Created by Claude - please verify

Entra ID P1/P2 compliance - a static reading of who benefits from premium features; Microsoft's licensing terms are authoritative.

Required Microsoft Graph permissions

User.Read.All Policy.Read.All Group.Read.All RoleManagement.Read.Directory Organization.Read.All — application permissions, granted to the app registration with admin consent.

Endpoints: GET /v1.0/users · GET /v1.0/identity/conditionalAccess/policies · GET /v1.0/roleManagement/directory/roleEligibilityScheduleInstances · GET /v1.0/subscribedSkus

Enabled member accounts only; guests are billed through External ID monthly active users. AAD_PREMIUM_P2 counts as P1 as well. Uses the same CA scoping as the CA Coverage Gaps report.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Entra ID P1 / P2 Licence Compliance

Members who benefit from Conditional Access (Entra ID P1) or from risk-based policies and Privileged Identity Management (Entra ID P2) without holding the matching licence. The features keep working - but the tenant is under-licensed, which surfaces in audits and true-ups.

Every member who uses Conditional Access or PIM holds the matching Entra ID licence.