Resources · n8n integration

Microsoft Graph Security n8n integrationAutomate Microsoft Graph Security with n8n.

Your secure score moves, and nobody watches it on a Tuesday. The Microsoft Graph Security n8n integration hands a workflow 5 operations across 2 resources: read one score, list them all, read or list control profiles, and update one. This node has no trigger, so the starting point is yours to pick.

Try the Microsoft Graph Security integration on n8nSee the 5 operations

Verified Trustpilot reviews · AI, automation & growth agency

Why automate

What does the Microsoft Graph Security n8n integration actually do?

The Microsoft Graph Security node lets an n8n workflow read secure score data and change the analyst setting on a control. It exposes 5 operations spread over 2 resources: Secure Score, with Get and Get Many, and Secure Score Control Profile, with Get, Get Many and Update. That is the whole surface of the node, and every field below comes from it.

Reporting is the obvious first job. A Schedule Trigger, which fires a workflow at a fixed interval, runs Get Many Secure Scores every morning and appends the rows to a Google Sheets tab. Nobody opens a portal, and the history builds itself while the sheet stays readable by people who never log into Azure.

The second job is narrowing. Get Many Secure Score Control Profiles accepts a Filter Query Parameter, so a workflow can pull only the profiles whose identifier starts with a given prefix and post that short list to a Slack channel. A team of 3 people gets one message with the profiles that concern them, instead of a full catalogue nobody reads.

The third job is the only write in the node. Update a Secure Score Control Profile sets State on a control, which is the analyst driven setting: Default, Ignored or Third Party. A review meeting ends with 4 decisions, and the workflow applies them in one run rather than 4 manual edits.

Some work sits outside these 5 operations. When the operation you need is missing from the dedicated node, the HTTP Request node calls any endpoint of the API and reuses the same credential through its predefined authentication, so you stay on one connection instead of managing a second one.

One structural point shapes every workflow here: this tool has no trigger node in n8n. A workflow that concerns it starts with another starter, a Schedule Trigger at a fixed interval, an n8n Webhook called by a third-party service, or the trigger of another tool. If you are still weighing the platform itself, the n8n review covers that, and the n8n training covers building these workflows hands-on.

Connect

How do you connect Microsoft Graph Security to n8n?

  1. 01

    Register an application

    Open the Microsoft Application Registration Portal and select Register an application. Give the app a Name, then under Supported account types pick accounts in any organizational directory plus personal Microsoft accounts. Copy the OAuth Callback URL from your n8n credential into the Redirect URI (optional) field, choose Select a platform then Web, and select Register. Copy the Application (client) ID into n8n as the Client ID.

  2. 02

    Generate a client secret

    On the application page, open Certificates & secrets in the left navigation, then in Client secrets select + New client secret. Enter a Description, something like n8n credential, and select Add. Copy the Secret from the Value column and paste it into n8n as the Client Secret. Select Connect my account, log in to your Microsoft account, and allow the app to access your info.

  3. 03

    Check the account prerequisites

    Three things gate that consent screen: a Microsoft Azure account, at least 1 user account with access to the appropriate service, and, when a corporate Microsoft Entra account manages that user, an administrator who has enabled the option letting users consent to apps accessing company data on their behalf. The result is a credential, a stored connection created once in the Credentials menu and offered by the node in its dropdown.

Actions

What can the Microsoft Graph Security node do?

The Microsoft Graph Security node exposes 5 operations across 2 resources. For each one: the node as you configure it in n8n, the required fields, and our field notes.

Resources × operations matrix
ResourceGetGet ManyUpdate
Secure Score✓✓
Secure Score Control Profile✓✓✓

Secure Score

2 operations
01

Get a secure score

secureScore.get

What you see in n8n

Notes & use cases

Pulls back a single secure score, the one whose identifier you already hold, and returns it as one item for the rest of the workflow to use.

Key parameters

  • Secure Score ID: the ID of the secure score to retrieve, as text. It is required, so an empty value stops the node before any call goes out. When the identifier arrives from an earlier node, reference it with an expression, n8n's way of reading a value from the incoming item, written {{ $json.field }} where field is the key that holds the ID.
Use cases
a security lead who keeps one score identifier per audit round re-reads that exact record months later and writes it next to the previous one in Postgres.
02

Get many secure scores

secureScore.getAll

What you see in n8n

Notes & use cases

Lists secure scores rather than fetching one, which is what you want when the workflow needs a series instead of a single point.

Key parameters

  • Return All: on, n8n walks through the pages of the API and brings back every secure score. Off, Limit caps how many come back.
  • Limit: the maximum number of secure scores returned when Return All stays off.
  • Filter Query Parameter: a query parameter that filters the results, written the way the API expects, for example currentScore eq 13.
Use cases
a monthly board slide that shows how the score moved needs the full series, so Return All goes on and the filter stays empty.

