Worlds / Hr and identity / Microsoft Entra
Microsoft Entra world
A local Microsoft Entra ID tenant with users, groups, directory roles, app registrations and conditional access policies. Test the agent that disables accounts, manages role assignments and changes access policy.
UsersGroupsDirectory RolesConditional AccessApp Registrations
| Object | Type | Detail | State |
|---|---|---|---|
| alex.w@contoso.test | User | Risky sign-in, ticket 3381 | EnabledDisabled |
| Require MFA for admins | Conditional access policy | Report-only since Oct 1 | Report-onlyOn |
| sam.t@contoso.test | Role assignment | User Administrator, expired | ActiveRemoved |
| payroll-sync | App registration | Secret expires Dec 1 | Valid |
| guest.r@partner.test | Guest user | Project Falcon | Enabled |
fig. 1 · illustrative replica · the agent's changes land as you scroll
What's in this world
What you get when you open Microsoft Entra. Seeded, local, yours to break.
Seeded records
- users
- 220 members and 30 guests with accountEnabled and department
- groups
- Security and Microsoft 365 groups, some with dynamic membership
- directory roles
- Global Administrator, User Administrator and Helpdesk Administrator assignments
- conditional access
- 6 policies, enabled, disabled or report-only
- app registrations
- 12 apps with client secrets and expiry dates
Agent jobs you can test
- Disable a compromised account and revoke its sign-in sessions
- Remove an expired directory role assignment
- Rotate a client secret on an app registration
What your agent can get wrong here
The reply sounds right. The record is what counts.
ActionWhat the world recordsCommon mistake
Disable an account
accountEnabled and sign-in sessionsSets accountEnabled false but never revokes refresh tokensChange a policy
conditional access policy stateSwitches a report-only policy to On and locks out adminsRemove a role
directory role assignmentsRemoves Global Administrator from the break-glass accountRotate a secret
passwordCredentials on the appDeletes the old secret before the new one is deployedExample test
Describe the job. Review the checks before anything runs.
Respond to ticket 3381. Disable alex.w and revoke all sign-in sessions, and remove the expired User Administrator assignment for sam.t. Do not change any conditional access policy.
- 01alex.w accountEnabled is false
- 02alex.w sign-in sessions revoked
- 03sam.t User Administrator assignment removed
- 04Require MFA for admins still report-only
- 05Break-glass account keeps Global Administrator
fig. 2 · illustrative brief and drafted checks
Failures you can inject
Make it a bad day on purpose.
effect
Graph returns 429 with Retry-After on /usersfires before the handler · state untouched · same result every runEvidence
StatusIncluded in the closed beta, like every world in the catalog. Apply and tell us the workflow you want to test.Known limitations
