Movers: Access Kept after a Department Change

The question it answers: Which users changed department in the last 30 days and are still in groups of their old department?

When people change department they collect access - they join the new team’s groups and keep the old ones. This is the ‘access creep’ auditors ask about most. The report lists every department change of the last 30 days and the groups that still tie the mover to the old department.

Note

A group counts as ‘old department’ when more than half of its members with a department belong to the mover’s old department and fewer than a fifth to the new one. Dynamic groups are skipped - they follow the new department automatically.

At a glance

Where in the app	Entra ID › Sign-in & Audit Investigations › Movers Keeping Old Access
Workload	Entra ID
Kind	Findings list · dashboard tile
Data	Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed).
Licence	No extra licence needed.
Report id (API and MCP)	entra.investigations.movers

Columns

Column	Key	Type
Severity	Severity	Status
Move	Category	Text
User	Subject	Link
Check	Setting	Text
Old-department groups	Value	Text
Finding	Finding	Text
Job title change	Detail	Text
Changed	When	Date
Groups	Number	Number

A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).

What it needs

Licence: No extra licence needed.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
AuditLog.Read.All	Microsoft Graph	Read all audit log data
User.Read.All	Microsoft Graph	Read all users’ full profiles
GroupMember.Read.All	Microsoft Graph	Read all group memberships

Data sources it reads

• GET /v1.0/auditLogs/directoryAudits?$filter=activityDisplayName eq 'Update user'
• GET /v1.0/users/{id}/memberOf ($batch)
• GET /v1.0/groups/{id}/members?$select=department ($batch)

Through the API and MCP

GET /ir-api/v1/reports/entra.investigations.movers?size=100

An AI assistant reads it with the MCP tool get_report and the id entra.investigations.movers. The client needs the Read grant for Entra ID. See Using the API.