Skip to content

Entra ID reports

129 reports belong to the Entra ID area. An API or MCP client sees them when it holds a grant for this area. Kind: a findings list rates each row by severity; a table lists objects. Data: Cached opens at once, On demand reads Microsoft 365 when first opened, Scan runs on request.

Entra ID › App & Workload Identities

Report	The question it answers	Kind	Data
App Provisioning (SCIM) Job Health	Which automatic provisioning jobs are quarantined, failing or not running, so leavers may keep their SaaS accounts?	Table	Cached
App Registration Hygiene	Which app registrations of this tenant have no owner, risky redirect URIs, or accept sign-ins from any tenant without a verified publisher?	Table	Cached
Application Proxy Connector Health	Which Application Proxy connector groups serving apps have no active connector, or hang on a single one, and which connectors are inactive?	Table	Cached
Apps with High-privilege Application Permissions	Which apps hold application permissions that let them take over the tenant or read and write all data without a signed-in user?	Table	Cached
Microsoft Entra Recommendations	Which Microsoft Entra recommendations are active for this tenant, and how many objects does each one affect?	Table	Cached
Risky Workload Identities	Which apps, service principals and managed identities does Identity Protection consider at risk?	Table	Cached

Entra ID › Conditional Access

Report	The question it answers	Kind	Data
CA Policies	Which Conditional Access policies exist, whom and what do they target, and what do they require?	Table	Cached
Conditional Access Coverage Gaps	Which enabled accounts does no enforced Conditional Access MFA policy fully cover?	Table · dashboard tile	Cached
Conditional Access Policy Gaps	Which Conditional Access MFA or block policies leave holes - report-only, MFA as one option, narrowing conditions or large exclusions?	Table	Cached

Entra ID › Devices

Report	The question it answers	Kind	Data
All Devices	Which devices are registered or joined in Entra ID, and are they compliant and managed?	Table	Cached
All Devices by User	Which devices is each user registered owner or registered user of?	Table	Cached
Devices with uploaded Bitlocker Keys	Which devices have a BitLocker recovery key in Entra ID, of which volume type and since when?	Table	On demand
Disabled Entra Devices - PREVIEW	Which devices are disabled in Entra ID?	Table	Cached
Duplicate Devices Entra ID - PREVIEW	Which Entra ID devices share a DeviceId with another device object?	Table	Cached
Duplicate Devices Entra ID by Device Name - PREVIEW	Which Entra ID devices share a display name with another device?	Table	Cached
Inactive Devices (90 days)	Which Entra ID devices have not signed in for 90 days, or never?	Table	Cached
Users by Device	Who are the registered users and registered owners of each Entra ID device?	Table	Cached

Entra ID › Groups

Report	The question it answers	Kind	Data
All Mail-Enabled Security Groups	Which mail-enabled security groups exist, with their primary address and number of direct members?	Table	On demand, PowerShell
All Microsoft 365 Groups	Which Microsoft 365 groups exist, with their primary address and number of direct members?	Table	On demand, PowerShell
Empty Entra ID Groups	Which groups have no direct member?	Table	Cached
Entra ID Groups	Which groups exist in the directory, how many members do they have and are they synchronised or licensed?	Table	Cached
Entra ID Groups Containing Guests	Which groups have guests among their direct members, and how many?	Table	Cached
Entra ID Groups with Disabled Members	Which groups still have disabled accounts among their direct members, and which ones?	Table	Cached
Entra ID Groups with Left / Expired Members	Which groups still have members whose employee leave date has passed, and which ones?	Table	Cached
Entra ID Groups Without Owners	Which groups have no owner, and how many direct members do they have?	Table	On demand
Expiring Entra ID Groups (90 Days)	Which Microsoft 365 groups expire within the next 90 days?	Table	On demand, PowerShell

