Cloud Security Group Soft-Delete
Microsoft Entra ID Cloud Security Group Soft-Delete discovery.
What it does
Detects whether the target tenant has the Soft-Delete for Cloud Security Groups Public Preview feature enabled, enumerates currently soft-deleted groups (retained for 30 days post Public Preview changelog June 2026), and surfaces a Day 1 readiness scorecard for M&A cutover operations. Authenticates to Microsoft Graph via the service-principal credentials carried in $Configuration. Pages across 3 Graph endpoint groups and writes 4 CSVs read by the React view (useCloudSecurityGroupSoftDeleteDiscoveredLogic.ts): CloudGroupSoftDelete_TenantReadiness.csv (single row) CloudGroupSoftDelete_DeletedGroups.csv CloudGroupSoftDelete_Dependencies.csv CloudGroupSoftDelete_RecoveryPlan.csv Column names match the TypeScript interfaces (PascalCase). Pipe '|' is the multi-value separator. No credentials -> Start-DiscoveryModule throws -> [ERROR_ENVELOPE] AUTH_FAILURE -> exit 1.
How the app exposes it
The module feeds into the ACQI app's dedicated results view. From there, conflicts, dependencies, and readiness scores roll up into the deal workspace.
/discovered/cloud-security-group-soft-delete Outputs
Each module produces a CSV with readiness and risk scores, evidence-source counts, and last-seen timestamps. The exact columns vary by module — the app's results view shows the live schema.