Created by Claude - please verify

Azure RBAC - Owner / User Access Administrator / RBAC Administrator at root, management groups and subscriptions (Azure Resource Manager, separate token audience).

Required Microsoft Graph permissions

Azure RBAC 'Reader' for this app at the root management group ('/') Directory.Read.All (names) AuditLog.Read.All (elevate access events) — application permissions, granted to the app registration with admin consent.

Licence: None.

Endpoints: GET https://management.azure.com/providers/Microsoft.Management/managementGroups · GET https://management.azure.com/subscriptions · GET .../providers/Microsoft.Authorization/roleAssignments?$filter=atScope() · GET /v1.0/auditLogs/directoryAudits (AzureRBACRoleManagementElevateAccess)

This is an Azure role assignment, not a Graph permission: assign Reader to the app registration at 'Tenant Root Group' (requires elevated access once to set up).

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Azure Subscription Owners & Root Elevation

Owners of a subscription can do anything in it, including granting access to others; Owner at a management group or the root is inherited by every subscription below. Guests, service principals and stale assignments with Owner are the blast radius nobody reviews - and 'elevate access' lets any Global Administrator take all of it.