60 admin flows.
One practical catalog.

1 · Prepare the app and permissions

1. Open the Entra admin center in the same cloud as your tenant, then open App registrations.
2. Choose the app registration you intend to use. Copy its Application (client) ID and your tenant's Directory (tenant) ID.
3. Open API permissions → Add a permission → Microsoft Graph → Application permissions.
4. Open the recipe, find Application permissions to check, and add only the permissions that Microsoft documents for that exact endpoint. Ask an authorized admin to select Grant admin consent.
5. Use an approved secret or certificate. If you use a client secret, copy its Value when created and store it in your organization's approved vault. Never paste a secret in the URI, a message, a screenshot, or public repository.

Important: Application permissions allow unattended access to tenant data. The permission chips are guidance, not a live check of your tenant. Do not add all cookbook permissions to one app just because they appear here.

2 · Create a test flow

1. In Power Automate, choose Create → Scheduled cloud flow. Give it a name and set it to run weekly while you are testing.
2. Choose New step, search for HTTP, and select the HTTP action (often marked Premium). If your tenant offers an approved Microsoft Entra ID HTTP connector or custom connector instead, follow your admin's connector instructions.
3. For a first test, use a read-only inventory recipe, such as guest account inventory, and a restricted recipient. Keep the flow turned off until the test response is correct.

3 · Prepare the request URL

1. Choose your cloud below. Worldwide tenants use graph.microsoft.com; GCC High tenants use graph.microsoft.us. The Graph and sign-in hosts must both belong to your tenant's cloud.
2. Open a recipe and select Copy full endpoint. The endpoint combines the cloud host, /v1.0, and that recipe's path.
3. Paste the copied full URL into the HTTP action's URI box. For a first test, use the Worldwide or GCC High option selected here and keep the request unchanged.

4 · Capture a sample body with Compose

1. First add and configure only the HTTP action. Add a Compose action immediately after HTTP.
2. In Compose Inputs, select the HTTP action's Body dynamic-content token. Or choose Expression and enter body('HTTP'); replace HTTP with the actual name of your HTTP action.
3. Select Save, then Test and run the flow once. The Compose step records the real JSON body returned by Graph.
4. In the run history, expand Compose and copy its Outputs JSON. Treat it as private tenant data; use a sanitized sample if sharing it.

5 · Generate the Parse JSON schema

1. Return to edit mode and add Parse JSON after Compose.
2. For Content, select the HTTP Body token (or Compose Outputs). For a beginner, use the HTTP Body token so the parser reads the response directly.
3. Choose Generate from sample, paste the JSON you copied from Compose Outputs, then select Done. Power Automate creates the schema for Parse JSON.
4. Save and test again. Confirm both Compose and Parse JSON succeeded and that Parse JSON exposes the expected fields.

Order matters: run HTTP plus Compose once to get a real sample first. You cannot generate the Parse JSON schema until you have sample JSON. You do not need a working Parse JSON action for that first sample run.

6 · Use the parsed result

1. For a collection response, set Apply to each to the Parse JSON value array, not the whole Body object.
2. For a single-object response (such as the organization profile), use its fields directly; do not add a loop.
3. After Parse JSON is working, you may remove the temporary Compose action. Keep it only if you need it for troubleshooting, and protect run history because it can contain user and tenant data.
4. Continue with the recipe-specific steps shown when you open each card.

7 · Run once and read the result

1. Open the run history and expand the HTTP action. A 200 status means the request succeeded. In the body, a collection normally has a value array.
2. A 401 usually means sign-in, tenant, audience, or credential trouble. A 403 usually means the app permission or admin consent is missing. Read the error body; don't post it publicly if it contains tenant or user details.
3. A 404 can mean a wrong URL/cloud or unavailable API; a 429 means slow down and retry after Graph's Retry-After interval.

8 · Turn the response into a report

1. For an endpoint that returns a collection, add Apply to each and select the Parse JSON value array—not the entire Body object.
2. Inside the loop, use the current item (the expression item()) when appending one record. Do not append the whole array into an array variable.
3. Use Select to choose only report columns, then Create HTML table or an approved notification action.
4. Test with yourself or a restricted admin mailbox before adding recipients. Directory exports often contain sensitive employee or security data.

9 · Add pagination before production

1. Graph can split a long list across pages. When the response includes @odata.nextLink, the response is not complete yet.
2. Beginner pattern: set a string variable called nextLink to the first full URL; use a Do until loop while it is not empty.
3. Inside the loop, call HTTP with nextLink, process that response's value array, then set nextLink to coalesce(body('HTTP')?['@odata.nextLink'], '').
4. Make sure the loop performs the first HTTP request before checking for an empty next link. Use an iteration limit appropriate for your tenant.