Entra ID › Identity Configuration

Report	The question it answers	Kind	Data
AI Agent Identity Inventory	Which AI agent identities exist in the tenant, what can they access, and does each have an accountable sponsor?	Findings list · dashboard tile	On demand
App Credential Restriction Policies	Do app management policies block client secrets and cap credential lifetimes, and which apps are exempt?	Findings list · dashboard tile	On demand
App Proxy Apps Published without Pre-authentication	Which Application Proxy apps are published without Entra pre-authentication, and are the connectors healthy?	Findings list · dashboard tile	On demand
Authentication Contexts - Are They Enforced?	Which authentication contexts are not enforced by any enabled Conditional Access policy?	Findings list · dashboard tile	On demand
Authentication Strengths - What They Really Allow	Which authentication strengths used by Conditional Access allow weaker methods than their name suggests?	Findings list · dashboard tile	On demand
B2B Identity Providers & One-time Passcode	Which external identity providers and one-time passcode settings can guests use to sign in?	Findings list · dashboard tile	On demand
Certificate-based Authentication - Trusted CAs	Which certificate authorities trusted for certificate-based authentication expire soon or have no revocation list?	Findings list · dashboard tile	On demand
Credentials Added to Microsoft First-party Apps	Which Microsoft first-party service principals have had a secret or certificate added in this tenant?	Findings list · dashboard tile	On demand
Cross-tenant Synchronisation & Multi-tenant Organisation	Which other tenants can create users in this directory or redeem invitations automatically?	Findings list · dashboard tile	On demand
Device Registration & Join Settings	Who may join and register devices, does it need MFA, and who becomes local administrator on joined devices?	Findings list · dashboard tile	On demand
Domain Federation & Trust Audit	Which domains are federated to another identity provider, and are their trusts and signing certificates sound?	Findings list · dashboard tile	On demand
Enterprise Apps Open to Every User	Which enterprise apps can every user and guest sign in to because assignment is not required?	Findings list · dashboard tile	On demand
Manager Chain Integrity	Which users have a manager who is disabled, deleted or a guest, so approvals and reviews go nowhere?	Findings list · dashboard tile	On demand
Multi-geo Data Location	Where are users’ mailboxes, OneDrives and group sites stored in a Multi-Geo tenant, and which have no preferred data location?	Findings list · dashboard tile	On demand
Password Protection & Smart Lockout Settings	How are smart lockout and banned-password protection configured, including for on-premises Active Directory?	Findings list · dashboard tile	On demand
PIM Activation Patterns (30 days)	Who activated which privileged role in the last 30 days, how often and at what times?	Findings list · dashboard tile	On demand
PIM for Groups - Standing & Eligible Access	Which groups under PIM for Groups have permanent active members or owners instead of eligible ones?	Findings list · dashboard tile	Scan
PIM Role Settings Audit	Which privileged roles can be activated without MFA or approval, for long periods, or are assigned permanently?	Findings list · dashboard tile	On demand
Privilege Escalation through App Ownership	Which users own an app that holds high privileges, and so can act with that app’s access?	Findings list · dashboard tile	On demand
Token Lifetime, Home Realm Discovery & Claims-mapping Policies	Which token lifetime, home realm discovery and claims-mapping policies exist and which apps do they apply to?	Findings list · dashboard tile	On demand
UPN, E-mail & Proxy Address Mismatches	Which users have duplicate proxy addresses, addresses on unverified domains, or a UPN that differs from their e-mail address?	Findings list · dashboard tile	On demand
Workload Identity Federation Trusts	Which external systems can get tokens for an app through a federated identity credential, and how broad are those trusts?	Findings list · dashboard tile	On demand

