Created by Claude - please verify

Onboarding - member accounts created in the last 30 days, checked against the registration, sign-in activity, Intune and manager data already cached.

Required Microsoft Graph permissions

User.Read.All AuditLog.Read.All UserAuthenticationMethod.Read.All DeviceManagementManagedDevices.Read.All — application permissions, granted to the app registration with admin consent.

Endpoints: GET /v1.0/users (createdDateTime, assignedLicenses) · GET /v1.0/reports/authenticationMethods/userRegistrationDetails · GET /v1.0/users?$select=signInActivity · GET /v1.0/deviceManagement/managedDevices · GET /v1.0/users?$expand=manager

'Device' means an Intune-managed device with this user as primary user. Service and shared accounts created in the period show up here too - they are expected to miss some checks.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

New-starter Onboarding Completeness

A new account that signs in before it has MFA is the easiest one to take over; one that nobody used after a week usually means the start date slipped or the hand-over failed. For every account created in the last 30 days: licence, first sign-in, MFA registration, enrolled device and manager.

No member account was created in the last 30 days.