Microsoft Entra ID Webhook Setup Guide

A user subscription needs User.Read.All and a group subscription needs Group.Read.All, the same permissions the connector already uses to list users and groups. No webhook-specific permission has to be added.

• If the connection can list users and groups today, it can receive their webhooks.
• A connection whose custom scopes leave out one of these permissions cannot create that subscription, so its events are never delivered.

Microsoft Graph expires user and group subscriptions after at most 29 days, and StackOne does not renew them. Delivery stops silently when a subscription lapses; no error is raised.

• Reconnect the account to create fresh subscriptions and resume delivery.
• Reconnecting also removes the previous subscriptions, so no duplicates are left behind.

Microsoft Graph verifies the notification URL before it creates each subscription, and the subscription is refused if the check is not answered.

• Validation Check (webhook_validation_check) — Answers Microsoft Graph’s validation request when a subscription is created. Must be enabled; without it no subscription can be created and no other event is delivered.

Events covering users in the directory. Microsoft Graph reports a new user, a changed user, a soft-deleted user and a restored user as the same change, so they share one event.

• User Updated (user_updated) — Fired when a user is created, changed, moved to deleted items, or restored
• User Deleted (user_deleted) — Fired when a user is permanently deleted

Events covering groups in the directory, including their membership.

• Group Updated (group_updated) — Fired when a group is changed, has members added or removed, is moved to deleted items, or is restored. A newly created group may raise no notification
• Group Deleted (group_deleted) — Fired when a group is permanently deleted

Notifications about the subscriptions themselves rather than about directory changes.

• Subscription Lifecycle Notification (subscription_lifecycle_notification) — Fired when Microsoft Graph reports that a subscription must be reauthorized, has been removed, or missed notifications

A notification identifies what changed rather than carrying it. Each one holds the id of the user or group, so read the full record with Get User or Get Group when you need its contents.

• Group membership changes list the affected member ids under members@delta in the notification’s resourceData; an entry that carries @removed is a member who was removed.
• A user or group that was moved to deleted items can no longer be read with Get User or Get Group.

Microsoft Graph can send several notifications in one request. StackOne splits the batch and delivers each notification as its own event.

Microsoft Graph delivers at least once and retries a failed delivery for up to four hours, so the same notification can arrive more than once.

• Treat each notification as a signal to re-read the user or group rather than as a change log.
• Make processing idempotent on the user or group id so a repeated notification is harmless.