Created by Claude - please verify

Stale administrators - break-glass accounts are expected to be idle; see the Break-glass Account Health report for those.

Required Microsoft Graph permissions

RoleManagement.Read.Directory User.Read.All AuditLog.Read.All — application permissions, granted to the app registration with admin consent.

Licence: Microsoft Entra ID P1 (sign-in activity).

Endpoints: GET /v1.0/roleManagement/directory/roleAssignments · GET /v1.0/users?$select=signInActivity

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Stale Administrators

Accounts holding privileged roles that nobody has used for more than 30 days. Unused standing admin rights are pure risk: remove the role, or make it PIM-eligible.

Every privileged role holder signed in within the last 30 days.