User.Read.All
GroupMember.Read.All
RoleManagement.Read.Directory
Application.Read.All
Device.Read.All
Policy.Read.All
Exchange.ManageAsApp (Send As rights)
— application permissions, granted to the app registration with admin consent.
Licence: None; PIM eligibility needs Entra ID P2.
Endpoints:
GET /v1.0/users/{upn} · GET /v1.0/users/{id}/transitiveMemberOf · GET /v1.0/users/{id}/ownedObjects · GET /v1.0/users/{id}/registeredDevices · GET /v1.0/users/{id}/appRoleAssignments · GET /v1.0/identity/conditionalAccess/policies · role assignments + PIM eligibility (cached) · Get-EXORecipientPermission -Trustee {upn}
Full Access rights on other mailboxes are not listed - they need a scan of every mailbox. Use the CA What-If checker for an exact policy evaluation.
If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.
User Access 360
Everything one user can reach, on one page: directory roles (active and eligible, direct or through groups), every group they are in (including nested), licences and how they were assigned, objects they own, their devices, enterprise apps assigned to them, Conditional Access policies that include or exclude them, and mailboxes they can send as. Helpdesk, audit and leaver checks all need this view.
User principal name: