Identity Risk dashboards — permissions & licensing

Identity inventory, guest staleness, monitored-identities count

Admin role membership (privileged-access strip, admin checks), app permission grants, password settings

Sign-in telemetry, per-user sign-in activity, the MFA registration report (both MFA checks)

Conditional Access checks: legacy authentication blocked, baseline access policy

Standing Admin Access check: permanent vs just-in-time (PIM) role assignments

Leaked Credentials check (joins Microsoft risk detections against last password change)

Auto-managed (recommended)

All permissions above are granted automatically at provisioning. Connectors created before the Identity Risk release show an amber "Needs consent" chip on the connector row and a "Grant missing permissions" banner in the detail panel — one Global Admin click adds the missing permission. Nothing else to do.

App-only (manual app registration)

Add the permissions above as Application permissions on your app registration and grant admin consent. If you set up the connector before the Identity Risk release, add RoleManagement.Read.Directory — without it the Standing Admin Access check shows "awaiting consent" (everything else still works). See the app-only connector article for the full registration walkthrough.

Delegated (interactive consent)

Delegated connectors cover the core checks via the standard consented scopes. The PIM check (Standing Admin Access) requires the RoleManagement.Read.Directory scope, which is not part of the default delegated consent — use auto-managed or app-only mode if that check matters to you, or re-consent after the scope is added.

Entra ID Free

Role/app-based checks work (admin inventory, over-privileged apps, service account hygiene). Both MFA checks and the Conditional Access checks show "Requires Entra ID P1" — Microsoft does not expose the MFA registration report or CA policies on Free. Those checks are excluded from the score.

Entra ID P1 (Business Premium / E3)

10 of 12 checks fully assessable. Standing Admin Access shows "Requires Entra ID P2" (PIM is a P2 feature) and Leaked Credentials shows the P2 notice (the leak detection type is masked below P2). Both are excluded from the score, not counted against you.

Entra ID P2 (E5)

All 12 checks fully assessable, including just-in-time admin analysis and leaked-credential rotation tracking.

Customer adds ONLY an app-only connector — does the dashboard work?

Yes, with no errors. After the first sync the score, tiles, and all permission-covered checks populate. Any check missing a permission or license shows a greyed card stating exactly what is needed; the score is computed over the checks that could be assessed. As you add permissions or upgrade licensing, checks light up on the next sync automatically.

Connector existed before this feature shipped

Auto-managed: click the "Needs consent" chip path (one GA consent). App-only: add RoleManagement.Read.Directory in the app registration. Either way the next sync picks it up — no connector recreation, no data loss.

Tenant license changes (e.g., upgrades P1 to E5)

Nothing to configure. License detection is automatic per sync: previously greyed P2 checks (Standing Admin Access, Leaked Credentials) begin evaluating as soon as Microsoft starts returning the data.