemberParams) => {
+    return {
+      success: true,
+      output: {
+        added: true,
+        groupId: params?.groupId ?? '',
+        memberId: params?.memberId ?? '',
+      },
+    }
+  },
+  outputs: {
+    added: { type: 'boolean', description: 'Whether the member was added successfully' },
+    groupId: { type: 'string', description: 'Group ID' },
+    memberId: { type: 'string', description: 'Member ID that was added' },
+  },
+}

apps/sim/tools/microsoft_ad/create_group.ts

@@ -0,0 +1,120 @@
+import type {
+  MicrosoftAdCreateGroupParams,
+  MicrosoftAdCreateGroupResponse,
+} from '@/tools/microsoft_ad/types'
+import { GROUP_OUTPUT_PROPERTIES } from '@/tools/microsoft_ad/types'
+import type { ToolConfig } from '@/tools/types'
+
+export const createGroupTool: ToolConfig<
+  MicrosoftAdCreateGroupParams,
+  MicrosoftAdCreateGroupResponse
+> = {
+  id: 'microsoft_ad_create_group',
+  name: 'Create Azure AD Group',
+  description: 'Create a new group in Azure AD (Microsoft Entra ID)',
+  version: '1.0.0',
+  errorExtractor: 'nested-error-object',
+  oauth: {
+    required: true,
+    provider: 'microsoft-ad',
+  },
+  params: {
+    accessToken: {
+      type: 'string',
+      required: true,
+      visibility: 'hidden',
+      description: 'Microsoft Graph API access token',
+    },
+    displayName: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'Display name for the group',
+    },
+    mailNickname: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'Mail alias for the group (ASCII only, max 64 characters)',
+    },
+    description: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Group description',
+    },
+    mailEnabled: {
+      type: 'boolean',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'Whether mail is enabled (true for Microsoft 365 groups)',
+    },
+    securityEnabled: {
+      type: 'boolean',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'Whether security is enabled (true for security groups)',
+    },
+    groupTypes: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Group type: "Unified" for Microsoft 365 group, leave empty for security group',
+    },
+    visibility: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description:
+        'Group visibility: "Private" or "Public" (can be changed later), or "HiddenMembership" (Microsoft 365 groups only; can only be set at creation and never changed afterward)',
+    },
+  },
+  request: {
+    url: 'https://graph.microsoft.com/v1.0/groups',
+    method: 'POST',
+    headers: (params) => ({
+      Authorization: `Bearer ${params.accessToken}`,
+      'Content-Type': 'application/json',
+    }),
+    body: (params) => {
+      const body: Record<string, unknown> = {
+        displayName: params.displayName,
+        mailNickname: params.mailNickname,
+        mailEnabled: params.mailEnabled,
+        securityEnabled: params.securityEnabled,
+      }
+      if (params.description) body.description = params.description
+      if (params.groupTypes) body.groupTypes = [params.groupTypes]
+      else body.groupTypes = []
+      if (params.visibility) body.visibility = params.visibility
+      return body
+    },
+  },
+  transformResponse: async (response: Response) => {
+    const group = await response.json()
+    return {
+      success: true,
+      output: {
+        group: {
+          id: group.id ?? null,
+          displayName: group.displayName ?? null,
+          description: group.description ?? null,
+          mail: group.mail ?? null,
+          mailEnabled: group.mailEnabled ?? null,
+          mailNickname: group.mailNickname ?? null,
+          securityEnabled: group.securityEnabled ?? null,
+          groupTypes: group.groupTypes ?? [],
+          visibility: group.visibility ?? null,
+          createdDateTime: group.createdDateTime ?? null,
+        },
+      },
+    }
+  },
+  outputs: {
+    group: {
+      type: 'object',
+      description: 'Created group details',
+      properties: GROUP_OUTPUT_PROPERTIES,
+    },
+  },
+}

