Entra ID Administrative Units
Azure AD Administrative Units and their members using Microsoft Graph API
What it does
Discovers Azure AD Administrative Units and their members using Microsoft Graph API. Administrative Units provide organizational boundaries for role-based access control. Includes enriched columns via pure testable mappers and multi-strategy collection with graceful fallback. Strategy 1 expands members only (scopedRoleMembers does not support $expand and causes BadRequest when combined). Strategy 2 lists AUs then lazy-loads members and scoped role memberships per unit. Migration-useful columns (v1.4.0): - Stable ids (ObjectId, MemberObjectId, RoleId) + human labels (never id-as-name) - Parent relationships: TenantId / ParentTenantId, ApplicationId (discovering SP) - GraphResourceUri for re-fetch; MembershipRuleProcessingState as dynamic "provisioning" state - Member edges: mail, accountEnabled, userType when Graph returns them - Scoped-role edges: RoleDisplayName via roleDefinitions lookup (empty + UNRESOLVED_REF if missing) Exports: - AzureAdministrativeUnits.csv (AU parent rows) - AzureAdministrativeUnitMembers.csv (AU→member edges for migration joins) - AzureAdministrativeUnitScopedRoleMembers.csv (AU→scoped role edges when present)
How the app exposes it
The module feeds into the ACQI app's dedicated results view. From there, conflicts, dependencies, and readiness scores roll up into the deal workspace.
/discovered/azure-administrative-units Outputs
Each module produces a CSV with readiness and risk scores, evidence-source counts, and last-seen timestamps. The exact columns vary by module — the app's results view shows the live schema.