Entra ID › Identity Governance & Lifecycle

Report	The question it answers	Kind	Data
Access Package Assignment Health	Which access package policies allow requests without approval, assignments that never expire, or no recurring review?	Findings list · dashboard tile	On demand
Contractors & Externals without an End Date	Which contractor and external member accounts have no end date, expiring access or sponsor?	Findings list · dashboard tile	On demand
Deleted Sites & Groups Nearing Permanent Purge	Which deleted groups and sites are in the recycle bin, and how many days are left before they are purged?	Findings list · dashboard tile	On demand, PowerShell
Group Usage Finder - Is This Group Used Anywhere?	Where is each group used - Conditional Access, licensing, Intune, access packages, roles - before it is deleted?	Findings list · dashboard tile	Scan
Joiners & Leavers Trend (12 months)	How many people joined and left each month over the last year, by department, and who leaves in the next 30 days?	Findings list · dashboard tile	On demand
Lifecycle Workflow Failures (30 days)	Which lifecycle workflow runs and tasks failed in the last 30 days, and for which users?	Findings list · dashboard tile	On demand
Terms of Use Acceptance	Which terms of use are enforced by Conditional Access, and who declined them or has an expired acceptance?	Findings list · dashboard tile	On demand
User Access 360	What can one user reach: roles, groups, licences, owned objects, devices, apps, Conditional Access policies and Send As rights?	Findings list · dashboard tile	On demand, PowerShell

Entra ID › Identity Hygiene

Report	The question it answers	Kind	Data
Cross-tenant Access & B2B Trust	Which external tenants can collaborate with this one, and whose MFA and device-compliance claims does Conditional Access trust?	Table	Cached
Custom Roles & Administrative Units	Which custom roles carry sensitive permissions, and which administrative units have no scoped admins?	Table	Cached
Dynamic Group Rule Health	Which dynamic groups are paused or have a membership rule that matches nobody?	Table	Cached
Guests with Elevated Access	Which guests hold a directory role or own a role-assignable group, an app registration or a Team?	Table	Cached
Hybrid Sync Health	When did Entra Connect last sync directory objects and password hashes, and which sync protections are on?	Findings list · dashboard tile	Cached
Microsoft 365 Group Governance Settings	Who may create Microsoft 365 groups, do names follow a policy, do abandoned groups expire, and what may guests do?	Findings list · dashboard tile	Cached
Named Locations & Trusted IP Audit	Which trusted named locations are too wide, and which named locations does no Conditional Access policy use?	Table	Cached
Phishing-resistant MFA for Admins	Which privileged roles in use are not required by Conditional Access to sign in with phishing-resistant MFA?	Table	Cached
Phone Numbers Shared Across MFA Registrations	Which phone numbers are registered for MFA by more than one user, and does an admin share one?	Table · dashboard tile	Scan
Role Assignments Made Outside PIM	Which directory roles were assigned directly instead of through Privileged Identity Management, and by whom?	Table	Cached
Security Defaults & Per-user MFA Leftovers	Are security defaults on, and which members still have legacy per-user MFA enabled or enforced?	Table · dashboard tile	Scan
Security Key & Passkey Inventory	Which security keys and passkeys are registered, by make and model, and which could not be attested?	Table · dashboard tile	Scan
Security-info Changes & Temporary Access Passes	Who registered or removed authentication methods or received a Temporary Access Pass recently, administrators first?	Table	Cached
Service Accounts Disguised as Users	Which user accounts behave like service accounts - script-only sign-ins, old passwords, no MFA?	Table	Cached
Stale Administrators	Which accounts hold privileged roles but have not signed in for longer than the inactive-privileged threshold?	Table	Cached
Synced & Everyday Accounts Holding Admin Roles	Which privileged role holders are synced from on-premises AD or also used as everyday, licensed accounts?	Table	Cached
Unused Delegated Consents	Which apps hold delegated consent to users’ data but have not signed in on anyone’s behalf for 90 days?	Table	Cached

