Role-assignable Group Changes

The question it answers: What changed in role-assignable groups in the audit window, and who changed it?

Adding a member or an owner to a role-assignable group is the same as handing out its directory roles. This report lists the group management entries of the directory audit log that target a role-assignable group, newest first.

Note

Change history comes from the directory audit log behind the Directory Changes report - 30 days at most, and less if Entra retains less.

At a glance

Where in the app	Entra ID › Security › Role-assignable Group Changes
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Entra ID P1 to create role-assignable groups.
Report id (API and MCP)	entra.security.role-assignable-group-changes

Columns

Column	Key	Type
When	ActivityDateTime	DateTime
Activity	ActivityDisplayName	Text
By	InitiatedBy	Text
Targets	TargetResourcesString	Text
Result	Result	Status

What it needs

Licence: Microsoft Entra ID P1 to create role-assignable groups.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Group.Read.All	Microsoft Graph	Read all groups
AuditLog.Read.All	Microsoft Graph	Read all audit log data

Data sources it reads

• GET /v1.0/groups?$filter=isAssignableToRole eq true
• GET /v1.0/auditLogs/directoryAudits

Through the API and MCP

GET /ir-api/v1/reports/entra.security.role-assignable-group-changes?size=100

An AI assistant reads it with the MCP tool get_report and the id entra.security.role-assignable-group-changes. The client needs the Read grant for Entra ID. See Using the API.

Related reports

• Role-assignable Group Membership & Changes - Which role-assignable groups grant directory roles, who is in them and who owns them, and what in them needs review?