When a new starter cannot reach what their teammates can, the difference is almost always membership: some group the team accumulated over years that the onboarding template never learned about. The fastest diagnosis is a structured comparison against a working peer.
The peer delta#
Compare the new hire's memberships against a teammate whose access works, including transitive membership, because the missing grant may sit levels above the group the template adds people to:
Connect-MgGraph -Scopes "User.Read.All"
$new = (Get-MgUserTransitiveMemberOf -UserId new.hire@contoso.com).Id
$peer = (Get-MgUserTransitiveMemberOf -UserId teammate@contoso.com).Id
$peer | Where-Object { $new -notcontains $_ } # groups the peer has, the hire lacksFix the template, not just the ticket#
Closing one hire's gap fixes the ticket; the durable fix updates whatever provisions new members of that team, because every future hire hits the same delta. Recurring new-hire tickets from the same team are the signal that the template and the team's real membership have drifted apart.
VisualizerEngine
How VisualizerEngine does it
The graph shows both users' paths side by side, structural search computes the membership delta without PowerShell, and the change-history panel shows when the team's real structure diverged from the onboarding template. Support roles can run the whole diagnosis read-only.