Created by Claude - please verify

Group usage - on-demand scan: CA, licensing, roles, app assignments, Intune assignments, access package catalogs and Teams per group.

Required Microsoft Graph permissions

Group.Read.All Policy.Read.All Application.Read.All DeviceManagementConfiguration.Read.All DeviceManagementApps.Read.All EntitlementManagement.Read.All (optional) — application permissions, granted to the app registration with admin consent.

Licence: None.

Endpoints: GET /v1.0/groups · GET /v1.0/identity/conditionalAccess/policies · GET /v1.0/groups/{id}/appRoleAssignments ($batch) · GET /v1.0/deviceManagement/deviceConfigurations|deviceCompliancePolicies?$expand=assignments · GET /v1.0/deviceAppManagement/mobileApps?$expand=assignments · GET /beta/deviceManagement/configurationPolicies?$expand=assignments · GET .../entitlementManagement/catalogs/{id}/resources

SharePoint and Teams permissions, Azure RBAC and third-party apps that read group membership are not visible here - check them before deleting a group.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Group Usage Finder - Is This Group Used Anywhere?

Before deleting a group you need to know whether anything depends on it. This scan finds every place the directory, Conditional Access, licensing, Intune and entitlement management reference each group - and lists the groups referenced nowhere as deletion candidates. Use the table filter to look up one group.

Press Run scan to check where every group is used.