Description:

This step retrieves all Microsoft Entra ID groups for a specified user.

The Get EntraID User Groups workflow step connects to Microsoft Entra ID (formerly Azure Active Directory) and retrieves all security groups and Microsoft 365 groups associated with the specified user account.

The retrieved group information is stored in a FlowWright variable or global variable, allowing subsequent workflow steps to process, validate, or iterate through the user's group memberships.

The step supports:

• Microsoft Entra ID user group membership retrieval
• Configurable Entra ID connections
• Lookup by User Principal Name (UPN)
• Storage of group collections in workflow variables
• Integration with Microsoft Graph through FlowWright connections

This step can be used for:

• User access reviews
• Security audits
• Role verification
• Identity reporting
• Access validation
• Identity lifecycle management
• Business process automation

Usage:

The Get EntraID User Groups step is typically placed after user information has been collected or selected within a workflow.

The workflow stores the retrieved group collection in the specified workflow variable or global variable.

Once the group memberships have been retrieved, later workflow steps can:

• Validate user access
• Generate membership reports
• Perform security audits
• Make workflow decisions based on group membership
• Synchronize authorization data
• Execute identity management processes

You need to set up an EntraID connection. Go to Integration > Connections > Generic Connections. On the Manage Generic Connections page, click Actions > Create. A sample connection is included here for reference. 

Example:

Let’s build and execute the “clsGetEntraIDUserGroupsDef” example:

• Create a new process definition named “clsGetEntraIDUserGroupsDef” and open it in designer mode. 
• Drag a “clsGetEntraIDUserGroups” step to the canvas.
• Connect the dots between the “Start” and “clsGetEntraIDUserGroups” steps.
• Define a variable or a global to store the user groups' results.
• Click the "clsGetEntraIDUserGroups" step to configure its "Required" properties. Provide a name for the step. Select the EntraID connection from the drop-down list. Enter the “Username”. Provide the variable or global reference. Click the Save button. Note: Click the "AI Predict" button to have the Copilot add new process steps that match your process description. 

• The “Logging” configuration is necessary for documentation and also measures workflow progress and percent complete. This is achieved by configuring the step state and percent fields individually, as shown below. Configure the “Logging” using the following properties.

• Save the Process Definition. Create a new Process Instance and execute it. When the workflow reaches the Get User Groups step, FlowWright connects to the configured Microsoft Entra ID tenant and retrieves all groups associated with the specified user account. The complete group collection is stored in the specified workflow variable or global variable. If the group memberships are successfully retrieved, the workflow follows the True return path. If the user cannot be found, the connection cannot be established, or the group information cannot be retrieved, the workflow follows the False return path.

Tips:

• Verify that the Microsoft Entra ID connection has been configured before using this step.
• Use workflow variables to dynamically specify the username.
• Store the returned group collection in a workflow variable that can be referenced by subsequent workflow steps.
• Use the returned data together with For Each or collection-processing steps to validate or process user memberships.
• Use this step when implementing role-based workflow routing or access validation.
• Use the True and False return paths to implement appropriate success and error handling.
• Combine this step with group management or user provisioning steps to automate identity administration.

Notes:

• A valid Microsoft Entra ID connection must exist before this step can execute.
• The configured connection must have sufficient Microsoft Graph permissions to read user group memberships.
• The specified User Principal Name (UPN) must exist in Microsoft Entra ID.
• Network connectivity or authentication issues may prevent successful retrieval.
• The workflow should include appropriate error handling for the False return path.
• The number of groups returned depends on the user's assigned memberships within the Microsoft Entra ID tenant.

Definition Sample:

You may download the sample definition(s) from the link provided and later import them (drag-and-drop) into your FlowWright Process Definition (XML file) or Form Definition (HTML file) page.

Note: Verify and complete any missing configuration after importing the sample, including:

• Microsoft Entra ID connection
• Username mapping
• Output variable mapping
• Workflow variable mappings
• Microsoft Graph permissions
• Environment-specific settings

After verifying the configuration, save the Process Definition before execution.

Click here to download the sample file.