apps/sim/tools/microsoft_ad/create_user.ts

@@ -0,0 +1,150 @@
+import type {
+  MicrosoftAdCreateUserParams,
+  MicrosoftAdCreateUserResponse,
+} from '@/tools/microsoft_ad/types'
+import { USER_OUTPUT_PROPERTIES } from '@/tools/microsoft_ad/types'
+import type { ToolConfig } from '@/tools/types'
+
+export const createUserTool: ToolConfig<
+  MicrosoftAdCreateUserParams,
+  MicrosoftAdCreateUserResponse
+> = {
+  id: 'microsoft_ad_create_user',
+  name: 'Create Azure AD User',
+  description: 'Create a new user in Azure AD (Microsoft Entra ID)',
+  version: '1.0.0',
+  errorExtractor: 'nested-error-object',
+  oauth: {
+    required: true,
+    provider: 'microsoft-ad',
+  },
+  params: {
+    accessToken: {
+      type: 'string',
+      required: true,
+      visibility: 'hidden',
+      description: 'Microsoft Graph API access token',
+    },
+    displayName: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'Display name for the user',
+    },
+    mailNickname: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'Mail alias for the user',
+    },
+    userPrincipalName: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'User principal name (e.g., "user@example.com")',
+    },
+    password: {
+      type: 'string',
+      required: true,
+      visibility: 'user-only',
+      description: 'Initial password for the user',
+    },
+    accountEnabled: {
+      type: 'boolean',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'Whether the account is enabled',
+    },
+    givenName: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'First name',
+    },
+    surname: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Last name',
+    },
+    jobTitle: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Job title',
+    },
+    department: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Department',
+    },
+    officeLocation: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Office location',
+    },
+    mobilePhone: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Mobile phone number',
+    },
+  },
+  request: {
+    url: 'https://graph.microsoft.com/v1.0/users?$select=id,displayName,givenName,surname,userPrincipalName,mail,jobTitle,department,officeLocation,mobilePhone,accountEnabled',
+    method: 'POST',
+    headers: (params) => ({
+      Authorization: `Bearer ${params.accessToken}`,
+      'Content-Type': 'application/json',
+    }),
+    body: (params) => {
+      const body: Record<string, unknown> = {
+        accountEnabled: params.accountEnabled,
+        displayName: params.displayName,
+        mailNickname: params.mailNickname,
+        userPrincipalName: params.userPrincipalName,
+        passwordProfile: {
+          password: params.password,
+          forceChangePasswordNextSignIn: true,
+        },
+      }
+      if (params.givenName) body.givenName = params.givenName
+      if (params.surname) body.surname = params.surname
+      if (params.jobTitle) body.jobTitle = params.jobTitle
+      if (params.department) body.department = params.department
+      if (params.officeLocation) body.officeLocation = params.officeLocation
+      if (params.mobilePhone) body.mobilePhone = params.mobilePhone
+      return body
+    },
+  },
+  transformResponse: async (response: Response) => {
+    const user = await response.json()
+    return {
+      success: true,
+      output: {
+        user: {
+          id: user.id ?? null,
+          displayName: user.displayName ?? null,
+          givenName: user.givenName ?? null,
+          surname: user.surname ?? null,
+          userPrincipalName: user.userPrincipalName ?? null,
+          mail: user.mail ?? null,
+          jobTitle: user.jobTitle ?? null,
+          department: user.department ?? null,
+          officeLocation: user.officeLocation ?? null,
+          mobilePhone: user.mobilePhone ?? null,
+          accountEnabled: user.accountEnabled ?? null,
+        },
+      },
+    }
+  },
+  outputs: {
+    user: {
+      type: 'object',
+      description: 'Created user details',
+      properties: USER_OUTPUT_PROPERTIES,
+    },
+  },
+}

apps/sim/tools/microsoft_ad/delete_group.ts

@@ -0,0 +1,59 @@
+import type {
+  MicrosoftAdDeleteGroupParams,
+  MicrosoftAdDeleteGroupResponse,
+} from '@/tools/microsoft_ad/types'
+import type { ToolConfig } from '@/tools/types'
+
+export const deleteGroupTool: ToolConfig<
+  MicrosoftAdDeleteGroupParams,
+  MicrosoftAdDeleteGroupResponse
+> = {
+  id: 'microsoft_ad_delete_group',
+  name: 'Delete Azure AD Group',
+  description:
+    'Delete a group from Azure AD (Microsoft Entra ID). Microsoft 365 and security groups can be restored within 30 days.',
+  version: '1.0.0',
+  errorExtractor: 'nested-error-object',
+  oauth: {
+    required: true,
+    provider: 'microsoft-ad',
+  },
+  params: {
+    accessToken: {
+      type: 'string',
+      required: true,
+      visibility: 'hidden',
+      description: 'Microsoft Graph API access token',
+    },
+    groupId: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'Group ID',
+    },
+  },
+  request: {
+    url: (params) => {
+      const groupId = params.groupId?.trim()
+      if (!groupId) throw new Error('Group ID is required')
+      return `https://graph.microsoft.com/v1.0/groups/${encodeURIComponent(groupId)}`
+    },
+    method: 'DELETE',
+    headers: (params) => ({
+      Authorization: `Bearer ${params.accessToken}`,
+    }),
+  },
+  transformResponse: async (_response: Response, params?: MicrosoftAdDeleteGroupParams) => {
+    return {
+      success: true,
+      output: {
+        deleted: true,
+        groupId: params?.groupId ?? '',
+      },
+    }
+  },
+  outputs: {
+    deleted: { type: 'boolean', description: 'Whether the deletion was successful' },
+    groupId: { type: 'string', description: 'ID of the deleted group' },
+  },
+}

apps/sim/tools/microsoft_ad/delete_user.ts

@@ -0,0 +1,59 @@
+import type {
+  MicrosoftAdDeleteUserParams,
+  MicrosoftAdDeleteUserResponse,
+} from '@/tools/microsoft_ad/types'
+import type { ToolConfig } from '@/tools/types'
+
+export const deleteUserTool: ToolConfig<
+  MicrosoftAdDeleteUserParams,
+  MicrosoftAdDeleteUserResponse
+> = {
+  id: 'microsoft_ad_delete_user',
+  name: 'Delete Azure AD User',
+  description:
+    'Delete a user from Azure AD (Microsoft Entra ID). The user is moved to a temporary container and can be restored within 30 days.',
+  version: '1.0.0',
+  errorExtractor: 'nested-error-object',
+  oauth: {
+    required: true,
+    provider: 'microsoft-ad',
+  },
+  params: {
+    accessToken: {
+      type: 'string',
+      required: true,
+      visibility: 'hidden',
+      description: 'Microsoft Graph API access token',
+    },
+    userId: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'User ID or user principal name',
+    },
+  },
+  request: {
+    url: (params) => {
+      const userId = params.userId?.trim()
+      if (!userId) throw new Error('User ID is required')
+      return `https://graph.microsoft.com/v1.0/users/${encodeURIComponent(userId)}`
+    },
+    method: 'DELETE',
+    headers: (params) => ({
+      Authorization: `Bearer ${params.accessToken}`,
+    }),
+  },
+  transformResponse: async (_response: Response, params?: MicrosoftAdDeleteUserParams) => {
+    return {
+      success: true,
+      output: {
+        deleted: true,
+        userId: params?.userId ?? '',
+      },
+    }
+  },
+  outputs: {
+    deleted: { type: 'boolean', description: 'Whether the deletion was successful' },
+    userId: { type: 'string', description: 'ID of the deleted user' },
+  },
+}

