What is Microsoft Graph API? Complete Guide with Endpoints, Permissions, and Examples

Introduction

If you work with Azure Active Directory (now called Microsoft Entra ID), Microsoft 365, or any Microsoft cloud services, you’ve likely heard about the Microsoft Graph API.

But what exactly is it? How do you use it to extract data like user details, audit logs, sign-in reports, and application ownership?

This guide will answer all those questions in detail — with real-world API examples, endpoint references, permission requirements, and SEO-optimized content that helps you learn and helps your website rank.

Related: How to Troubleshoot Azure Entra ID Sign-in Logs Deep Dive

What is Microsoft Graph API?

Microsoft Graph API is the unified API endpoint that connects you to data across Microsoft services. It acts as a single gateway to access data from Microsoft 365, Azure AD, Intune, Teams, OneDrive, Outlook, and more.

Instead of managing multiple APIs for different Microsoft services, you can use one endpoint:

https://graph.microsoft.com/


Everything you need — from user attributes to audit logs, groups, applications, devices, and security insights — can be retrieved or modified through this one URL structure.

Why is Microsoft Graph API Important?

• Unified access – Access all Microsoft cloud data from one API.

• Automation – Ideal for scripting, reporting, and provisioning.

• Security insights – Monitor sign-ins, risky users, and compliance.

• Integration – Easily connect Microsoft data with external applications or Power BI.

• Scalability – Works for both small organizations and large enterprises.

🧠 In short, if you’re managing users, auditing logs, or automating reports in Microsoft Entra ID — Graph API is your best friend.

How to Use Microsoft Graph API (Step-by-Step)

To use Graph API, you first need to register an application in Azure Entra ID, assign the right permissions, and then authenticate to get a token.

Let’s go step by step,

Step 1: Register an App in Azure Entra

1. Go to Azure Portal → App Registrations.

2. Click New Registration.

3. Give your app a name (e.g., GraphAPIDemoApp).

4. Choose supported account types (usually “Accounts in this organizational directory only”).

5. Add redirect URI if needed (for delegated access).

6. Click Register.

You’ll now see:

• Application (client) ID

• Directory (tenant) ID

• Option to create a client secret

Keep these safe — they’ll be used for authentication.

Step 2: Authentication Flow

There are two main ways to authenticate:

To get a token:

POST https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token
Content-Type: application/x-www-form-urlencoded
client_id=<ClientID>
&scope=https://graph.microsoft.com/.default
&client_secret=<Secret>
&grant_type=client_credentials

You’ll receive an access token which is used in the authorization header for each Graph API call.

Step 3: Make Your First Graph API Call

Once you have a token, add it to your headers:

GET https://graph.microsoft.com/v1.0/users
Authorization: Bearer <access_token>

🎯 Pro Tip: Use tools like Graph Explorer (https://developer.microsoft.com/en-us/graph/graph-explorer) to test requests before running scripts.

Microsoft Graph API Endpoints

Here’s a table of the most commonly used endpoints:

📘 For extended examples, visit Microsoft Graph API Documentation.

Permissions Required for Graph API

Permissions are critical — they define what data your app can access.

Here are the most commonly required permissions:

Important:

• Delegated permissions require user consent.

• Application permissions require admin consent (performed by a Global Admin or Privileged Role Administrator).

How to Get User Details with Microsoft Graph API

To fetch user details, use:

 GET https://graph.microsoft.com/v1.0/users/{userPrincipalName}
Authorization: Bearer <access_token>


Example Response:

{
"id": "7f123456-98ab-45c1-9cdb-abc123456789",
"displayName": "Shivi Mehra",
"mail": "shivi@cloudknowledge.in",
"jobTitle": "Identity Engineer",
"userPrincipalName": "shivi@cloudknowledge.in"
}


Use the $select query to limit properties:

GET https://graph.microsoft.com/v1.0/users/{id}?$select=id,displayName,mail,jobTitle


🔗 Related: Learn How to Use Graph API for Azure Entra ID User Management

How to Get Audit and Sign-In Logs with Graph API

The Audit Logs and Sign-In Logs endpoints are powerful tools for security analysis.

Get Audit Logs

GET https://graph.microsoft.com/v1.0/auditLogs/directoryAudits
Authorization: Bearer <access_token>


Filter results:

GET https://graph.microsoft.com/v1.0/auditLogs/directoryAudits?$filter=activityDisplayName eq 'Add user'


Get Sign-In Logs

GET https://graph.microsoft.com/v1.0/auditLogs/signIns


Filter by date and status:

GET https://graph.microsoft.com/v1.0/auditLogs/signIns?$filter=createdDateTime ge 2025-09-01T00:00:00Z and conditionalAccessStatus eq 'failure'


Tip: Always use $top or $filter to reduce payload size.

How to Get Application Details with Owners

Applications endpoint helps you retrieve app registrations and their owners.

Example:

GET https://graph.microsoft.com/v1.0/applications?$filter=appId eq '11111111-2222-3333-4444-555555555555'

To get owners of an application:

GET https://graph.microsoft.com/v1.0/applications/{application-id}/owners

Response:

[
  {
    "id": "9a8b7c6d-1234-4e8a-9cdb-5a6b9e3f1234",
    "displayName": "Admin User",
    "userPrincipalName": "admin@cloudknowledge.in"
  }
]

More Data You Can Access Using Microsoft Graph API

Related: Azure Entra Conditional Access Policies — Deep Dive Guide

Advanced Graph API Features

• Delta Queries – Sync incremental changes only.

• Batch Requests – Send multiple queries in one call.

• Webhooks (Change Notifications) – Get alerts for new sign-ins or user updates.

• Beta Endpoint (/beta) – Access preview features (not for production).

Example Delta Query:

GET https://graph.microsoft.com/v1.0/users/delta?$select=id,displayName,mail

Best Practices for Using Microsoft Graph API

1. Use Least Privilege: Request only permissions you need.

2. Prefer Application Permissions for automation and scripts.

3. Paginate Results: Use @odata.nextLink for large datasets.

4. Error Handling: Implement retry and exponential backoff for 429 (rate limit).

5. Secure Secrets: Store client secrets safely in Azure Key Vault.

6. Monitor API Usage: Check API throttling limits for enterprise-scale apps.

7. Use $select & $filter: Always narrow down data to improve performance.

Troubleshooting Common Graph API Issues

Troubleshooting Common Graph API Issues

Conclusion

Microsoft Graph API is a game-changer for automating, reporting, and integrating with Microsoft Entra ID and 365 services.

It unifies multiple data sources, simplifies permissions, and provides a standard REST API surface for developers and admins.

With the right permissions and proper authentication, you can:

• Fetch user details

• Retrieve audit and sign-in logs

• Manage applications and owners

• Access security insights, devices, and more

Continue Learning:

• Troubleshooting Azure Entra Sign-in Logs

• Microsoft Entra Conditional Access Policy — Complete Guide

• Entra ID Audit Logs Explained Deep Dive