Created by Claude - please verify

Provisioning job health - the collection checks every non-Microsoft enterprise app for jobs, so the first load after a restart takes a while.

Required Microsoft Graph permissions

Synchronization.Read.All Application.Read.All — application permissions, granted to the app registration with admin consent.

Endpoints: GET /v1.0/servicePrincipals?$filter=servicePrincipalType eq 'Application' · GET /v1.0/servicePrincipals/{id}/synchronization/jobs

Also covers Entra Cloud Sync and cross-tenant sync jobs, which use the same API.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

App Provisioning (SCIM) Job Health

Automatic user provisioning creates, updates and - crucially - disables accounts in SaaS apps. A quarantined or failing job means leavers keep their accounts in Salesforce, ServiceNow or Workday-connected systems without anyone noticing.

No enterprise app has automatic provisioning configured.