apps/sim/tools/microsoft_ad/get_group.ts

@@ -0,0 +1,70 @@
+import type {
+  MicrosoftAdGetGroupParams,
+  MicrosoftAdGetGroupResponse,
+} from '@/tools/microsoft_ad/types'
+import { GROUP_OUTPUT_PROPERTIES } from '@/tools/microsoft_ad/types'
+import type { ToolConfig } from '@/tools/types'
+
+export const getGroupTool: ToolConfig<MicrosoftAdGetGroupParams, MicrosoftAdGetGroupResponse> = {
+  id: 'microsoft_ad_get_group',
+  name: 'Get Azure AD Group',
+  description: 'Get a group by ID from Azure AD (Microsoft Entra ID)',
+  version: '1.0.0',
+  errorExtractor: 'nested-error-object',
+  oauth: {
+    required: true,
+    provider: 'microsoft-ad',
+  },
+  params: {
+    accessToken: {
+      type: 'string',
+      required: true,
+      visibility: 'hidden',
+      description: 'Microsoft Graph API access token',
+    },
+    groupId: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'Group ID',
+    },
+  },
+  request: {
+    url: (params) => {
+      const groupId = params.groupId?.trim()
+      if (!groupId) throw new Error('Group ID is required')
+      return `https://graph.microsoft.com/v1.0/groups/${encodeURIComponent(groupId)}?$select=id,displayName,description,mail,mailEnabled,mailNickname,securityEnabled,groupTypes,visibility,createdDateTime`
+    },
+    method: 'GET',
+    headers: (params) => ({
+      Authorization: `Bearer ${params.accessToken}`,
+    }),
+  },
+  transformResponse: async (response: Response) => {
+    const group = await response.json()
+    return {
+      success: true,
+      output: {
+        group: {
+          id: group.id ?? null,
+          displayName: group.displayName ?? null,
+          description: group.description ?? null,
+          mail: group.mail ?? null,
+          mailEnabled: group.mailEnabled ?? null,
+          mailNickname: group.mailNickname ?? null,
+          securityEnabled: group.securityEnabled ?? null,
+          groupTypes: group.groupTypes ?? [],
+          visibility: group.visibility ?? null,
+          createdDateTime: group.createdDateTime ?? null,
+        },
+      },
+    }
+  },
+  outputs: {
+    group: {
+      type: 'object',
+      description: 'Group details',
+      properties: GROUP_OUTPUT_PROPERTIES,
+    },
+  },
+}

apps/sim/tools/microsoft_ad/get_user.ts

@@ -0,0 +1,71 @@
+import type {
+  MicrosoftAdGetUserParams,
+  MicrosoftAdGetUserResponse,
+} from '@/tools/microsoft_ad/types'
+import { USER_OUTPUT_PROPERTIES } from '@/tools/microsoft_ad/types'
+import type { ToolConfig } from '@/tools/types'
+
+export const getUserTool: ToolConfig<MicrosoftAdGetUserParams, MicrosoftAdGetUserResponse> = {
+  id: 'microsoft_ad_get_user',
+  name: 'Get Azure AD User',
+  description: 'Get a user by ID or user principal name from Azure AD',
+  version: '1.0.0',
+  errorExtractor: 'nested-error-object',
+  oauth: {
+    required: true,
+    provider: 'microsoft-ad',
+  },
+  params: {
+    accessToken: {
+      type: 'string',
+      required: true,
+      visibility: 'hidden',
+      description: 'Microsoft Graph API access token',
+    },
+    userId: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'User ID or user principal name (e.g., "user@example.com")',
+    },
+  },
+  request: {
+    url: (params) => {
+      const userId = params.userId?.trim()
+      if (!userId) throw new Error('User ID is required')
+      return `https://graph.microsoft.com/v1.0/users/${encodeURIComponent(userId)}?$select=id,displayName,givenName,surname,userPrincipalName,mail,jobTitle,department,officeLocation,mobilePhone,accountEnabled`
+    },
+    method: 'GET',
+    headers: (params) => ({
+      Authorization: `Bearer ${params.accessToken}`,
+    }),
+  },
+  transformResponse: async (response: Response) => {
+    const user = await response.json()
+    return {
+      success: true,
+      output: {
+        user: {
+          id: user.id ?? null,
+          displayName: user.displayName ?? null,
+          givenName: user.givenName ?? null,
+          surname: user.surname ?? null,
+          userPrincipalName: user.userPrincipalName ?? null,
+          mail: user.mail ?? null,
+          jobTitle: user.jobTitle ?? null,
+          department: user.department ?? null,
+          officeLocation: user.officeLocation ?? null,
+          mobilePhone: user.mobilePhone ?? null,
+          accountEnabled: user.accountEnabled ?? null,
+        },
+      },
+    }
+  },
+  outputs: {
+    user: {
+      type: 'object',
+      description: 'User details',
+      properties: USER_OUTPUT_PROPERTIES,
+    },
+  },
+}

