Entra ID Identity
Azure Identity Discovery - enumerates Entra ID (Azure AD) users, groups,
What it does
Calls MS Graph endpoints and writes CSVs: - GET /v1.0/users -> AzureADUsers.csv - GET /v1.0/groups (+ members/owners) -> AzureADGroups.csv - GET /v1.0/groups/{id}/members -> AzureADGroupMembers.csv - GET /beta/reports/credentialUserRegistrationDetails -> AzureMFARegistration.csv Pattern: identical to AzureDirectoryRolesDiscovery.psm1 (SPEC-104, shipped). Pagination, retry, and beta-URL handling are provided by Invoke-GraphAPIWithPaging (DiscoveryBase.psm1). Each endpoint is independent: a failure on one emits a warning and continues to the next. Required Graph application permissions: - User.Read.All for /v1.0/users - Group.Read.All for /v1.0/groups (+ members/owners) - GroupMember.Read.All for membership enumeration - Reports.Read.All for /beta/reports/credentialUserRegistrationDetails - AuditLog.Read.All (optional) for signInActivity / LastSignIn Token acquisition scope: https://graph.microsoft.com/.default
How the app exposes it
The module feeds into the ACQI app's dedicated results view. From there, conflicts, dependencies, and readiness scores roll up into the deal workspace.
/discovered/azure-identity Outputs
Each module produces a CSV with readiness and risk scores, evidence-source counts, and last-seen timestamps. The exact columns vary by module — the app's results view shows the live schema.