GRAPHPAAS

Connections graph · Microsoft 365, Intune, Azure

Who reaches
what.

Every person, group, device, app, admin role, policy, licence and Azure resource in a tenant, and the links between them. Pick a case below and walk it: this is a demo tenant, so click anything.

Ana Dias and Bruno Keller hold it directly; Inès Ramos is only eligible through PIM (dashed). The red dashed curve: Ana is excluded from Require MFA for admins, the policy meant to protect this role.

What it reads

Entra, Intune and Azure in one picture

Members and owners, admin roles held or eligible, who uses which device, Conditional Access inclusions and exclusions, Intune assignments and what each device reports back, licences, app permissions on Microsoft Graph, and Azure roles on every scope. Filled shapes can hold access; outlines are what gets applied to them.

  • Person
  • Group
  • Device
  • Autopilot registration
  • Enterprise app
  • App registration
  • Admin role
  • Conditional Access
  • Intune policy
  • Intune script
  • Intune app
  • Licence
  • Azure

How it works

01One hop at a time

Start from anything and open its links. The canvas keeps what you walked, so a group leads to a member, the member to their other groups. Long lists fold into one node and page in the side panel.

02Nested as it is

Groups inside groups are shown as they are, not flattened, so you see the path that grants access and not just the result.

03Read once a day, read-only

The links are read from Microsoft once a day, and nothing is ever written to your tenant.

04Azure through your Bills connection

With Azure connected on the Bills page, Azure roles join the graph, held or eligible through PIM, from management groups down to each resource. It sees what the admin who connected can read.

05Checks in the Advisor

Apps that can install in a loop, Azure access at the tenant root and Azure roles held by deleted identities come out of the same graph as Advisor findings.

06In Claude too

The edges are a domain like any other in the GraphPaaS MCP server, so you can ask Claude about them in plain language.