User.Read.All
RoleManagement.Read.Directory
Group.Read.All
Application.Read.All
— application permissions, granted to the app registration with admin consent.
Endpoints:
GET /v1.0/users · GET /v1.0/roleManagement/directory/roleAssignments · GET /v1.0/groups/{id}/owners (role-assignable groups, Teams) · GET /v1.0/applications?$expand=owners
If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.
Guests with Elevated Access
External accounts should consume, not administer. A guest who holds a directory role, owns a role-assignable group, an app registration or a Team can change who has access - with an identity your organisation does not control and cannot MFA-enforce as tightly.
No guest holds a directory role or owns a role-assignable group or Team.