User.Read.All
Group.Read.All
RoleManagement.Read.Directory
Policy.Read.All
AuditLog.Read.All
— application permissions, granted to the app registration with admin consent.
Licence: Microsoft Entra ID P1 for the 'last tested' column (sign-in activity). The rest works without it.
Endpoints:
GET /v1.0/users · GET /v1.0/roleManagement/directory/roleAssignments · GET /v1.0/identity/conditionalAccess/policies · GET /v1.0/groups/{id}/transitiveMembers (CA-referenced and role-assignable groups) · GET /v1.0/reports/authenticationMethods/userRegistrationDetails · GET /v1.0/users?$select=signInActivity
Group-based CA exclusions use the full transitive membership of every group a CA policy references; Global Admin via a group uses the full membership of role-assignable groups.
If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.
Break-glass Account Health
Emergency-access accounts are the way back in when Conditional Access, MFA or federation breaks. An account is listed when it is a Global Administrator excluded from an all-user Conditional Access policy, or when its name looks like an emergency account. Each one is checked against Microsoft's emergency access guidance.
Break-glass accounts found
0
Microsoft recommends two or more
Healthy
0
Not usable / unsafe
0
Enabled all-user CA policies
0
Policies a break-glass account must be excluded from
No break-glass account was detected. No Global Administrator is excluded from an all-user Conditional Access policy, and no account name suggests an emergency account. If you have one, check its exclusions.