Created by Claude - please verify

Role assignments outside PIM - from the directory audit log (30 days at most, less if Entra retains less).

Required Microsoft Graph permissions

AuditLog.Read.All — application permission, granted to the app registration with admin consent.

Endpoint: GET /v1.0/auditLogs/directoryAudits

An entry counts when the activity is 'Add member to role' and it was not logged by the PIM service. Uses the audit data behind the Directory Changes report (up to 5,000 entries).

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Role Assignments Made Outside PIM

Directory roles granted directly instead of through Privileged Identity Management: no approval, no justification, no expiry. In a tenant that uses PIM every row here is either a process gap or someone working around it.

No directory role was assigned outside PIM in the audit window.