New-starter Onboarding Completeness

The question it answers: Which member accounts created in the last 30 days still lack a licence, a first sign-in, MFA, an enrolled device or a manager?

A new account that signs in before it has MFA is the easiest one to take over; one that nobody used after a week usually means the start date slipped or the hand-over failed. For every account created in the last 30 days: licence, first sign-in, MFA registration, enrolled device and manager.

Note

‘Device’ means an Intune-managed device with this user as primary user. Service and shared accounts created in the period show up here too - they are expected to miss some checks.

At a glance

Where in the app	Entra ID › Identity Lifecycle › New-starter Onboarding
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Entra ID P1 (sign-in activity, MFA registration details); Microsoft Intune for the device check.
Report id (API and MCP)	entra.lifecycle.onboarding-completeness

Columns

Column	Key	Type
User	DisplayName	Link
Missing	Missing	Status
Created	Created	Date
Licence	Licensed	Text
Signed in	SignedIn	Text
MFA	MfaRegistered	Text
Device	DeviceEnrolled	Text
Manager	HasManager	Text
Department	Department	Text
UPN	UserPrincipalName	Text

Filters

Filter	Key (API)	On when the page opens
Only accounts with something missing	missing	Yes

What it needs

Licence: Microsoft Entra ID P1 (sign-in activity, MFA registration details); Microsoft Intune for the device check.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
User.Read.All	Microsoft Graph	Read all users’ full profiles
User-LifeCycleInfo.Read.All	Microsoft Graph	Read all users’ lifecycle information
AuditLog.Read.All	Microsoft Graph	Read all audit log data
UserAuthenticationMethod.Read.All	Microsoft Graph	Read all users’ authentication methods
DeviceManagementManagedDevices.Read.All	Microsoft Graph	Read Microsoft Intune devices

Data sources it reads

• GET /v1.0/users (createdDateTime, assignedLicenses)
• GET /v1.0/reports/authenticationMethods/userRegistrationDetails
• GET /v1.0/users?$select=signInActivity
• GET /beta/deviceManagement/managedDevices
• GET /v1.0/users?$expand=manager

Through the API and MCP

GET /ir-api/v1/reports/entra.lifecycle.onboarding-completeness?size=100
GET /ir-api/v1/reports/entra.lifecycle.onboarding-completeness?filter=missing

An AI assistant reads it with the MCP tool get_report and the id entra.lifecycle.onboarding-completeness. The client needs the Read grant for Entra ID. See Using the API.