Created by Claude - please verify

Custom roles & administrative units - 'sensitive' is a keyword match on resource actions, not Microsoft's privileged flag.

Required Microsoft Graph permissions

RoleManagement.Read.Directory AdministrativeUnit.Read.All — application permissions, granted to the app registration with admin consent.

Licence: Microsoft Entra ID P1 (custom roles, administrative units).

Endpoints: GET /v1.0/roleManagement/directory/roleDefinitions?$filter=isBuiltIn eq false · GET /v1.0/directory/administrativeUnits · GET /v1.0/roleManagement/directory/roleAssignments

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Custom Roles & Administrative Units

Custom roles and administrative units are where delegated admin rights hide from the usual 'who is Global Admin' checks. A custom role that can reset passwords or change credentials is a privileged role, whatever its name; an administrative unit without scoped admins does nothing.

This tenant has no custom roles and no administrative units.