Introducing Netra: an AI agent for Microsoft Entra ID

Which groups does a user belong to? What applications are assigned to them? Which accounts are disabled? What does a Conditional Access policy include or exclude?

These are everyday questions for identity and IT teams. Answering them can mean moving between admin screens, finding the right Microsoft Graph endpoints, writing a script, or combining spreadsheet exports.

We built Netra AI to give teams a simpler starting point: ask the question.

Netra is a self-hosted AI agent for Microsoft Entra ID. It helps you explore your tenant's users, groups, applications, devices, and configuration through a conversation, then review and export the results.

Start with a question. Keep investigating.

An initial lookup often leads to another question.

You might start with:

Show users in the Engineering department, including their job titles and whether their accounts are enabled.

Then narrow the result:

Which of those accounts are disabled?

And ask for the details you need:

Include their sign-in names and export the results.

Netra can build follow-ups on previously retrieved results. You can examine the records in a table, refine your question, and download a CSV for further review.

That is the experience we want: spend your attention on what the answer means, rather than rebuilding the query each time the question changes.

Ask about the details behind your directory

Netra goes beyond a basic user search. Its supported Microsoft Graph operations cover group relationships, enterprise applications, app registrations, directory roles, authentication-method registrations, Conditional Access configuration, and more.

For example:

• Groups: Which users belong to both of these groups?
• Applications: Which enterprise applications are assigned to this user directly or through their direct groups?
• Devices: Show disabled Entra ID devices and their operating systems.
• Authentication: What authentication methods are registered for this user?
• Policies: Which users and groups does this Conditional Access policy exclude?

These questions use the permissions and data available in your connected tenant. Some capabilities require additional Graph permissions or Entra ID licensing. The question library provides examples you can adapt to your environment.

The current beta uses read-only Graph operations. Its purpose is to help you investigate and understand your directory—not make account or permission changes.

Your results are more than a chat response

A useful answer should let you inspect the underlying records, not leave you with only a paragraph of AI-generated text.

Netra retrieves and processes directory data using code and, where configured, a local database. It keeps saved results outside the language model's context and supplies the model with compact previews or selected information.

In practical terms, the model does not need every retrieved record pasted into its conversation to help you work with the dataset. The records remain available for tables, further analysis, and exports.

Netra can query Microsoft Graph directly, use supported data from an optional local snapshot, or combine the two. Live queries retrieve current information; snapshot-based answers reflect the last successful refresh. Review the data source and any incomplete results before using an answer to make an operational decision.

Run it in your environment

You deploy Netra and choose a supported AI provider, including options such as Azure OpenAI, OpenAI, Anthropic, and Google, or compatible local models through Ollama.

Self-hosting gives you control over the application and its stored data. When you choose an external AI provider, prompts and selected directory context are sent to that provider, so that choice should follow your organization's data-handling requirements.

Netra builds on the same agent foundation as Tako AI for Okta, adapted for Entra ID and Microsoft Graph.

Put your first question to Netra

Netra AI is available now in beta. Getting started involves deploying the application, connecting an Entra ID app registration with the required read permissions, and configuring your AI provider. The current beta connects one commercial Entra ID tenant per deployment.

Start with a question your team regularly answers manually. Review the returned records, ask a follow-up, and see whether the conversation makes that work easier.

Try Netra AI on GitHub to see the demonstration and follow the setup guide.

Have an Entra ID question you would like Netra to handle? Tell us about it.

Sources

• Fctr Identity: Netra AI overview, demonstration, and setup
• Netra AI documentation: Administrator question library
• Netra AI documentation: Supported Microsoft Graph reads
• Netra AI documentation: Data sync and CLI queries