Microsoft Graph is the unified API for Microsoft 365 and Entra ID: groups, users, memberships, licenses, devices, and much more are all read and written through it. Any tool that analyzes your directory, first party or third party, is a Graph client.
Permissions scope everything#
A Graph client can only do what its granted permissions allow, and permissions are named precisely: Group.Read.All reads groups and memberships, while Group.ReadWrite.All would also modify them. The permission list an application requests at admin consent therefore tells you its maximum possible behavior, regardless of what its interface exposes.
For directory analysis, the relevant read permissions cover groups and their memberships, users and their license details, and tenant subscription information.
Reading at scale#
Graph paginates large collections and throttles aggressive clients, which is why naive recursive scripts struggle on big tenants. Efficient clients page correctly, respect throttling hints, and use delta queries to fetch only what changed instead of re-crawling.
VisualizerEngine
Graph in VisualizerEngine
VisualizerEngine is a read-only Graph client by design: it asks for Group.Read.All, User.Read.All, and Organization.Read.All, and nothing more. A full crawl establishes the mirror, then delta queries keep it current, including correct handling of deletions.