Microsoft Graph
Getting Started with Teams Bots: Where Bot Framework Ends and Graph API Begins
The building blocks of a conversational bot in Teams: why the Graph API alone cannot substitute for a bot (bot identity and application-permission limits), the bot architecture of an Azure Bot resource plus a messaging endpoint, proactive messages that reach users before they ever talk to the bot via conversation references and proactive installation, RSC permissions for reading channel messages without a mention, and Adaptive Cards — the road from notification bots to conversational ones.
Power Automate vs Graph API: Which One for Which Automation Job
Comparing the two roads to Microsoft 365 automation: what the low-code connector-assembly tool Power Automate does well versus calling the Graph API directly in code, Power Automate strengths in triggers, approval flows, and citizen development, its limits at volume, complexity, and version control, the hidden variables of premium connectors and licensing, and the practical division of labor for mixing both.
Automating Excel Reports with Microsoft Graph: Sessions, Tables, Chart Images
The Graph workbook API that reads and writes Excel files without opening them: the three session modes and what persistChanges means, eliminating the per-call file reopen cost, reading data with usedRange and appending rows through tables, creating charts and extracting them as images for reports, the delegated-permission-centric constraint peculiar to the Excel API and its practical workarounds, plus operational cautions like session expiry and retries.
Entra ID Automation #5 PIM and Auditing: Killing Standing Admins, Logs, and Access Reviews
The track finale on privilege and accountability: the PIM structure that replaces standing admin rights with eligibility and time-boxed activation, Graph roleEligibilityScheduleRequests and the self-activation API, the pattern combining role-assignable groups with PIM, pulling audit and sign-in logs through the API to alert on high-risk events, automating periodic access reviews, and the adoption order for everything in this track.
Entra ID Automation #4 Conditional Access: Managing Policy as Code
The sign-in-moment defense line, from an automation angle: the if-then structure of signals, decisions, and enforcement, CRUD on policies through the Graph conditionalAccess endpoint, the policy-as-code flow of source control, review, and CI deployment, why every new policy must run in report-only mode first, the rule that break-glass accounts are excluded from every policy, and the 30-day restore window for accidentally deleted policies.
Entra ID Automation #3 Group Design: Dynamic Groups, Group-Based Licensing, Access Packages
Designing groups — the unit of access management — for automation: when to use security groups versus Microsoft 365 groups, dynamic groups whose membership is computed from attribute rules and their P1 licensing, rule syntax and processing delays as operational realities, group-based licensing that automates assignment and reclamation on entry and exit, the security boundary of role-assignable groups, and access packages that productize self-service access requests.
Entra ID Automation #2 The User Lifecycle: Creation, Disabling, and Lifecycle Workflows
Handling joiners, movers, and leavers in code: why attribute standardization matters when creating users through the Graph API, delivering initial credentials with a Temporary Access Pass, why offboarding starts with disabling rather than deletion and how the 30-day soft delete works, why group-based licensing beats per-user assignment, and the product features that package the whole flow — Entra lifecycle workflows and HR-driven provisioning.
Entra ID Automation #1 The Big Picture: Tenants, Directory Objects, and the JML Lifecycle
First post in a series on automating Microsoft Entra ID administration with code: where Entra ID (renamed from Azure AD) sits, the structure of a tenant and its directory objects — users, groups, apps, devices — the joiner-mover-leaver (JML) model that forms the backbone of account automation, the tooling landscape across Graph API, PowerShell, and IaC, and how features map to the Free, P1, P2, and Governance license tiers.
Microsoft Graph in Practice #7: Operations — Throttling, Pagination, Delta Queries, Change Notifications
Raising Graph automation to operational grade: retries that honor 429 and Retry-After, the pagination (@odata.nextLink) that silently truncates data when missed, delta queries replacing polling (deltaLink state management), change notification subscriptions (validation handshake, renewal, lifecycleNotificationUrl), and JSON batching — closing the series.
Microsoft Graph in Practice #6: Teams — Reading Messages, and the Three Routes for Sending Notifications
Facing the most famous wall in Graph's Teams integration head-on: reading teams, channels, and messages; why application permissions can't post to channels (migration-only), and the three alternative routes — a delegated automation account, Workflows incoming webhooks, and bots — with selection criteria.
Microsoft Graph in Practice #5: Files in OneDrive and SharePoint — Upload Sessions and Sharing
Automating files with Graph: the shared drive/driveItem model, the path differences between personal OneDrive and SharePoint site drives, downloads and simple uploads up to 250MB, upload sessions for large files (320KiB-multiple chunks, resume), creating sharing links, and narrowing permissions with Sites.Selected.
Microsoft Graph in Practice #4: Automating Mail and Calendar — Reading, Sending, Creating Events
Automating Outlook mail and calendar with Graph: inbox queries with filters, report delivery via sendMail and the cautions around bulk sending, attachments, creating meetings with invitations, availability lookups with getSchedule, and the classic trap of time zones — all in working code.