AzureDirectoryRoles
Azure Directory Roles Discovery - enumerates Entra ID (Azure AD) directory
What it does
Uses pure REST client-credentials + Graph HTTP (no Microsoft.Graph SDK / Connect-MgGraph). SDK auth was hanging under Crucible's short prove timeout. Calls MS Graph /v1.0/directoryRoles to enumerate all activated directory roles, then /v1.0/directoryRoles/{id}/members when $expand=members is not available, broken down by principal type (User / Group / ServicePrincipal). Output: AzureDirectoryRoles.csv - one row per activated role (enriched) AzureDirectoryRoleMembers.csv - one row per role-member assignment Required Graph app permissions: - Directory.Read.All OR RoleManagement.Read.Directory
How the app exposes it
The module runs through the ACQI discovery orchestrator and writes its rows into a dedicated results view. From there, conflicts, dependencies, and readiness scores feed the deal-wide consolidation layer.
/discovered/azure-directory-roles Outputs
Each module emits a normalised CSV keyed by entity ID with readiness and risk scores, evidence-source counts, and last-seen timestamps. The exact column set varies by module — the app's results view shows the live schema.