AzureAdministrativeUnits
Azure Administrative Units Discovery Module for M&A Discovery Suite
What it does
Discovers Azure AD Administrative Units and their members using Microsoft Graph API. Administrative Units provide organizational boundaries for role-based access control. Includes enriched columns via pure testable mappers and multi-strategy collection with graceful fallback. Strategy 1 expands members only (scopedRoleMembers does not support $expand and causes BadRequest when combined). Strategy 2 lists AUs then lazy-loads members and scoped role memberships per unit. Migration-useful columns (v1.4.0): - Stable ids (ObjectId, MemberObjectId, RoleId) + human labels (never id-as-name) - Parent relationships: TenantId / ParentTenantId, ApplicationId (discovering SP) - GraphResourceUri for re-fetch; MembershipRuleProcessingState as dynamic "provisioning" state - Member edges: mail, accountEnabled, userType when Graph returns them - Scoped-role edges: RoleDisplayName via roleDefinitions lookup (empty + UNRESOLVED_REF if missing) Exports: - AzureAdministrativeUnits.csv (AU parent rows) - AzureAdministrativeUnitMembers.csv (AU→member edges for migration joins) - AzureAdministrativeUnitScopedRoleMembers.csv (AU→scoped role edges when present)
How the app exposes it
The module runs through the ACQI discovery orchestrator and writes its rows into a dedicated results view. From there, conflicts, dependencies, and readiness scores feed the deal-wide consolidation layer.
/discovered/azure-administrative-units Outputs
Each module emits a normalised CSV keyed by entity ID with readiness and risk scores, evidence-source counts, and last-seen timestamps. The exact column set varies by module — the app's results view shows the live schema.