Created by Claude - please verify

Movers - 30 days of 'Update user' audit events with a department change; group membership compared with each group's department mix (first 100 movers).

Required Microsoft Graph permissions

AuditLog.Read.All User.Read.All GroupMember.Read.All — application permissions, granted to the app registration with admin consent.

Licence: None.

Endpoints: GET /v1.0/auditLogs/directoryAudits?$filter=activityDisplayName eq 'Update user' · GET /v1.0/users/{id}/memberOf ($batch) · GET /v1.0/groups/{id}/members?$select=department ($batch)

A group counts as 'old department' when more than half of its members with a department belong to the mover's old department and fewer than a fifth to the new one. Dynamic groups are skipped - they follow the new department automatically.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Movers: Access Kept after a Department Change

When people change department they collect access - they join the new team's groups and keep the old ones. This is the 'access creep' auditors ask about most. The report lists every department change of the last 30 days and the groups that still tie the mover to the old department.