EntraGroupInsights

1.0.0

Visualizes and de-risks Microsoft Entra ID dynamic group rules: rule-tree parsing, at-scale membership simulation, snapshot/diff versioning, and blast-radius mapping (Conditional Access, license, app role, and PIM dependencies - including inheritance through nested/parent groups and rule-based memberOf references) for a given group, with an SVG relationship report and
Visualizes and de-risks Microsoft Entra ID dynamic group rules: rule-tree parsing, at-scale membership simulation, snapshot/diff versioning, and blast-radius mapping (Conditional Access, license, app role, and PIM dependencies - including inheritance through nested/parent groups and rule-based memberOf references) for a given group, with an SVG relationship report and example-user "would they match" illustration.
Show more

Minimum PowerShell version

5.1

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name EntraGroupInsights

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

Install-PSResource -Name EntraGroupInsights

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

Copyright

(c) Pascal Huber. All rights reserved.

Package Details

Author(s)

  • Pascal Huber

Tags

Entra EntraID AzureAD IdentityGovernance ConditionalAccess DynamicGroups MicrosoftGraph Security

Functions

Get-EGIDynamicGroupRuleTree Test-EGIDynamicGroupRule Get-EGIGroupBlastRadius Export-EGIGroupBlastRadiusSvg Export-EGIGroupSnapshot Compare-EGIGroupSnapshot

PSEditions

Desktop Core

Dependencies

Release Notes

1.0.0: first stable release. Rule-tree parsing and bulk membership simulation for the common comparison operators, blast-radius mapping (Conditional Access, license, app role, and PIM dependencies) now including inheritance through nested/parent groups and rule-based memberOf references, a self-contained SVG relationship report with optional example-user match illustration, and JSON snapshot/diff for change tracking. See README Limitations for what is intentionally out of scope (Direct Reports rules, employeeHireDate date-math, and the general -and/-or precedence caveat).

FileList

Version History

Version Downloads Last updated
1.0.0 (current version) 4 8/4/2026
0.1.2 15 7/21/2026
0.1.1 4 7/21/2026