apps/sim/tools/microsoft_ad/index.ts

@@ -0,0 +1,27 @@
+import { addGroupMemberTool } from '@/tools/microsoft_ad/add_group_member'
+import { createGroupTool } from '@/tools/microsoft_ad/create_group'
+import { createUserTool } from '@/tools/microsoft_ad/create_user'
+import { deleteGroupTool } from '@/tools/microsoft_ad/delete_group'
+import { deleteUserTool } from '@/tools/microsoft_ad/delete_user'
+import { getGroupTool } from '@/tools/microsoft_ad/get_group'
+import { getUserTool } from '@/tools/microsoft_ad/get_user'
+import { listGroupMembersTool } from '@/tools/microsoft_ad/list_group_members'
+import { listGroupsTool } from '@/tools/microsoft_ad/list_groups'
+import { listUsersTool } from '@/tools/microsoft_ad/list_users'
+import { removeGroupMemberTool } from '@/tools/microsoft_ad/remove_group_member'
+import { updateGroupTool } from '@/tools/microsoft_ad/update_group'
+import { updateUserTool } from '@/tools/microsoft_ad/update_user'
+
+export const microsoftAdListUsersTool = listUsersTool
+export const microsoftAdGetUserTool = getUserTool
+export const microsoftAdCreateUserTool = createUserTool
+export const microsoftAdUpdateUserTool = updateUserTool
+export const microsoftAdDeleteUserTool = deleteUserTool
+export const microsoftAdListGroupsTool = listGroupsTool
+export const microsoftAdGetGroupTool = getGroupTool
+export const microsoftAdCreateGroupTool = createGroupTool
+export const microsoftAdUpdateGroupTool = updateGroupTool
+export const microsoftAdDeleteGroupTool = deleteGroupTool
+export const microsoftAdListGroupMembersTool = listGroupMembersTool
+export const microsoftAdAddGroupMemberTool = addGroupMemberTool
+export const microsoftAdRemoveGroupMemberTool = removeGroupMemberTool

apps/sim/tools/microsoft_ad/list_group_members.ts

@@ -0,0 +1,93 @@
+import type {
+  MicrosoftAdListGroupMembersParams,
+  MicrosoftAdListGroupMembersResponse,
+} from '@/tools/microsoft_ad/types'
+import { MEMBER_OUTPUT_PROPERTIES } from '@/tools/microsoft_ad/types'
+import { assertGraphNextPageUrl, getGraphNextPageUrl } from '@/tools/sharepoint/utils'
+import type { ToolConfig } from '@/tools/types'
+
+export const listGroupMembersTool: ToolConfig<
+  MicrosoftAdListGroupMembersParams,
+  MicrosoftAdListGroupMembersResponse
+> = {
+  id: 'microsoft_ad_list_group_members',
+  name: 'List Azure AD Group Members',
+  description: 'List members of a group in Azure AD (Microsoft Entra ID)',
+  version: '1.0.0',
+  errorExtractor: 'nested-error-object',
+  oauth: {
+    required: true,
+    provider: 'microsoft-ad',
+  },
+  params: {
+    accessToken: {
+      type: 'string',
+      required: true,
+      visibility: 'hidden',
+      description: 'Microsoft Graph API access token',
+    },
+    groupId: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Group ID. Not needed when Next Page is provided to fetch a later page.',
+    },
+    top: {
+      type: 'number',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Maximum number of members to return (default 100, max 999)',
+    },
+    nextLink: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description:
+        'Continuation URL from a previous response\'s "nextLink" output, used to fetch the next page of results',
+    },
+  },
+  request: {
+    url: (params) => {
+      if (params.nextLink) return assertGraphNextPageUrl(params.nextLink)
+      const groupId = params.groupId?.trim()
+      if (!groupId) throw new Error('Group ID is required')
+      const queryParts = ['$select=id,displayName,mail']
+      if (params.top) queryParts.push(`$top=${params.top}`)
+      return `https://graph.microsoft.com/v1.0/groups/${encodeURIComponent(groupId)}/members?${queryParts.join('&')}`
+    },
+    method: 'GET',
+    headers: (params) => ({
+      Authorization: `Bearer ${params.accessToken}`,
+    }),
+  },
+  transformResponse: async (response: Response) => {
+    const data = await response.json()
+    const members = (data.value ?? []).map((member: Record<string, unknown>) => ({
+      id: member.id ?? null,
+      displayName: member.displayName ?? null,
+      mail: member.mail ?? null,
+      odataType: (member['@odata.type'] as string) ?? null,
+    }))
+    return {
+      success: true,
+      output: {
+        members,
+        memberCount: members.length,
+        nextLink: getGraphNextPageUrl(data) ?? null,
+      },
+    }
+  },
+  outputs: {
+    members: {
+      type: 'array',
+      description: 'List of group members',
+      properties: MEMBER_OUTPUT_PROPERTIES,
+    },
+    memberCount: { type: 'number', description: 'Number of members returned' },
+    nextLink: {
+      type: 'string',
+      description: 'Continuation URL for the next page of results, or null if there are no more',
+      optional: true,
+    },
+  },
+}

