User.Read.All
— application permission, granted to the app registration with admin consent.
Endpoints:
GET /v1.0/users (department, jobTitle, usageLocation, assignedLicenses) · GET /v1.0/users?$select=id&$expand=manager($select=id)
In hybrid tenants these attributes are mastered in on-premises Active Directory (or the HR system) - fix them there, not in Entra.
If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.
Directory Data Quality
Dynamic groups, licence assignment, access reviews by manager, org charts and every department report in this console depend on a few user attributes being filled in. Licensed users without a usage location cannot receive some licences at all and are listed first.
No enabled member accounts were found.