VisualizerEngine reference

Overview

VisualizerEngine is a read-only visibility platform for Microsoft Entra ID. It mirrors a tenant's groups, users, memberships, and license assignments into per-tenant storage, then presents that mirror as an interactive hierarchy tree, force-directed graph, or sunburst, with analytics, simulation, policies, snapshots, search, and exports built on top. It never writes to the directory.

Onboarding and consent

Onboarding is a standard Entra admin-consent link. A global administrator grants consent once for the tenant; no agents are deployed and nothing is installed. Consent is multi-tenant: each customer tenant consents independently and is mirrored independently.

Graph permissions

The platform requests exactly three Microsoft Graph application permissions, all read-only:

• Group.Read.All: groups, nesting, memberships, and group license assignments.
• User.Read.All: users and their license assignments.
• Organization.Read.All: tenant-level subscription and SKU information.

Nothing more is requested. Because every permission is read-only, the platform cannot modify the directory under any circumstances.

Sync behaviour

A full crawl establishes the mirror. After that, Microsoft Graph delta queries keep it current on a per-tenant schedule, including correct handling of deletions. Members are typed correctly during sync: users, devices, nested groups, service principals, and contacts are distinguished, so a device is never mistaken for a nested group.

Roles

Users sign in with Entra ID single sign-on; there are no VisualizerEngine passwords. Inside the platform, four roles are enforced server-side: Viewer, Analyst, Admin, and Auditor.

Views

The same live directory can be explored as an interactive hierarchy tree, a force-directed graph, or a sunburst. Switching is instant, and zoom ranges from the whole tenant down to a single membership edge.

Nesting analysis

• Circular reference detection finds membership loops before they break provisioning.
• Depth analysis compares every chain against the maximum nesting depth your organisation tolerates and ranks every violation.
• Orphan and overlap detection surfaces abandoned groups and groups whose memberships almost entirely overlap.

License analytics

• Inheritance mapping: for any user, the exact path a license travelled through nested groups to reach them.
• Cost analysis by SKU and by group.
• Conflict and duplicate detection, including disabled service plans, tracked per user.
• Utilization alerts and recommendations.
• Removal impact analysis: before you unassign, know exactly who loses what.

Simulation

What-if simulation models a group move or a license change before the directory is touched. Scenarios can have multiple steps, be compared side by side, and generate an ordered implementation plan. Every simulation shows the full blast radius: who gains access, who loses it, which licenses cascade. Simulations run entirely inside VisualizerEngine, never against the live directory.

Policies and compliance

Governance rules, such as nesting depth and structural constraints, are encoded from templates or from scratch. The policy engine scores every violation, computes a live compliance percentage, and plots drift over time.

Snapshots

Point-in-time snapshots capture the directory's state. Any two snapshots can be diffed to show exactly what changed, and structural and license trends are plotted on a dashboard.

Search

An advanced query language covers groups, users, and memberships. Saved searches keep the questions you ask every week one click away.

Exports

• CSV and JSON exports of the full hierarchy and analytics.
• PDF reports with your own branding.
• PNG and SVG image export of any visualization.
• Compliance exports carry provenance metadata and an integrity trailer, so a report can be traced back to the data that produced it.

Notifications

A notification centre provides configurable alerts, and a change-history panel records structural and license changes.

Security model

• Tenant isolation enforced in the database. Every row is bound to a tenant, and Postgres row-level security is FORCE-enabled. Isolation is proven by test.
• Tamper-evident audit trail. Every administrative and read action lands in an HMAC-chained, append-only audit log. Chain verification detects tampering, including tampering by the database itself.
• Least privilege. Read-only Graph permissions; database roles split so the runtime cannot alter its own security policies; secrets file-mounted, never in code.
• Hardened SPA. Strict Content-Security-Policy, Trusted Types, pinned Graph origins, ReDoS and prototype-pollution guards.
• Rate limiting per principal and per tenant, verified by test.
• Encrypted, drilled backups. Restore is rehearsed, not hoped for.

Verified limits

The read path is performance-verified at 50,000 groups and 250,000 memberships, with sub-25 ms page reads and keyset pagination that does not degrade with depth.