apps/sim/tools/microsoft_ad/list_groups.ts

@@ -0,0 +1,115 @@
+import type {
+  MicrosoftAdListGroupsParams,
+  MicrosoftAdListGroupsResponse,
+} from '@/tools/microsoft_ad/types'
+import { GROUP_OUTPUT_PROPERTIES } from '@/tools/microsoft_ad/types'
+import { assertGraphNextPageUrl, getGraphNextPageUrl } from '@/tools/sharepoint/utils'
+import type { ToolConfig } from '@/tools/types'
+
+export const listGroupsTool: ToolConfig<
+  MicrosoftAdListGroupsParams,
+  MicrosoftAdListGroupsResponse
+> = {
+  id: 'microsoft_ad_list_groups',
+  name: 'List Azure AD Groups',
+  description: 'List groups in Azure AD (Microsoft Entra ID)',
+  version: '1.0.0',
+  errorExtractor: 'nested-error-object',
+  oauth: {
+    required: true,
+    provider: 'microsoft-ad',
+  },
+  params: {
+    accessToken: {
+      type: 'string',
+      required: true,
+      visibility: 'hidden',
+      description: 'Microsoft Graph API access token',
+    },
+    top: {
+      type: 'number',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Maximum number of groups to return (default 100, max 999)',
+    },
+    filter: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'OData filter expression (e.g., "securityEnabled eq true")',
+    },
+    search: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Search string to filter groups by displayName or description',
+    },
+    nextLink: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description:
+        'Continuation URL from a previous response\'s "nextLink" output, used to fetch the next page of results',
+    },
+  },
+  request: {
+    url: (params) => {
+      if (params.nextLink) return assertGraphNextPageUrl(params.nextLink)
+      const queryParts: string[] = []
+      queryParts.push(
+        '$select=id,displayName,description,mail,mailEnabled,mailNickname,securityEnabled,groupTypes,visibility,createdDateTime'
+      )
+      if (params.top) queryParts.push(`$top=${params.top}`)
+      if (params.filter) queryParts.push(`$filter=${encodeURIComponent(params.filter)}`)
+      if (params.search) {
+        const term = params.search.replace(/\\/g, '\\\\').replace(/"/g, '\\"')
+        queryParts.push(
+          `$search=${encodeURIComponent(`"displayName:${term}" OR "description:${term}"`)}`
+        )
+        queryParts.push('$count=true')
+      }
+      return `https://graph.microsoft.com/v1.0/groups?${queryParts.join('&')}`
+    },
+    method: 'GET',
+    headers: (params) => ({
+      Authorization: `Bearer ${params.accessToken}`,
+      ConsistencyLevel: 'eventual',
+    }),
+  },
+  transformResponse: async (response: Response) => {
+    const data = await response.json()
+    const groups = (data.value ?? []).map((group: Record<string, unknown>) => ({
+      id: group.id ?? null,
+      displayName: group.displayName ?? null,
+      description: group.description ?? null,
+      mail: group.mail ?? null,
+      mailEnabled: group.mailEnabled ?? null,
+      mailNickname: group.mailNickname ?? null,
+      securityEnabled: group.securityEnabled ?? null,
+      groupTypes: group.groupTypes ?? [],
+      visibility: group.visibility ?? null,
+      createdDateTime: group.createdDateTime ?? null,
+    }))
+    return {
+      success: true,
+      output: {
+        groups,
+        groupCount: groups.length,
+        nextLink: getGraphNextPageUrl(data) ?? null,
+      },
+    }
+  },
+  outputs: {
+    groups: {
+      type: 'array',
+      description: 'List of groups',
+      properties: GROUP_OUTPUT_PROPERTIES,
+    },
+    groupCount: { type: 'number', description: 'Number of groups returned' },
+    nextLink: {
+      type: 'string',
+      description: 'Continuation URL for the next page of results, or null if there are no more',
+      optional: true,
+    },
+  },
+}

apps/sim/tools/microsoft_ad/list_users.ts

@@ -0,0 +1,111 @@
+import type {
+  MicrosoftAdListUsersParams,
+  MicrosoftAdListUsersResponse,
+} from '@/tools/microsoft_ad/types'
+import { USER_OUTPUT_PROPERTIES } from '@/tools/microsoft_ad/types'
+import { assertGraphNextPageUrl, getGraphNextPageUrl } from '@/tools/sharepoint/utils'
+import type { ToolConfig } from '@/tools/types'
+
+export const listUsersTool: ToolConfig<MicrosoftAdListUsersParams, MicrosoftAdListUsersResponse> = {
+  id: 'microsoft_ad_list_users',
+  name: 'List Azure AD Users',
+  description: 'List users in Azure AD (Microsoft Entra ID)',
+  version: '1.0.0',
+  errorExtractor: 'nested-error-object',
+  oauth: {
+    required: true,
+    provider: 'microsoft-ad',
+  },
+  params: {
+    accessToken: {
+      type: 'string',
+      required: true,
+      visibility: 'hidden',
+      description: 'Microsoft Graph API access token',
+    },
+    top: {
+      type: 'number',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Maximum number of users to return (default 100, max 999)',
+    },
+    filter: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'OData filter expression (e.g., "department eq \'Sales\'")',
+    },
+    search: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Search string to filter users by displayName or mail',
+    },
+    nextLink: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description:
+        'Continuation URL from a previous response\'s "nextLink" output, used to fetch the next page of results',
+    },
+  },
+  request: {
+    url: (params) => {
+      if (params.nextLink) return assertGraphNextPageUrl(params.nextLink)
+      const queryParts: string[] = []
+      queryParts.push(
+        '$select=id,displayName,givenName,surname,userPrincipalName,mail,jobTitle,department,officeLocation,mobilePhone,accountEnabled'
+      )
+      if (params.top) queryParts.push(`$top=${params.top}`)
+      if (params.filter) queryParts.push(`$filter=${encodeURIComponent(params.filter)}`)
+      if (params.search) {
+        const term = params.search.replace(/\\/g, '\\\\').replace(/"/g, '\\"')
+        queryParts.push(`$search=${encodeURIComponent(`"displayName:${term}" OR "mail:${term}"`)}`)
+        queryParts.push('$count=true')
+      }
+      return `https://graph.microsoft.com/v1.0/users?${queryParts.join('&')}`
+    },
+    method: 'GET',
+    headers: (params) => ({
+      Authorization: `Bearer ${params.accessToken}`,
+      ConsistencyLevel: 'eventual',
+    }),
+  },
+  transformResponse: async (response: Response) => {
+    const data = await response.json()
+    const users = (data.value ?? []).map((user: Record<string, unknown>) => ({
+      id: user.id ?? null,
+      displayName: user.displayName ?? null,
+      givenName: user.givenName ?? null,
+      surname: user.surname ?? null,
+      userPrincipalName: user.userPrincipalName ?? null,
+      mail: user.mail ?? null,
+      jobTitle: user.jobTitle ?? null,
+      department: user.department ?? null,
+      officeLocation: user.officeLocation ?? null,
+      mobilePhone: user.mobilePhone ?? null,
+      accountEnabled: user.accountEnabled ?? null,
+    }))
+    return {
+      success: true,
+      output: {
+        users,
+        userCount: users.length,
+        nextLink: getGraphNextPageUrl(data) ?? null,
+      },
+    }
+  },
+  outputs: {
+    users: {
+      type: 'array',
+      description: 'List of users',
+      properties: USER_OUTPUT_PROPERTIES,
+    },
+    userCount: { type: 'number', description: 'Number of users returned' },
+    nextLink: {
+      type: 'string',
+      description: 'Continuation URL for the next page of results, or null if there are no more',
+      optional: true,
+    },
+  },
+}

