Understand every click.

EntraMap has two workspaces. Relationship map explores one object and its relationships. Change Planner compares saved group evidence across a replacement or a later verification scan. This guide covers the 0.6.0 interface, including controls that appear only after an object is selected.

Try the app before connecting a tenant: the interactive tutorial and three planner labs use synthetic data. The tutorial graph is intentionally small and some actions simulate a result. Demo labels, counts and coverage are examples, not a promise about your tenant.

1. Open Relationship map. Choose Start tutorial without sign-in, select User, type engin and open the tutorial result. Click a linked group, inspect its details and fit the graph.
2. For live data, use Sign in with Microsoft on entramap.com. Select your organization account and complete the organization’s normal consent requirements. Check the displayed identity before searching.
3. Select User, Group, Device, App or CA Policy, enter at least two characters and choose a result. Click a node for details; double-click a supported object to make it the new root.
4. For a group, inspect Impact, including access limitations, before interpreting an empty result. Load impact graph for a visual projection, or Compare maps for the difference from the standard map.
5. Open Change Planner. Try Application replacement, expand its changed finding, then select Demo: lost visibility. Unknown demonstrates why an unreadable domain cannot count as resolved.

The relationship map has a left search and insights panel, a central graph, an object detail pane and a Linked Objects rail. The top graph toolbar works on the loaded map. The footer contains project links and, when signed in, Disconnect tenant.

Planner and documentation are separate pages. Save planner snapshots before navigating away: its workspace is page memory. The version identifies the running app, not the age of a scan.

Microsoft sign-in runs in a popup. The app requests delegated Microsoft Graph scopes and operates as the signed-in account. Both granted permissions and the account’s roles, licenses and workload availability can limit visibility.

Start from the canonical public domain. A callback URL is single-use: do not bookmark or replay it. The hosting alias redirects entry pages to the configured callback domain so the session cookie survives the round trip.

On the relationship map, four idle minutes open a 60-second warning, with automatic sign-out at five idle minutes. Mouse, keyboard, scroll or touch activity resets it. This client-side warning is separate from the server session lifetime (60 minutes by default). Planner does not have the map’s idle-warning overlay.

Search is scoped to the selected type. Switching tabs clears the old query and results. Live queries start after a short typing pause (320 ms) and require at least two characters. Results are a bounded lookup, not a directory export. Selecting a result loads its graph and root details.

The App tab searches Intune mobile apps. Enterprise applications are service principals reached through user/group relationships and their own drilldown; they are a separate object type. Object IDs, application IDs and device IDs are not interchangeable.

Nodes represent objects; labelled edges describe observed relationships. The legend identifies types. Included scope and Excluded scope distinguish Conditional Access group targeting. These are references, not a simulation of an actual sign-in.

Operational insights summarize the loaded graph: nodes, devices, explicitly unmanaged devices, explicitly non-compliant devices, CA policies and apps, plus operating-system counts. Missing device flags are not counted as explicit false values. Counts do not describe your entire tenant.

The impact map projects findings from the group impact analysis. It can show dependency resources absent from direct relationship traversal. Explain mode identifies these projected nodes; a dependency is not automatically a navigable directory object.

The details pane displays properties returned for the selected object. Missing data may be omitted or shown with a placeholder; a blank property is not proof of absence. User/group photos can fall back to icons.

User: UPN, email, job title, department, company, office, city/country, mobile, account state, creation/password-change dates, last sign-in when returned, object ID. Group: description, type flags, dynamic membership rule/state and object ID.

Device: operating system/version, display name, trust type, managed/compliant flags, device ID and directory object ID. App/Enterprise App: publisher, type, description, application ID where returned and object ID. CA Policy: enabled/disabled/report-only state, included/excluded group counts, application scope, platforms, required grant controls, AND/OR operator and ID.

The Linked Objects rail lists neighbors of the selected object, grouped by type, with relationship labels and counts. It lists the currently loaded graph, not every possible tenant relationship.

The detail pane has a fixed width in this release; its internal content scrolls. Close it to reclaim graph space.

Impact summarizes blockers, warnings, domains with hits, checked domains, risk score, coverage and confidence. The executive summary and top evidence are a triage aid. A “No blocking dependencies found” result applies only to the collected scope.

Risk score is capped at 100: 25 per blocker + 10 per warning + 5 per incomplete domain. Caution has a minimum score of 15. A blocker yields Blocked; warnings or incomplete domains yield Caution; otherwise the label is Review complete. This is a heuristic, not a probability.

Coverage is the percentage of domains whose collection status is ok. “Complete within scope” still means bounded API collection. Review every access limitation, including errors and scan limits. A low risk score with incomplete coverage cannot establish that deletion is safe.

Each populated domain shows up to three sample findings, an owner suggestion, remediation guidance and checklist steps. Export the evidence for the full finding list. The suggested owner is a team role, not a looked-up responsible person.

