Created by Claude - please verify

Admin account hygiene - 'everyday use' is inferred from the licences on the account, not from actual mail activity.

Required Microsoft Graph permissions

RoleManagement.Read.Directory User.Read.All Group.Read.All Organization.Read.All — application permissions, granted to the app registration with admin consent.

Endpoints: GET /v1.0/roleManagement/directory/roleAssignments · GET /v1.0/users · GET /v1.0/subscribedSkus

Privileged roles as flagged by Microsoft (roleDefinition.isPrivileged). Break-glass accounts are cloud-only and unlicensed by design, so they do not appear here.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Synced & Everyday Accounts Holding Admin Roles

Privileged roles should sit on separate, cloud-only admin accounts. An admin account synced from on-premises AD falls with the domain; an admin account that also reads email is one phishing click away from a tenant compromise.

Every privileged role holder is a cloud-only account without productivity licences.