apps/sim/tools/microsoft_ad/remove_group_member.ts

@@ -0,0 +1,68 @@
+import type {
+  MicrosoftAdRemoveGroupMemberParams,
+  MicrosoftAdRemoveGroupMemberResponse,
+} from '@/tools/microsoft_ad/types'
+import type { ToolConfig } from '@/tools/types'
+
+export const removeGroupMemberTool: ToolConfig<
+  MicrosoftAdRemoveGroupMemberParams,
+  MicrosoftAdRemoveGroupMemberResponse
+> = {
+  id: 'microsoft_ad_remove_group_member',
+  name: 'Remove Azure AD Group Member',
+  description: 'Remove a member from a group in Azure AD (Microsoft Entra ID)',
+  version: '1.0.0',
+  errorExtractor: 'nested-error-object',
+  oauth: {
+    required: true,
+    provider: 'microsoft-ad',
+  },
+  params: {
+    accessToken: {
+      type: 'string',
+      required: true,
+      visibility: 'hidden',
+      description: 'Microsoft Graph API access token',
+    },
+    groupId: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'Group ID',
+    },
+    memberId: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'User ID of the member to remove',
+    },
+  },
+  request: {
+    url: (params) => {
+      const groupId = params.groupId?.trim()
+      const memberId = params.memberId?.trim()
+      if (!groupId) throw new Error('Group ID is required')
+      if (!memberId) throw new Error('Member ID is required')
+      return `https://graph.microsoft.com/v1.0/groups/${encodeURIComponent(groupId)}/members/${encodeURIComponent(memberId)}/$ref`
+    },
+    method: 'DELETE',
+    headers: (params) => ({
+      Authorization: `Bearer ${params.accessToken}`,
+    }),
+  },
+  transformResponse: async (_response: Response, params?: MicrosoftAdRemoveGroupMemberParams) => {
+    return {
+      success: true,
+      output: {
+        removed: true,
+        groupId: params?.groupId ?? '',
+        memberId: params?.memberId ?? '',
+      },
+    }
+  },
+  outputs: {
+    removed: { type: 'boolean', description: 'Whether the member was removed successfully' },
+    groupId: { type: 'string', description: 'Group ID' },
+    memberId: { type: 'string', description: 'Member ID that was removed' },
+  },
+}

