Microsoft Entra Recommendations
The question it answers: Which Microsoft Entra recommendations are active for this tenant, and how many objects does each one affect?
Microsoft checks every tenant daily against its identity best practices and publishes the result as recommendations - renew expiring app credentials, remove unused apps, migrate from legacy MFA, and so on. This page lists them with how many objects each one affects.
At a glance
Section titled “At a glance”| Where in the app | Entra ID › App & Workload Identities › Entra Recommendations |
| Workload | Entra ID |
| Kind | Table |
| Data | Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once. |
| Licence | None; some recommendations are only generated with Microsoft Entra ID P1/P2. |
| Report id (API and MCP) | entra.security.entra-recommendations |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Recommendation | DisplayName | Text |
| Priority | Priority | Status |
| Status | StatusDisplay | Text |
| Impacted | ImpactedResourceCount | Text |
| Insight | Insights | Text |
| Category | Category | Text |
| Updated | LastModifiedDateTime | Date |
Filters
Section titled “Filters”| Filter | Key (API) | On when the page opens |
|---|---|---|
| Active recommendations only | active | Yes |
What it needs
Section titled “What it needs”Licence: None; some recommendations are only generated with Microsoft Entra ID P1/P2.
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
DirectoryRecommendations.Read.All | Microsoft Graph | Read all Azure AD recommendations |
Data sources it reads
GET /beta/directory/recommendationsGET /beta/directory/recommendations/{id}/impactedResources
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/entra.security.entra-recommendations?size=100GET /ir-api/v1/reports/entra.security.entra-recommendations?filter=activeAn AI assistant reads it with the MCP tool get_report and the id entra.security.entra-recommendations. The client needs the Read grant for Entra ID. See Using the API.