Entra ID structure, defined
Short, precise definitions of the concepts behind Microsoft Entra ID group structure and licensing, each with the operational context the definition alone leaves out. Task-oriented material lives in the guides.
Access review
An access review is a periodic certification that access is still appropriate. What reviews certify in Entra ID, why they rubber-stamp, and what makes them meaningful.
Admin consent
Admin consent is how a global administrator grants an application permissions in an Entra ID tenant. How the consent flow works and what to check before granting it.
Blast radius
Blast radius is the full set of consequences of a directory change: who gains or loses access and every license that cascades. Compute it before changing anything.
Circular group reference
A circular group reference is a loop in Entra ID group nesting: A contains B, B contains C, C contains A. Why loops break provisioning and how they are detected.
Delta query
Delta queries return only what changed in Microsoft Graph data since the last request, including deletions. Why they matter for keeping a directory mirror current.
Deprovisioning
Deprovisioning removes an identity's access when no longer needed: at offboarding, role change, or project end. Why group structure decides whether it completes.
Direct vs group-based license assignment
The two ways a Microsoft 365 license reaches a user in Entra ID: assigned directly or inherited from a group. How the models differ and why mixing them causes confusion.
Directory drift
Directory drift is the gradual divergence between a directory's designed structure and its actual state, built up by everyday changes. How it is measured and controlled.
Dynamic group
Dynamic groups compute membership from rules over user or device attributes instead of manual addition. How they interact with nesting and group-based licensing.
Effective access
Effective access is what a user can actually reach once every membership, nesting chain, and inherited grant is counted. Why it differs from what any single list shows.
Entra Connect sync
Entra Connect synchronizes on-premises Active Directory objects into Entra ID. What synced groups mean for cloud management, and why hybrid structure is harder to see.
Entra ID tenant
An Entra ID tenant is an organization's dedicated directory instance: users, groups, devices, applications, and licenses. What it contains and why its structure matters.
Group expiration policy
The Entra ID group expiration policy retires inactive Microsoft 365 groups unless renewed. What it covers, what it does not, and where it fits in sprawl control.
Group membership types
Entra ID group members can be users, devices, nested groups, service principals, and contacts. Why member typing matters and how mistyping corrupts hierarchy analysis.
Group nesting
Group nesting is placing one Entra ID group inside another so inner members become indirect members of the outer group. How it works and where it goes wrong.
Group owner
A group owner is the accountable manager of an Entra ID group: its membership, purpose, and lifecycle. Why ownerless groups are a governance failure and how to find them.
Group-based licensing
Group-based licensing assigns Microsoft 365 licenses to an Entra ID group and members inherit them automatically. How it works, service plans, and its blind spots.
Keyset pagination
Keyset pagination reads large datasets page by page using a cursor on a sorted key, keeping deep pages as fast as the first. Why it matters for directory-scale data.
License inheritance
License inheritance is how a Microsoft 365 license reaches a user through group membership, including nested groups. Why the inheritance path matters and how to see it.
Microsoft Graph
Microsoft Graph is the API surface for Microsoft 365 and Entra ID data, including groups, users, memberships, and licenses. How permissions scope what an app can read.
Nesting depth
Nesting depth is the length of a chain of nested groups in Microsoft Entra ID. Why depth matters for access reasoning, and how organizations set and enforce a maximum.
Orphaned group
An orphaned group has no owner, no members, or no remaining purpose. Why orphaned Entra ID groups accumulate, the risk they carry, and how they are found.
Point-in-time snapshot
A point-in-time snapshot captures a directory's complete structure: groups, memberships, and license assignments. Why snapshots are the basis of provable history.
Role-based access control
Role-based access control grants permissions through roles rather than individuals. How RBAC relates to groups in Entra ID, and why role sprawl mirrors group sprawl.
Security groups vs Microsoft 365 groups
The two main Entra ID group types: security groups for access control, Microsoft 365 groups for collaboration, and how each behaves in nesting and licensing.
Service plan
A service plan is a single service inside a Microsoft 365 SKU, such as Exchange Online inside E5. How plans are enabled per assignment and how conflicts arise.
Service principal
A service principal is an application's identity in an Entra ID tenant. Why service principals appear in groups and what that means for structure analysis.
SKU
A SKU is a purchasable Microsoft 365 product such as E3 or E5, bundling multiple service plans. How SKUs, seats, and assignments relate in Entra ID licensing.
Transitive membership
Transitive membership is a user's effective membership in an Entra ID group through any chain of nested groups. How it is computed and why it defines real access.
Usage location
Usage location is the per-user country property some Microsoft 365 services require before a license can be assigned. Why missing values cause group licensing errors.
See how everything connects.
Request early access to VisualizerEngine. Read-only onboarding, with no agents to install and no changes to your directory.