MS Entra – Users – Update User

Update a user in Entra ID.

Action details

Property	Value
Action label	MS Entra – Users – Update User
Category	CloudTools
Apex class and method	UpdateEntraUser.updateUser
Input type	UpdateEntraUser.UpdateEntraUserInput
Output type	List<UpdateEntraUser.UpdateEntraUserOutput>
Authorization	Microsoft 365 connector; supported authorization depends on the endpoint and target.
Microsoft Graph request	PATCH /users/{userIdOrPrincipalName}

Prerequisites and permissions

Configure a CloudTools Connector with Connector Type set to Microsoft 365. Complete sign-in for OAuth Delegated (Authorization Code). For supported OAuth Application (Client Credentials) requests, grant application permissions and administrator consent. The identity must have access to the selected resource; directory operations can also require Microsoft Entra roles. Use Creating an Entra ID App and Integration Connectors for setup.

The action permission provider declares these alternatives. They are not cumulative requirements, not all are least privileged, and a scope can have target-specific restrictions. Check the Microsoft operation reference before selecting permissions.

Permission type	Declared alternatives
Delegated	User.ReadUpdate.All, User.ReadWrite.All, Directory.ReadWrite.All
Application	User.ReadUpdate.All, User.ReadWrite.All, Directory.ReadWrite.All

Endpoints: /users/{id | userPrincipalName}

See the Microsoft operation and permissions reference.

Inputs

Input	Apex field	Type	Required	Description
User Id or Principal Name	userIdOrPrincipalName	String	Yes	User id or user principal name to update
Account Enabled	accountEnabled	Boolean	No	Whether the account is enabled
Display Name	displayName	String	No	Display name for the user
Given Name	givenName	String	No	Given name for the user
Surname	surname	String	No	Surname for the user
Job Title	jobTitle	String	No	Job title for the user
Mail	mail	String	No	Email address for the user
Mobile Phone	mobilePhone	String	No	Mobile phone number for the user
Office Location	officeLocation	String	No	Office location for the user
Preferred Language	preferredLanguage	String	No	Preferred language for the user
Usage Location	usageLocation	String	No	Two-letter country code for the user
Department	department	String	No	Department for the user
Mail Nickname	mailNickname	String	No	Mail nickname for the user
Business Phones	businessPhones	String	No	Comma-separated business phone numbers
Other Mails	otherMails	String	No	Comma-separated additional email addresses

Supply a nonempty list with a non-null first request. Graph actions process only that first request. Global inputs do not expose connectorId; subscriber Apex and Flow use CloudTools connector selection. Use Microsoft Graph resource IDs or the specifically documented user identifier, and resolve dynamic values before invocation.

Outputs

Returns one operation result after the call returns. Inspect success and message; an accepted or started operation may still require completion checks. Exceptions are generally thrown for failures rather than returned as success=false.

Output	Apex field	Type	Description
Success	success	Boolean	Whether the update succeeded
Message	message	String	Result message

Behavior and limits

Only documented writable inputs are sent. Blank optional strings are generally omitted rather than used to clear existing values; inspect the action body when a workflow needs explicit removal of a property.

Use in Flow

Use MS Entra – Users – Update User where supported. Use a Microsoft 365 application connector configured as Set as default for Flow automations only if the endpoint and target support application access. Supply required values, retain useful outputs, and add fault handling. Delegated connections are not supported for CloudTools Flow automation. The action processes only the first input request.

Use in custom Apex

This subscriber-org example uses the Apptigent namespace. Replace identifiers and example values before use. Configure the connector, complete authorization first, run in a context permitting callouts, and handle exceptions, empty results, and unmapped fields.

