Created by Claude - please verify

Role-assignable groups - change history is matched to groups by display name, because audit entries do not carry the group id here.

Required Microsoft Graph permissions

Group.Read.All RoleManagement.Read.Directory AuditLog.Read.All — application permissions, granted to the app registration with admin consent.

Licence: Microsoft Entra ID P1 to create role-assignable groups; P2 for the eligible (PIM) assignments.

Endpoints: GET /v1.0/groups?$filter=isAssignableToRole eq true · GET /v1.0/groups/{id}/members, /owners · GET /v1.0/roleManagement/directory/roleAssignments · GET /v1.0/auditLogs/directoryAudits

Change history comes from the directory audit log behind the Directory Changes report - 30 days at most, and less if Entra retains less.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Role-assignable Group Membership & Changes

A role-assignable group hands its directory roles to every member. Adding someone to the group is the same as making them an administrator - and every owner of the group can do that. This report lists each such group, the roles it grants, who is in it, who owns it, and recent membership changes.

This tenant has no role-assignable groups.