CLI Reference

Global Flags

Flag	Description
`-h, --help`	Show help for any command

Search Commands

`openapi-search`

Search a pre-processed index of the Microsoft Graph OpenAPI specification to find available endpoints, required scopes, and API details.

msgraph openapi-search [flags]

At least one of --query, --resource, or --method is required.

Flags:

Flag	Type	Description	Default
`--query`	string	Free-text search (searches path, summary, description)	—
`--resource`	string	Filter by resource name (e.g. users, groups, messages)	—
`--method`	string	Filter by HTTP method (GET, POST, PUT, PATCH)	—
`--limit`	int	Max results	20

Examples:

msgraph openapi-search --query "list users"
msgraph openapi-search --resource users --method GET
msgraph openapi-search --query "send mail" --method POST

Output: JSON with count and results array.

`api-docs-search`

Search a pre-processed index of Microsoft Graph API documentation to find per-endpoint permissions, supported query parameters, default properties, required headers, and endpoint-specific gotchas.

msgraph api-docs-search [flags]

Use --endpoint to look up endpoint details (permissions, query params, headers). Use --resource to look up resource properties (filter operators, default status).

Flags:

Flag	Type	Description	Default
`--endpoint`	string	Search by endpoint path (e.g. /users, /me/messages)	—
`--resource`	string	Search by resource type name (e.g. user, group, message)	—
`--method`	string	Filter by HTTP method (GET, POST, PUT, PATCH)	—
`--query`	string	Free-text search across all fields	—
`--limit`	int	Max results	10

Examples:

msgraph api-docs-search --endpoint /users --method GET
msgraph api-docs-search --endpoint /me/messages
msgraph api-docs-search --resource user
msgraph api-docs-search --resource group --query "filter"
msgraph api-docs-search --query "ConsistencyLevel"

Output: JSON with matching endpoint documentation including permissions, query parameter support, headers, and property details.

`sample-search`

Search a curated library of community-contributed Microsoft Graph API query samples to find the right API call for a given task. These samples map natural-language intents (e.g. “list all Conditional Access policies”) to exact Graph API queries, including multi-step workflows.

msgraph sample-search [flags]

Flags:

Flag	Type	Description	Default
`--query`	string	Free-text search (searches intent and query fields)	—
`--product`	string	Filter by product (entra, intune, exchange, teams, sharepoint, security, general)	—
`--limit`	int	Max results	10

Examples:

msgraph sample-search --query "conditional access policies"
msgraph sample-search --query "send email"
msgraph sample-search --product entra
msgraph sample-search --query "managed devices" --product intune

Output: JSON with matching samples including intent, Graph API queries, and product category.

Execution Commands

`graph-call`

Execute an HTTP request against the Microsoft Graph API. The URL can be a full URL or a relative path starting with /.

By default, only GET requests are allowed. Use --allow-writes to enable POST, PUT, and PATCH requests. DELETE is always blocked for safety.

msgraph graph-call <METHOD> <URL> [flags]

Args:

Arg	Description
`METHOD`	HTTP method: GET, POST, PUT, PATCH
`URL`	Full URL or relative path (e.g. `/me`, `/users`, `/me/messages`)

Flags:

Flag	Type	Description	Default
`--allow-writes`	bool	Allow POST, PUT, PATCH requests (agent must confirm with user)	false
`--body`	string	JSON request body	—
`--headers`	strings	Custom headers (key:value)	—
`--api-version`	string	`v1.0` or `beta`	beta
`--select`	string	OData $select	—
`--filter`	string	OData $filter	—
`--top`	int	OData $top	—
`--expand`	string	OData $expand	—
`--orderby`	string	OData $orderby	—
`--scopes`	strings	Additional permission scopes to request	—
`--output`	string	`json` or `raw`	json

Examples:

msgraph graph-call GET /me
msgraph graph-call GET /me/messages --select "subject,from" --top 10
msgraph graph-call POST /me/messages --body '{"subject":"Hello"}' --allow-writes

Output: JSON with statusCode and body.

Authentication Commands

`auth signin`

Authenticate to a Microsoft 365 tenant. For delegated auth, uses interactive browser or device code flow. For app-only auth (client secret, certificate, managed identity, workload identity), verifies that credentials are valid.

msgraph auth signin [flags]

Flags:

Flag	Type	Description
`--device-code`	bool	Use device code flow instead of browser (delegated only)
`--scopes`	strings	Permission scopes to request (default: User.Read, delegated only)

App-only behavior: When app-only auth is detected (via environment variables), auth signin acquires a token to verify credentials and shows the auth status. The --device-code and --scopes flags are ignored.

Output: JSON with sign-in status.

`auth signout`

Clear the current authentication session and token cache.

msgraph auth signout

Output: JSON confirmation.

`auth status`

Display the current sign-in state, including the signed-in user/app and tenant.

msgraph auth status

Output:

{
  "signedIn": true,
  "username": "user@contoso.com",
  "tenantId": "common",
  "clientId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
  "authMethod": "delegated",
  "environment": "login.microsoftonline.com"
}

For app-only auth, authMethod shows the detected method (e.g. client-secret, certificate, managed-identity, workload-identity) and username reflects the auth type.

`auth switch-tenant`

Sign out of the current tenant and sign in to a new one.

msgraph auth switch-tenant [tenant-id] [flags]

Args:

Arg	Description
`tenant-id`	The Entra ID tenant ID to switch to

Flags: Same as auth signin.

Utility Commands

`completion`

Generate shell autocompletion scripts for msgraph.

msgraph completion <shell>

Supported shells: bash, fish, powershell, zsh.

See msgraph completion <shell> --help for instructions on how to install the generated script.