Apptigent.UpdateEntraUser.UpdateEntraUserInput request =
    new Apptigent.UpdateEntraUser.UpdateEntraUserInput();
request.userIdOrPrincipalName = '87d349ed-44d7-43e1-9a83-5f2406dee5bd';
request.displayName = 'Adele Vance';
request.jobTitle = 'Product Marketing Manager';
request.mobilePhone = '+1 425 555 0109';
request.officeLocation = '18/2111';
request.preferredLanguage = 'en-US';
request.businessPhones = '+1 425 555 0109';



List<Apptigent.UpdateEntraUser.UpdateEntraUserOutput> results =
    Apptigent.UpdateEntraUser.updateUser(
        new List<Apptigent.UpdateEntraUser.UpdateEntraUserInput>{ request }
    );
System.debug(results);

Use in a Lightning Web Component

Use updateEntraUser from msEntraConnectorLib through MSEntraConnectorController. These c/ imports apply in the same namespace. Set request.connectorId for direct MSEntraAction calls. The controller captures the request selection for MSEntraAction.

Global input	LWC request mapping
userIdOrPrincipalName	request.userIdOrPrincipalName
accountEnabled	request.accountEnabled
displayName	request.displayName
givenName	request.givenName
surname	request.surname
jobTitle	request.jobTitle
mail	request.mail
mobilePhone	request.mobilePhone
officeLocation	request.officeLocation
preferredLanguage	request.preferredLanguage
usageLocation	request.usageLocation
department	request.department
mailNickname	request.mailNickname
businessPhones	request.businessPhones (converted by the controller)
otherMails	request.otherMails (converted by the controller)

entraActionExample.js

import { LightningElement } from 'lwc';
import { updateEntraUser } from 'c/msEntraConnectorLib';

export default class EntraActionExample extends LightningElement {
    result = null;
    errorMessage = '';
    isRunning = false;
    completed = false;

    async handleRun() {
        if (this.isRunning || this.completed) return;
        this.isRunning = true;
        this.errorMessage = '';
        try {
            const request = { connectorId: 'REPLACE_WITH_CONNECTOR_RECORD_ID' };
            request.userIdOrPrincipalName = '87d349ed-44d7-43e1-9a83-5f2406dee5bd';
            request.displayName = 'Adele Vance';
            request.jobTitle = 'Product Marketing Manager';
            request.mobilePhone = '+1 425 555 0109';
            request.officeLocation = '18/2111';
            request.preferredLanguage = 'en-US';
            request.businessPhones = ['+1 425 555 0109'];
            this.result = await updateEntraUser(request);
            this.completed = true;
        } catch (error) {
            this.errorMessage = error.requiresInteractiveAuthorization
                ? 'Sign in to Microsoft for the connector, then try again.'
                : error.message || 'The Entra action failed.';
        } finally {
            this.isRunning = false;
        }
    }
}

entraActionExample.html

<template>
    <lightning-button label="Run action" onclick={handleRun}
        disabled={isRunning}></lightning-button>
    <p role="alert">{errorMessage}</p>
</template>

The library returns one mapped DTO or null. The controller can flatten nested fields, serialize data, or map an action result into an operation DTO. rawJson contains serialized mapped Apex data rather than the untouched Graph response.

Use getMSEntraAuthorizationState, beginMSEntraAuthorization, and createMSEntraOAuthMessageHandler to arrange delegated sign-in. The library normalizes errors but does not automatically sign in or retry. Reset completed for a new deliberate operation, and inspect resource state before retrying a mutation with an uncertain outcome.

Error handling and troubleshooting

Symptom	What to check
Required fields error	Supply a nonempty request list and required or conditionally required inputs. For LWC, use the mapped field names.
Authorization or access denied	Check connector selection, sign-in, endpoint/target permission support, administrator consent, directory roles, and resource access.
Resource not found	Check Microsoft IDs and parent resource relationships. Preserve group/drive/item associations and mailbox/calendar/event IDs.
Missing or unexpected output	Check query support, pagination, wrapper versus item models, public-only properties, and mapped DTO fields.
Operation rejected	Inspect the Microsoft error, supported writable fields, group/calendar restrictions, recipient/license data, and file transfer limits.

See Entra connector introduction.