Created by Claude - please verify

Leaver clean-up - disabled member accounts checked against role assignments, licences, Microsoft 365 group and app ownership and Intune devices.

Required Microsoft Graph permissions

User.Read.All RoleManagement.Read.Directory Group.Read.All Application.Read.All DeviceManagementManagedDevices.Read.All — application permissions, granted to the app registration with admin consent.

Endpoints: GET /v1.0/users (accountEnabled, assignedLicenses) · GET /v1.0/roleManagement/directory/roleAssignments · GET /v1.0/groups?$expand=owners · GET /v1.0/applications?$expand=owners · GET /v1.0/deviceManagement/managedDevices

Mailbox delegates and forwarding: see Mailbox Delegation. OneDrive hand-over: see Orphaned OneDrives of Leavers. Disabled accounts that are shared or resource mailboxes on purpose appear too.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Leaver Clean-up Completeness

Disabling the account is only the first step of an off-boarding. Disabled users who still hold admin roles, paid licences, sole ownership of teams and groups, app registrations or devices are the leftovers - listed with what exactly remains.

No disabled member account holds roles, licences, ownerships or devices.