Entra ID › Identity Lifecycle

Report	The question it answers	Kind	Data
Access Review Health	Which access reviews are overdue, have items nobody decided, or are set up so that their decisions change nothing?	Table	Cached
Directory Data Quality	Which enabled members are missing a department, job title, manager or usage location, or share a display name?	Table	Cached
Guest Sponsorship Coverage	Which enabled guests have no sponsor, or only sponsors who have left?	Table	Cached
Leaver Clean-up Completeness	Which disabled member accounts still hold admin roles, licences, group or app ownership, or Intune devices?	Table	Cached
New-starter Onboarding Completeness	Which member accounts created in the last 30 days still lack a licence, a first sign-in, MFA, an enrolled device or a manager?	Table	Cached

Entra ID › Roles

Report	The question it answers	Kind	Data
Entra ID Roles	Which directory roles are activated in the tenant, and how many active direct members does each have?	Table	Cached
Entra ID Roles - Privileged Role Members	Who holds an active or eligible assignment of a role Microsoft marks as privileged?	Table	On demand, PowerShell

Entra ID › Security

Report	The question it answers	Kind	Data
App & Service Principal Credential Expiry	Which client secrets and certificates on app registrations and enterprise applications have expired or expire soon?	Table	Cached
App Consent Policy Posture	Can ordinary users consent to apps or invite guests, and which of these tenant-wide settings need action?	Table	Cached
Authentication Methods Policy Audit	Which sign-in methods does the tenant allow, for whom, and is the passkey registration campaign running?	Table	Cached
Break-glass Account Health	Does the tenant have usable emergency-access accounts, and does each follow Microsoft’s guidance?	Table	Cached
Directory Changes (last 30 days)	What changed in Entra ID in the last 30 days, and who changed it?	Table	Cached
Entra ID Failed Authentication Attempts	Which sign-ins failed in the last 7 days, with which error and risk level?	Table	On demand, PowerShell
Inactive Enterprise Apps & Stale Service Principals	Which enterprise apps have not signed in for 90 days or more, and which of them still hold valid credentials?	Table	Cached
MFA & Passwordless Coverage	Which accounts cannot perform multifactor authentication, and which administrators are among them?	Table	Cached
OAuth Consent Grants	Which delegated permissions were consented to which applications, by whom, and which are tenant-wide or high impact?	Table	Cached
Pending Admin Consent Requests	Which apps are waiting for an administrator to grant consent, and which permissions do they ask for?	Table	Cached
Risk Detections	Which risk detections did Identity Protection record in the last 30 days, for whom and from where?	Table	Cached
Risky Users & Risk Detections	Which users does Identity Protection hold at risk or recently changed the risk of, and has anyone dealt with them yet?	Table	Cached
Role-assignable Group Changes	What changed in role-assignable groups in the audit window, and who changed it?	Table	Cached
Role-assignable Group Membership & Changes	Which role-assignable groups grant directory roles, who is in them and who owns them, and what in them needs review?	Table	Cached
Self-service Password Reset Gaps	Which users cannot reset their own password - not covered by the SSPR policy, or covered but never registered?	Table	Cached
SMS / Voice MFA Retirement Exposure	Which users lose MFA when Microsoft-provided SMS and voice end, because a phone is their only or default second factor?	Table	Cached
Standing vs Just-in-time Admin Access	Who holds admin roles permanently that could be activated just in time through PIM instead?	Table	Cached

Report	The question it answers	Kind	Data
Azure Management Sign-ins after Mandatory MFA	Which accounts sign in to Azure management without MFA now that Microsoft enforces it?	Findings list · dashboard tile	On demand
BitLocker Key & LAPS Password Retrieval Audit (30 days)	Who read BitLocker recovery keys or LAPS passwords in the last 30 days, and were there unusual bursts or night-time reads?	Findings list · dashboard tile	On demand
Conditional Access Change History with Diff (30 days)	Who changed which Conditional Access policy in the last 30 days, what exactly changed, and did it weaken protection?	Findings list · dashboard tile	On demand
Movers: Access Kept after a Department Change	Which users changed department in the last 30 days and are still in groups of their old department?	Findings list · dashboard tile	On demand
Partner (CSP / GDAP) Admin Sign-ins (30 days)	Which partner (CSP / GDAP) administrators signed in to this tenant in the last 30 days, and to what?	Findings list · dashboard tile	On demand
Single-factor Interactive Sign-ins (7 days)	Which interactive sign-ins in the last 7 days succeeded with a password alone, for which users and apps?	Findings list · dashboard tile	On demand

