Entra ID Directory Roles
Azure Directory Roles Discovery - enumerates Entra ID (Azure AD) directory
What it does
Uses pure REST client-credentials + Graph HTTP (no Microsoft.Graph SDK / Connect-MgGraph). SDK auth was hanging under Crucible's short prove timeout. Calls MS Graph /v1.0/directoryRoles to enumerate all activated directory roles, then /v1.0/directoryRoles/{id}/members when $expand=members is not available, broken down by principal type (User / Group / ServicePrincipal). Output: AzureDirectoryRoles.csv - one row per activated role (enriched) AzureDirectoryRoleMembers.csv - one row per role-member assignment Required Graph app permissions: - Directory.Read.All OR RoleManagement.Read.Directory
How the app exposes it
The module feeds into the ACQI app's dedicated results view. From there, conflicts, dependencies, and readiness scores roll up into the deal workspace.
/discovered/azure-directory-roles Outputs
Each module produces a CSV with readiness and risk scores, evidence-source counts, and last-seen timestamps. The exact columns vary by module — the app's results view shows the live schema.