apps/sim/tools/microsoft_ad/types.ts

@@ -0,0 +1,236 @@
+import type { OutputProperty, ToolResponse } from '@/tools/types'
+
+interface MicrosoftAdBaseParams {
+  accessToken: string
+}
+
+export interface MicrosoftAdListUsersParams extends MicrosoftAdBaseParams {
+  top?: number
+  filter?: string
+  search?: string
+  nextLink?: string
+}
+
+export interface MicrosoftAdGetUserParams extends MicrosoftAdBaseParams {
+  userId: string
+}
+
+export interface MicrosoftAdCreateUserParams extends MicrosoftAdBaseParams {
+  displayName: string
+  mailNickname: string
+  userPrincipalName: string
+  password: string
+  accountEnabled: boolean
+  givenName?: string
+  surname?: string
+  jobTitle?: string
+  department?: string
+  officeLocation?: string
+  mobilePhone?: string
+}
+
+export interface MicrosoftAdUpdateUserParams extends MicrosoftAdBaseParams {
+  userId: string
+  displayName?: string
+  givenName?: string
+  surname?: string
+  jobTitle?: string
+  department?: string
+  officeLocation?: string
+  mobilePhone?: string
+  accountEnabled?: boolean
+}
+
+export interface MicrosoftAdDeleteUserParams extends MicrosoftAdBaseParams {
+  userId: string
+}
+
+export interface MicrosoftAdListGroupsParams extends MicrosoftAdBaseParams {
+  top?: number
+  filter?: string
+  search?: string
+  nextLink?: string
+}
+
+export interface MicrosoftAdGetGroupParams extends MicrosoftAdBaseParams {
+  groupId: string
+}
+
+export interface MicrosoftAdCreateGroupParams extends MicrosoftAdBaseParams {
+  displayName: string
+  mailNickname: string
+  description?: string
+  mailEnabled: boolean
+  securityEnabled: boolean
+  groupTypes?: string
+  visibility?: string
+}
+
+export interface MicrosoftAdUpdateGroupParams extends MicrosoftAdBaseParams {
+  groupId: string
+  displayName?: string
+  description?: string
+  mailNickname?: string
+  visibility?: string
+}
+
+export interface MicrosoftAdDeleteGroupParams extends MicrosoftAdBaseParams {
+  groupId: string
+}
+
+export interface MicrosoftAdListGroupMembersParams extends MicrosoftAdBaseParams {
+  groupId?: string
+  top?: number
+  nextLink?: string
+}
+
+export interface MicrosoftAdAddGroupMemberParams extends MicrosoftAdBaseParams {
+  groupId: string
+  memberId: string
+}
+
+export interface MicrosoftAdRemoveGroupMemberParams extends MicrosoftAdBaseParams {
+  groupId: string
+  memberId: string
+}
+
+export const USER_OUTPUT_PROPERTIES = {
+  id: { type: 'string', description: 'User ID' },
+  displayName: { type: 'string', description: 'Display name' },
+  givenName: { type: 'string', description: 'First name' },
+  surname: { type: 'string', description: 'Last name' },
+  userPrincipalName: { type: 'string', description: 'User principal name (email)' },
+  mail: { type: 'string', description: 'Email address' },
+  jobTitle: { type: 'string', description: 'Job title' },
+  department: { type: 'string', description: 'Department' },
+  officeLocation: { type: 'string', description: 'Office location' },
+  mobilePhone: { type: 'string', description: 'Mobile phone number' },
+  accountEnabled: { type: 'boolean', description: 'Whether the account is enabled' },
+} as const satisfies Record<string, OutputProperty>
+
+export const GROUP_OUTPUT_PROPERTIES = {
+  id: { type: 'string', description: 'Group ID' },
+  displayName: { type: 'string', description: 'Display name' },
+  description: { type: 'string', description: 'Group description' },
+  mail: { type: 'string', description: 'Email address' },
+  mailEnabled: { type: 'boolean', description: 'Whether mail is enabled' },
+  mailNickname: { type: 'string', description: 'Mail nickname' },
+  securityEnabled: { type: 'boolean', description: 'Whether security is enabled' },
+  groupTypes: { type: 'array', description: 'Group types' },
+  visibility: { type: 'string', description: 'Group visibility' },
+  createdDateTime: { type: 'string', description: 'Creation date' },
+} as const satisfies Record<string, OutputProperty>
+
+export const MEMBER_OUTPUT_PROPERTIES = {
+  id: { type: 'string', description: 'Member ID' },
+  displayName: { type: 'string', description: 'Display name' },
+  mail: { type: 'string', description: 'Email address' },
+  odataType: { type: 'string', description: 'Directory object type' },
+} as const satisfies Record<string, OutputProperty>
+
+export interface MicrosoftAdListUsersResponse extends ToolResponse {
+  output: {
+    users: Array<Record<string, unknown>>
+    userCount: number
+    nextLink: string | null
+  }
+}
+
+export interface MicrosoftAdGetUserResponse extends ToolResponse {
+  output: {
+    user: Record<string, unknown>
+  }
+}
+
+export interface MicrosoftAdCreateUserResponse extends ToolResponse {
+  output: {
+    user: Record<string, unknown>
+  }
+}
+
+export interface MicrosoftAdUpdateUserResponse extends ToolResponse {
+  output: {
+    updated: boolean
+    userId: string
+  }
+}
+
+export interface MicrosoftAdDeleteUserResponse extends ToolResponse {
+  output: {
+    deleted: boolean
+    userId: string
+  }
+}
+
+export interface MicrosoftAdListGroupsResponse extends ToolResponse {
+  output: {
+    groups: Array<Record<string, unknown>>
+    groupCount: number
+    nextLink: string | null
+  }
+}
+
+export interface MicrosoftAdGetGroupResponse extends ToolResponse {
+  output: {
+    group: Record<string, unknown>
+  }
+}
+
+export interface MicrosoftAdCreateGroupResponse extends ToolResponse {
+  output: {
+    group: Record<string, unknown>
+  }
+}
+
+export interface MicrosoftAdUpdateGroupResponse extends ToolResponse {
+  output: {
+    updated: boolean
+    groupId: string
+  }
+}
+
+export interface MicrosoftAdDeleteGroupResponse extends ToolResponse {
+  output: {
+    deleted: boolean
+    groupId: string
+  }
+}
+
+export interface MicrosoftAdListGroupMembersResponse extends ToolResponse {
+  output: {
+    members: Array<Record<string, unknown>>
+    memberCount: number
+    nextLink: string | null
+  }
+}
+
+export interface MicrosoftAdAddGroupMemberResponse extends ToolResponse {
+  output: {
+    added: boolean
+    groupId: string
+    memberId: string
+  }
+}
+
+export interface MicrosoftAdRemoveGroupMemberResponse extends ToolResponse {
+  output: {
+    removed: boolean
+    groupId: string
+    memberId: string
+  }
+}
+
+export type MicrosoftAdResponse =
+  | MicrosoftAdListUsersResponse
+  | MicrosoftAdGetUserResponse
+  | MicrosoftAdCreateUserResponse
+  | MicrosoftAdUpdateUserResponse
+  | MicrosoftAdDeleteUserResponse
+  | MicrosoftAdListGroupsResponse
+  | MicrosoftAdGetGroupResponse
+  | MicrosoftAdCreateGroupResponse
+  | MicrosoftAdUpdateGroupResponse
+  | MicrosoftAdDeleteGroupResponse
+  | MicrosoftAdListGroupMembersResponse
+  | MicrosoftAdAddGroupMemberResponse
+  | MicrosoftAdRemoveGroupMemberResponse

