platform-identity-graph

Type: decision

Decision

Landing zone-managed identities receive Microsoft Graph permissions, allowing them to query Entra ID objects.

Why

Without these permissions, landing zone automation can't detect Entra ID users, groups and applications.

Links

• landing-zone-identity — Receives Directory.Read.All at landing zone creation time.
• initial-setup — Graph permissions are granted via admin consent as a manual prerequisite.

← Back to all decisions