Secure Score Control Profile

3 operations
03

Get a secure score control profile

secureScoreControlProfile.get

What you see in n8n

Notes & use cases

Reads one control profile, the record that describes a single security control, and hands it to the next node untouched.

Key parameters

  • Secure Score Control Profile ID: the ID of the control profile to retrieve, as text and required. It is an identifier, not the control's display name, so a workflow that only has a label has to resolve it first, typically through Get Many.
Use cases
a ticket that mentions one control by its identifier gets enriched automatically, the workflow reads that profile and pastes its content into the ticket thread before a human picks it up.
04

Get many secure score control profiles

secureScoreControlProfile.getAll

What you see in n8n

Notes & use cases

Browses the control profiles as a set, which is the operation to reach for when you are inventorying rather than inspecting.

Key parameters

  • Return All: on, the node pages through the API until every control profile has been retrieved. Off, it stops at Limit.
  • Limit: the maximum number of control profiles to return.
  • Filter Query Parameter: a query parameter that narrows the profiles returned, for instance startsWith(id, 'AATP') to keep one family of identifiers.
Use cases
a quarterly inventory dumped into MySQL, so the next quarter can be compared against it row by row.
05

Update a secure score control profile

secureScoreControlProfile.update

What you see in n8n

Notes & use cases

Writes back to a control profile. It is the only operation in this node that changes anything on the Microsoft side, the other 4 just read.

Key parameters

  • Secure Score Control Profile ID: the ID of the control profile to update. Required.
  • Provider: the name of the provider of the security product or service, required, for example SecureScore.
  • Vendor: the name of the vendor of the security product or service, required, for example Microsoft.
  • State, in Update Fields: the analyst driven setting on the control, with three choices, Default, Ignored and ThirdParty.
Use cases
after a review, the controls a team decided to leave to an external product are set to Third Party in one run.
Need help

Need help automating Microsoft Graph Security with n8n?

A person reads every message.

FAQ

Microsoft Graph Security and n8n, answered

01Is the Microsoft Graph Security n8n integration free?
Yes on the n8n side. The node ships with n8n, so there is nothing to install and nothing extra to pay for it, whether you run n8n Cloud, the hosted offer run by n8n, or a self-hosted instance in its Community Edition under the Sustainable Use license. A workflow behaves the same way in both setups, which matters if you prototype on Cloud and move to your own server later. What the Microsoft side costs is a separate question and this page does not cover it, because that pricing is not part of what the node exposes.
02What credentials do you need for Microsoft Graph Security in n8n?
A Microsoft credential, and OAuth2 is the supported authentication method. Concretely: a Microsoft Azure account, at least 1 user account with access to the appropriate service, and an application registered with the Microsoft Identity Platform that gives you a Client ID and a Client Secret. When a corporate Microsoft Entra account manages the user, an administrator needs to have enabled the option that lets users consent to apps accessing company data on their behalf. You create that credential once in the Credentials menu and reuse it across workflows, and the generic Microsoft credential can serve other Microsoft nodes provided you grant it the scopes each one needs.
03What are the limits of the Microsoft Graph Security node?
The node covers 5 operations across 2 resources, Secure Score and Secure Score Control Profile. On the two list operations, results arrive page by page: Return All walks through every page, and with it off, Limit caps the number of items. When the operation you are after is not in the catalogue of this node, the HTTP Request node calls any endpoint of the API and reuses the same credential through its predefined authentication, so you do not set up a second connection to do it. That is the standard way out, and it keeps one credential in charge of everything.
04Does Microsoft Graph Security react in real time in n8n?
No, because this tool has no trigger node in n8n. A trigger is the node that starts a workflow, and here you supply your own. Three options: a Schedule Trigger that runs at a fixed interval, which fits a daily or weekly read of the scores; an n8n Webhook, a URL that a third-party service calls, when something outside can notify you; or the trigger of another tool already in your stack of automations. The Microsoft Graph Security node then sits after that starter and does the reading or the update once the run begins.
05n8n or Make for Microsoft Graph Security?
It depends on 4 things, and neither tool is the wrong answer. Hosting: n8n self-hosts with Docker or npm, or runs on n8n Cloud, while Make is hosted and has no self-hosting option. Data control follows from that, since self-hosting keeps the score data inside your own infrastructure. Cost model: Make bills per operation, which is worth modelling when a workflow lists every control profile on a schedule. Visual logic: both build workflows visually, and the way each one handles branching and expressions is a matter of habit more than capability.
Hack'celeration Lab

Get our weekly integration tips.

No spam. Unsubscribe anytime.

Same platform

Other docs you might need on this stack.

Browse all integrations