apps/sim/tools/microsoft_ad/update_group.ts

@@ -0,0 +1,91 @@
+import type {
+  MicrosoftAdUpdateGroupParams,
+  MicrosoftAdUpdateGroupResponse,
+} from '@/tools/microsoft_ad/types'
+import type { ToolConfig } from '@/tools/types'
+
+export const updateGroupTool: ToolConfig<
+  MicrosoftAdUpdateGroupParams,
+  MicrosoftAdUpdateGroupResponse
+> = {
+  id: 'microsoft_ad_update_group',
+  name: 'Update Azure AD Group',
+  description: 'Update group properties in Azure AD (Microsoft Entra ID)',
+  version: '1.0.0',
+  errorExtractor: 'nested-error-object',
+  oauth: {
+    required: true,
+    provider: 'microsoft-ad',
+  },
+  params: {
+    accessToken: {
+      type: 'string',
+      required: true,
+      visibility: 'hidden',
+      description: 'Microsoft Graph API access token',
+    },
+    groupId: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'Group ID',
+    },
+    displayName: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Display name',
+    },
+    description: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Group description',
+    },
+    mailNickname: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Mail alias',
+    },
+    visibility: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Group visibility: "Private" or "Public"',
+    },
+  },
+  request: {
+    url: (params) => {
+      const groupId = params.groupId?.trim()
+      if (!groupId) throw new Error('Group ID is required')
+      return `https://graph.microsoft.com/v1.0/groups/${encodeURIComponent(groupId)}`
+    },
+    method: 'PATCH',
+    headers: (params) => ({
+      Authorization: `Bearer ${params.accessToken}`,
+      'Content-Type': 'application/json',
+    }),
+    body: (params) => {
+      const body: Record<string, unknown> = {}
+      if (params.displayName) body.displayName = params.displayName
+      if (params.description) body.description = params.description
+      if (params.mailNickname) body.mailNickname = params.mailNickname
+      if (params.visibility) body.visibility = params.visibility
+      return body
+    },
+  },
+  transformResponse: async (_response: Response, params?: MicrosoftAdUpdateGroupParams) => {
+    return {
+      success: true,
+      output: {
+        updated: true,
+        groupId: params?.groupId ?? '',
+      },
+    }
+  },
+  outputs: {
+    updated: { type: 'boolean', description: 'Whether the update was successful' },
+    groupId: { type: 'string', description: 'ID of the updated group' },
+  },
+}

apps/sim/tools/microsoft_ad/update_user.ts

@@ -0,0 +1,119 @@
+import type {
+  MicrosoftAdUpdateUserParams,
+  MicrosoftAdUpdateUserResponse,
+} from '@/tools/microsoft_ad/types'
+import type { ToolConfig } from '@/tools/types'
+
+export const updateUserTool: ToolConfig<
+  MicrosoftAdUpdateUserParams,
+  MicrosoftAdUpdateUserResponse
+> = {
+  id: 'microsoft_ad_update_user',
+  name: 'Update Azure AD User',
+  description: 'Update user properties in Azure AD (Microsoft Entra ID)',
+  version: '1.0.0',
+  errorExtractor: 'nested-error-object',
+  oauth: {
+    required: true,
+    provider: 'microsoft-ad',
+  },
+  params: {
+    accessToken: {
+      type: 'string',
+      required: true,
+      visibility: 'hidden',
+      description: 'Microsoft Graph API access token',
+    },
+    userId: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'User ID or user principal name',
+    },
+    displayName: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Display name',
+    },
+    givenName: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'First name',
+    },
+    surname: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Last name',
+    },
+    jobTitle: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Job title',
+    },
+    department: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Department',
+    },
+    officeLocation: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Office location',
+    },
+    mobilePhone: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Mobile phone number',
+    },
+    accountEnabled: {
+      type: 'boolean',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Whether the account is enabled',
+    },
+  },
+  request: {
+    url: (params) => {
+      const userId = params.userId?.trim()
+      if (!userId) throw new Error('User ID is required')
+      return `https://graph.microsoft.com/v1.0/users/${encodeURIComponent(userId)}`
+    },
+    method: 'PATCH',
+    headers: (params) => ({
+      Authorization: `Bearer ${params.accessToken}`,
+      'Content-Type': 'application/json',
+    }),
+    body: (params) => {
+      const body: Record<string, unknown> = {}
+      if (params.displayName) body.displayName = params.displayName
+      if (params.givenName) body.givenName = params.givenName
+      if (params.surname) body.surname = params.surname
+      if (params.jobTitle) body.jobTitle = params.jobTitle
+      if (params.department) body.department = params.department
+      if (params.officeLocation) body.officeLocation = params.officeLocation
+      if (params.mobilePhone) body.mobilePhone = params.mobilePhone
+      if (params.accountEnabled !== undefined) body.accountEnabled = params.accountEnabled
+      return body
+    },
+  },
+  transformResponse: async (_response: Response, params?: MicrosoftAdUpdateUserParams) => {
+    return {
+      success: true,
+      output: {
+        updated: true,
+        userId: params?.userId ?? '',
+      },
+    }
+  },
+  outputs: {
+    updated: { type: 'boolean', description: 'Whether the update was successful' },
+    userId: { type: 'string', description: 'ID of the updated user' },
+  },
+}