Synced & Everyday Accounts Holding Admin Roles

The question it answers: Which privileged role holders are synced from on-premises AD or also used as everyday, licensed accounts?

Privileged roles should sit on separate, cloud-only admin accounts. An admin account synced from on-premises AD falls with the domain; an admin account that also reads email is one phishing click away from a tenant compromise.

Note

Privileged roles as flagged by Microsoft (roleDefinition.isPrivileged). Break-glass accounts are cloud-only and unlicensed by design, so they do not appear here.

At a glance

Where in the app	Entra ID › Identity Hygiene › Synced & Everyday Admins
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	No extra licence needed.
Report id (API and MCP)	entra.security.admin-account-hygiene

Columns

Column	Key	Type
Account	DisplayName	Link
UPN	Secondary	Text
Type	Category	Status
Finding	Finding	Text
Privileged roles	Detail	Text
State	Value	Text

What it needs

Licence: No extra licence needed.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
RoleManagement.Read.Directory	Microsoft Graph	Read all directory RBAC settings
User.Read.All	Microsoft Graph	Read all users’ full profiles
User-LifeCycleInfo.Read.All	Microsoft Graph	Read all users’ lifecycle information
Group.Read.All	Microsoft Graph	Read all groups
Organization.Read.All	Microsoft Graph	Read organization information

Data sources it reads

• GET /v1.0/roleManagement/directory/roleAssignments
• GET /v1.0/users
• GET /v1.0/subscribedSkus

Through the API and MCP

GET /ir-api/v1/reports/entra.security.admin-account-hygiene?size=100

An AI assistant reads it with the MCP tool get_report and the id entra.security.admin-account-hygiene. The client needs the Read grant for Entra ID. See Using the API.