Manager Chain Integrity

The question it answers: Which users have a manager who is disabled, deleted or a guest, so approvals and reviews go nowhere?

Access reviews, access-package approvals and lifecycle workflows route to managers. A disabled, deleted or guest manager means those decisions are never made - or are made by the wrong person. Directory Data Quality flags users with no manager; this report checks the managers that are set.

At a glance


Where in the app	Entra ID › Identity Configuration › Manager Chain Integrity
Workload	Entra ID
Kind	Findings list · dashboard tile
Data	Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed).
Licence	No extra licence needed.
Report id (API and MCP)	`entra.configuration.manager-chain`

Columns

Column	Key	Type
Severity	`Severity`	Status
Issue	`Category`	Text
User	`Subject`	Link
Check	`Setting`	Text
Manager	`Value`	Text
Finding	`Finding`	Text
UPN	`Detail`	Text
Date	`When`	Date
Direct reports	`Number`	Number

A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).

What it needs

Licence: No extra licence needed.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
`User.Read.All`	Microsoft Graph	Read all users’ full profiles

Data sources it reads

GET /v1.0/users?$expand=manager (cached)
GET /v1.0/users (cached)

Through the API and MCP

GET /ir-api/v1/reports/entra.configuration.manager-chain?size=100

An AI assistant reads it with the MCP tool get_report and the id entra.configuration.manager-chain. The client needs the Read grant for Entra ID. See Using the API.