How do I mock the Microsoft Graph / Entra ID API locally?

Install stunt, add a one-service block to stunt.yaml (adapter: embedded:entra-id-style), and run stunt up. You get a local, stateful stand-in for Microsoft Graph / Entra ID v1.0 — 9 routes over rest — with no remote account, no network, and no bills.

Is the Microsoft Graph / Entra ID mock data synthetic?

Yes — entirely. The adapter returns generated data only; stunt's adapter lint rejects real-looking secrets and PII at build time. It simulates the shape and behavior of Microsoft Graph / Entra ID (routes, status codes, pagination, webhooks), never real records.

← all adapters

entra-id-style

simulates Microsoft Graph / Entra ID v1.0

restadapter v0.1.09 routes

verification

SDKverified with microsoft-graph-client 3.0.7 (floor)· surface 9 · not implemented 8 · differs 3

use it

# add to stunt.yaml
services:
  entra-id:
    adapter: embedded:entra-id-style

# then
$ stunt up

The embedded: source extracts this adapter from the binary — no git clone, fully offline.

how to mock the Microsoft Graph / Entra ID API locally

Install stunt, paste the service block above into stunt.yaml, run stunt up — then point your client at localhost instead of Microsoft Graph / Entra ID. It works offline, keeps state across requests and restarts, and every response is synthetic: the route shapes, status codes, pagination, and webhook delivery follow the real Microsoft Graph / Entra ID v1.0 surface — the data is fake, the behavior is real.

backing stores

tokensrefresh_tokenscodesusersapplicationsservice_principals

api surface (9)

generated from the adapter manifest — exactly what boots, nothing more · covers 0% of the real API's 17531 routes (derived from spec msgraph-metadata v1.0 @ v1.0)

9 routes

GET/common/oauth2/v2.0/authorize

POST/common/oauth2/v2.0/token

GET/common/discovery/v2.0/keys

GET/v1.0/me

GET/v1.0/users

POST/v1.0/users

GET/v1.0/users/{id}

GET/v1.0/applications

GET/v1.0/servicePrincipals

SDK-verified behaviors (8)

✓authorize redirects with code + state
✓token exchange mints a JWKS-verifiable RS256 bearer
✓authProvider feeds the SDK; /v1.0/me resolves the token's user
✓users create + get round-trip (by id and by UPN)
✓users list pages via $top + $skipToken + PageIterator
✓applications + servicePrincipals reads
✓refresh grant rotates the token the SDK presents
✓error decoding: 404 and 401 surface as GraphError

Not implemented (8)

No $filter, $search, $orderby, $select, or $expand on Graph queries
No user PATCH or DELETE (/v1.0/users/{id})
No application or servicePrincipal create, update, or delete operations
No groups, members, or memberOf endpoints (/v1.0/groups)
No directory roles, role assignments, or organization endpoints
No B2B invitations (POST /invitations) or guest users
No client-credentials or device-code token grant support
No signInLogs, audit logs, or user activities

Differs from the real API (3)

Authorize auto-approves with an instant 302; no consent screen
nextLink cursor param is $skipToken (camelCase); real Graph emits $skiptoken
users create ignores mailNickname; mail defaults to the UPN

full scorecard →

want more of the Microsoft Graph / Entra ID surface? adapters are YAML + Starlark — the authoring guide covers adding routes, fixtures, and state machines. Open an issue for anything big first, or just file a PR — merged routes ship in the next release.