Docs · Connector reference

Microsoft Graph GCC High connector reference

Operations, inputs, troubleshooting, and questions for the Microsoft Graph GCC High connection.

Set up and verify the Microsoft Graph GCC High connection

Choose one task and its account, and match the reads and actions on the overview page to it before granting provider permissions.
Prepare the connection settings from the overview page, connect the provider in Deixic, and choose which tools your agent can use.
Try a small task with a known result, and compare the returned identity and resource with what the account owner expects.
Review the retrieved information, retain its identifiers, and keep any later change in a separate, explicitly authorized step.

Information your agent can use

Resource	Record identity	Start with	Page coverage
Mfa registration	`id`	Top level	Next-page URL
Users	`id`	Top level	Next-page URL
Groups	`id`	Top level	Next-page URL
Group memberships	`id`	Groups	Next-page URL
Directory roles	`id`	Top level	Next-page URL
Role assignments	`id`	Top level	Next-page URL
Conditional access policies	`id`	Top level	Next-page URL
Directory devices	`id`	Top level	Next-page URL
Managed devices	`id`	Top level	Next-page URL
Active role schedule instances	`id`	Top level	Next-page URL
Eligible role schedule instances	`id`	Top level	Next-page URL

Record identity: Match on these fields before joining or deduplicating results; where none is specified, check the returned record first.
Start with: Resolve the parent identifier first.
Next-page URL: Next-page URL. Follow the continuation returned by the provider before treating the collection as complete.

Supported operations

Review the inputs before granting an action to an agent. Required inputs must be supplied, optional inputs narrow the request, and provider permissions apply in addition to Deixic policy.

Read: Retrieves information; check the returned scope and identifiers before use.

Operation	Effect	Approval	Provider permissions	Inputs
Mfa Registration List	Read	By policy	AuditLog.Read.All	None named
Users List	Read	By policy	User.Read.All	1
Groups List	Read	By policy	GroupMember.Read.All	1
Group Memberships List	Read	By policy	GroupMember.Read.All	1
Directory Roles List	Read	By policy	RoleManagement.Read.Directory	1
Role Assignments List	Read	By policy	RoleManagement.Read.Directory	1
Conditional Access Policies List	Read	By policy	Policy.Read.All	1
Directory Devices List	Read	By policy	Device.Read.All	1
Managed Devices List	Read	By policy	DeviceManagementManagedDevices.Read.All	1
Role Assignment Instances List	Read	By policy	RoleManagement.Read.Directory	1
Role Eligibility Instances List	Read	By policy	RoleManagement.Read.Directory	1

Inputs by operation

Users List Read

Inputs for Microsoft-Graph-Gcc-High Users List
Input	Requirement	Accepted value
`$select`	Required	string

Groups List Read

Inputs for Microsoft-Graph-Gcc-High Groups List
Input	Requirement	Accepted value
`$select`	Required	string

Group Memberships List Read

Inputs for Microsoft-Graph-Gcc-High Group Memberships List
Input	Requirement	Accepted value
`group_id`	Required	stringMinimum characters: 1Maximum characters: 128

Directory Roles List Read

Inputs for Microsoft-Graph-Gcc-High Directory Roles List
Input	Requirement	Accepted value
`$select`	Required	string

Role Assignments List Read

Inputs for Microsoft-Graph-Gcc-High Role Assignments List
Input	Requirement	Accepted value
`$select`	Required	string

Conditional Access Policies List Read

Inputs for Microsoft-Graph-Gcc-High Conditional Access Policies List
Input	Requirement	Accepted value
`$select`	Required	string

Directory Devices List Read

Inputs for Microsoft-Graph-Gcc-High Directory Devices List
Input	Requirement	Accepted value
`$select`	Required	string

Managed Devices List Read

Inputs for Microsoft-Graph-Gcc-High Managed Devices List
Input	Requirement	Accepted value
`$select`	Required	string

Role Assignment Instances List Read

Inputs for Microsoft-Graph-Gcc-High Role Assignment Instances List
Input	Requirement	Accepted value
`$select`	Required	string

Role Eligibility Instances List Read

Inputs for Microsoft-Graph-Gcc-High Role Eligibility Instances List
Input	Requirement	Accepted value
`$select`	Required	string

When the Microsoft Graph GCC High task does not produce the expected result

Connected, but the expected data is missing

Check the identity behind the oauth connection and its access to the specific resource; a successful connection does not establish access to every object.

Resolve parent resources first: Groups. A matching display name is not enough for a child lookup.

The answer covers only part of the data

Check the resource’s page coverage, query filters, and result limit, and have the agent state the account and time window it inspected, so a partial response yields a scoped answer.

The agent keeps doing the same work

Inspect the action history for repeated targets and inputs, keep the successful result’s identifiers with the task, and refresh a lookup only when the information changed.

The next step needs a write

Use a separate authorized action or a person to make the change; broader credentials do not add a write operation to this connection.

See how an action proceeds and how to review an approval.

Questions about the Microsoft Graph GCC High connector

Can I use my existing agent with Microsoft Graph GCC High?

Yes: connect your agent to Deixic through MCP, choose which connected tools it can use, and Deixic checks calls routed through its gateway; Dex is available if your team also wants an agent.

Can an agent change data in Microsoft Graph GCC High?

This connector supports reads. Use a configured connection to retrieve information and prepare a recommendation; it provides no action for changing provider data, even if the provider’s API offers writes.

What do I need to connect Microsoft Graph GCC High?

Prepare Access token; the connection uses OAuth, and the connected identity’s provider permissions determine which resources it can access.

Does connecting Microsoft Graph GCC High keep every answer up to date?

No: an earlier answer is still an earlier answer, so for a decision that depends on current state, have the agent refresh the source and retain the lookup time, and save stable instructions separately from facts that can change.

Microsoft Graph GCC High connector overview Docs All connectors