Report	The question it answers	Kind	Data
Conditional Access Blocks by App & Policy	Which Conditional Access policies blocked which applications in the last 7 days, and for how many users?	Table	Cached
Failing App Sign-ins	Which apps and scripts failed to sign in during the last 7 days, why, and are they still failing?	Table	Cached
Guest Sign-ins by Home Tenant	Which external organisations’ guests signed in during the last 7 days, how many of them, and to which apps?	Table	Cached
MFA Fatigue & Repeated MFA Denials	Which users denied or reported MFA prompts, or had repeated failed MFA attempts in the last 7 days - and signed in afterwards?	Table	Cached
Sign-ins from Unmanaged & Non-compliant Devices	Which applications did people reach successfully from unmanaged or non-compliant devices in the last 7 days?	Table	Cached
Sign-ins from Unusual Countries & Device-code Flow	Who used the device-code flow, and who signed in successfully from a country the tenant rarely signs in from, in the last 7 days?	Table	Cached
Smart Lockout & Password-spray Indicators	Which IP addresses sprayed wrong passwords at many accounts, and which users were locked out by smart lockout in the last 7 days?	Table	Cached

Entra ID › Users

Report	The question it answers	Kind	Data
Days Since Last Password Reset for Users	Which users last changed their password longer ago than the password age threshold?	Table	Cached
Deleted Entra ID Users	Which users were deleted, when, and how many days are left to restore them?	Table	On demand
Disabled Entra ID Users	Which user accounts are disabled?	Table	Cached
Entra ID Guest Users	Which guest accounts are in the directory, and when were they created?	Table	Cached
Entra ID Users	Which users and guests are in the directory, where are they and are they enabled or synchronised?	Table	Cached
Entra ID Users With OnPremises Provisioning Errors	Which users did Entra Connect fail to sync, according to their on-premises provisioning errors?	Table	Cached
Entra ID Users with past Employee Leave DateTime Attribute	Which accounts can still sign in although their employee leave date has passed?	Table	Cached
Entra ID Users Without Location	Which users have no usage location, so no licence can be assigned to them?	Table	Cached
Entra User Licence Assignment Direct vs. Inherited	Which licences are assigned to each user directly, and which are inherited from a group?	Table	On demand, PowerShell
Guest Domains & Pending Invitations	Which external organisations do our guests come from, and how many of their guests are still active?	Table	Cached
Guest Lifecycle	Which guest accounts are stale or never used, and how much can they still reach through group membership?	Table	Cached
Inactive Entra ID Users	Which enabled accounts have not signed in for longer than the inactivity threshold, or never?	Table	Cached
Pending Guest Invitations	Which guest invitations were never accepted, and for how long have they been pending?	Table	Cached
Unlicensed Users	Which member accounts hold no licence?	Table	Cached
User Excessive Group Membership (10)	Which users are direct members of more than 10 groups?	Table	On demand

Licensing › Groups

Report	The question it answers	Kind	Data
Entra ID Groups Licence Statistics	How many members does each licensing group have, how many of them got the licence from it, and how many failed?	Table	On demand, PowerShell
Entra ID Groups with Licences	Which groups assign licences, and which licences do they assign?	Table	On demand, PowerShell
Entra ID Groups with Licences containing disabled products (plans)	Which group-based licences have service plans switched off, and which plans are they?	Table	On demand, PowerShell
Entra ID Groups with Licensing Issues	Which licensing groups have members whose licence from the group failed to apply?	Table	On demand, PowerShell