Group Usage Finder - Is This Group Used Anywhere?

The question it answers: Where is each group used - Conditional Access, licensing, Intune, access packages, roles - before it is deleted?

Before deleting a group you need to know whether anything depends on it. This scan finds every place the directory, Conditional Access, licensing, Intune and entitlement management reference each group - and lists the groups referenced nowhere as deletion candidates. Use the table filter to look up one group.

Note

SharePoint and Teams permissions, Azure RBAC and third-party apps that read group membership are not visible here - check them before deleting a group.

At a glance

Where in the app	Entra ID › Identity Governance & Lifecycle › Group Usage Finder
Workload	Entra ID
Kind	Findings list · dashboard tile
Data	A scan: it runs only when someone presses Run scan (or calls the API’s scan action) and can take minutes. The last result is kept until the next scan.
Licence	No extra licence needed.
Report id (API and MCP)	entra.governance.group-usage

Columns

Column	Key	Type
Severity	Severity	Status
Group type	Category	Text
Group	Subject	Link
Check	Setting	Text
Used by	Value	Text
Finding	Finding	Text
Detail	Detail	Text
Date	When	Date
References	Number	Number

A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).

What it needs

Licence: No extra licence needed.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Group.Read.All	Microsoft Graph	Read all groups
Policy.Read.All	Microsoft Graph	Read your organization’s policies
Application.Read.All	Microsoft Graph	Read all applications
DeviceManagementConfiguration.Read.All	Microsoft Graph	Read Microsoft Intune device configuration and policies
DeviceManagementApps.Read.All	Microsoft Graph	Read Microsoft Intune apps
EntitlementManagement.Read.All	Microsoft Graph	Read all entitlement management resources	optional

Data sources it reads

• GET /v1.0/groups
• GET /v1.0/identity/conditionalAccess/policies
• GET /v1.0/groups/{id}/appRoleAssignments ($batch)
• GET /v1.0/deviceManagement/deviceConfigurations|deviceCompliancePolicies?$expand=assignments
• GET /v1.0/deviceAppManagement/mobileApps?$expand=assignments
• GET /beta/deviceManagement/configurationPolicies?$expand=assignments
• GET .../entitlementManagement/catalogs/{id}/resources

Through the API and MCP

GET /ir-api/v1/reports/entra.governance.group-usage?size=100
POST /ir-api/v1/reports/entra.governance.group-usage/scan

An AI assistant reads it with the MCP tool get_report and the id entra.governance.group-usage. The client needs the Run scan grant for Entra ID. See Using the API.