What Deixic does with Microsoft Graph.

How Deixic helps with Microsoft Graph.

Read information

Review groups, users and authentication methods from Microsoft Graph as evidence and to check state.

Choose the actions

Deixic supports actions on users, groups and roles. Grant only the tools and permissions the task needs.

Keep your decisions

Deixic checks your policy before a change; sensitive changes wait for a named approver. The action record keeps the decision and result.

4 of 4 changing operations require approval. See how approvals work.

Example workflow

List who still has access after a termination

Read the Microsoft 365 users and groups through Graph. Find the departed person's account and their group memberships, and return the accesses that still need to be removed, with identifiers.

1. Take the termination from the HR system and match it to a user by user principal name or object ID. Do not match on display name.
2. Read the user and the groups that user belongs to. Record the account status the user record returns and the group identifiers, since group names repeat across tenants.
3. Prepare the account disablement, session revocation, group membership removal, or directory-role removal for approval. After approval, run the supported changes and read the same user, memberships, and role assignments again to check the result for CC6.2.

Check before you continue: Graph returns paged results. Follow the continuation link before reporting that a user has no remaining group memberships. Which properties come back depends on the permissions granted to the connection.

Provider reference: Graph user resourceUpdate a user (accountEnabled)

Use your existing agent with Deixic. Calls you route through Deixic follow your access and approval policy.

Provider access

Supported Microsoft Graph reads and actions.

Choose the reads and actions your task needs. Your connection’s permissions and your agent’s access determine what it can use.

Permissions

Choose the access for Microsoft Graph.

Have the account owner authorize the intended account and permissions, and if data is missing, inspect the authorizing user’s access to the target resource before requesting broader access.

Find Microsoft Graph in the appManage connected accounts

Connection

OAuth

Supported operations

Read and act

Reads

5

Actions

3

Provider permissions

Grant only the permissions needed for the task.

What you need to connect

• Access token
• Application (client) ID (optional)
• Client secret (optional)
• Refresh token (optional)

Deixic checks calls routed through its gateway and requests approval when your policy requires it.

Reference and troubleshooting

Microsoft Graph operation reference, troubleshooting, and questionsSOC 2 for Microsoft 365

Connectors for related work