A delta query is a Microsoft Graph pattern that returns only the changes to a collection since your previous request: created objects, updated objects, and tombstones for deleted ones. It is the efficient alternative to re-reading an entire directory to find out what moved.
How the pattern works#
The first delta request walks the full collection and ends with a token representing that point in time. Each later request presents the token and receives only the differences plus a new token. Deletions arrive as tombstone entries, which is what makes the pattern complete: a mirror kept by deltas learns about removals, not just additions.
Why it matters operationally#
For any tool that maintains a copy of directory data, the difference between re-crawling and delta syncing is the difference between hours of Graph traffic and seconds. Freshness stops being a scheduled batch job and becomes a continuous property.
VisualizerEngine
Delta queries in VisualizerEngine
The mirror is established by one full crawl, then kept current with Graph delta queries on a per-tenant schedule, including correct handling of deletions. That is why the hierarchy, license flows, and analytics reflect the directory as it is, not as it was at the last export.