Checklist progress is stored in this browser’s local storage per group. Checking a task records your review only: it performs no Graph change and is not shared approval. After actual administrative changes, run a fresh scan or use Change Planner verification.

These controls appear only on an impact graph. The active domain, severity choices and Explain setting are saved in browser local storage. A domain filter that does not exist in the next loaded graph is reset to All. Filters change presentation, not scan coverage or the underlying report.

Map Compare compares two projections of one group: the standard relationship graph and impact graph. It is not a historical comparison and does not compare source and replacement groups. Use Change Planner for those questions.

Metrics show node/edge totals, overlaps and standard-only/impact-only edges. Three lists show standard-only nodes, impact-only nodes and overlapping nodes. Top relation deltas summarize differences in edge labels. The “Ready” badge means comparison output is ready, not that a group is safe to remove.

The tutorial screenshot uses the simplified demo comparison. Live comparisons additionally show metrics and Type, Search and Sort controls described below.

Each domain carries its own collection status and evidence. The planner compares resource references and selected semantic fields: impact, appRoleId, assignment, disabledPlans, directoryScopeId, appScopeId and state. Evidence timestamps/endpoints help trace a finding; they are not themselves assignment equivalence.

“Settings” below means collected reference settings can be compared in replacement mode. “Manual” means replacement rows require manual_review even when both collections succeeded. Verification can still describe observed changes, but never migrates the resource.

The planner has a Source group (baseline) and a Comparison group or later source scan. It collects fresh impact evidence and up to 10,000 direct member IDs. It requires no write permission and performs no migration or removal.

Capturing a new baseline clears the previous comparison/report. A failed new capture invalidates the stale scan for that slot so it cannot be mistaken for fresh evidence. Busy actions disable controls while a request runs; large tenants may take several minutes.

Each scan summary shows its group name, SYNTHETIC LAB or LIVE TENANT SCAN, capture timestamp, snapshot ID and readable-domain ratio. The UUID in this summary is the snapshot ID; the group object ID is the resolved input and is also preserved inside the saved snapshot.

1. Sign in from Relationship map, then open Change Planner. Search a source group or paste its directory object ID. Choose Capture baseline and Save baseline.
2. Find a different proposed replacement group. Choose Scan replacement. Confirm both names, IDs, timestamps and coverage summaries.
3. Choose Compare replacement assignments and select Compare evidence. Inspect changed, missing, additional, unknown and manual-review rows, direct members and coverage limitations.
4. Export a dossier for review. Carry out approved changes separately in the relevant Microsoft administration tools.
5. Keep/import the original baseline, select Re-scan source, then Compare evidence in verification mode. Expand the results and verify remaining limitations.

Labs replace the current planner workspace with synthetic source/replacement evidence and immediately show a comparison. Save any live snapshots before choosing a lab. Demo and live snapshots cannot be mixed.

Each lab includes one deliberate settings change, a later scan with the reference removed and a later scan with visibility lost. This makes changed, removed and unknown reproducible without a tenant. Demo comparisons do not validate your live tenant.

The report title identifies replacement readiness or changes to the source. Status counts count resource rows, not members or all assignments in the tenant. “Collected references reviewed” is not deletion approval.

Coverage limitations are listed even when neither scan produced findings. Direct member comparison is available only when both membership collections succeeded: Shared is an intersection count; Only before / Only after contain direct member IDs. Matching membership does not establish effective access.

Snapshots live in page memory. Refreshing, closing or leaving the planner clears them. Save both sides explicitly before leaving. A saved snapshot contains group and tenant/account identifiers, direct member IDs, settings and collection evidence.

The server signs snapshots and validates their contents, issuing deployment, tenant and account when comparing/exporting. Acceptance lasts 24 hours. Import performs structural checks first; successful import alone does not establish server acceptance. Use the original unmodified JSON.

Each import is limited to 4 MB; the server request limit is 8 MB. The same scope and scan version are required. Verification requires a different snapshot ID and later capturedAt for the same group. An invalid import leaves the current slot intact.

A JSON dossier contains the exact before/after signed envelopes, but the whole dossier is not a snapshot import file. Graph JSON, map-compare JSON and pseudonymized reports are also not snapshot files. Save baseline/comparison is the supported way to obtain an importable file.

Export timestamps and scan timestamps have different meanings. Graph exports describe the loaded view, impact exports can perform fresh collection, and Planner dossiers compare the exact selected snapshots. Keep coverage with the evidence when sharing.

The application triggers browser downloads; your browser determines whether they save automatically, prompt or are blocked. Check its downloads list. If a download is missing, allow downloads for the site and retry. A toast by itself does not verify that a file was saved.

Pseudonymize exports is available for Planner dossiers only. Other exports can include names, object IDs and tenant evidence. Pseudonymization removes raw identifiers/evidence, but contextual counts and statuses can still be sensitive to your organization.

Tutorials replace live map interactions with fixed synthetic objects while active. Progress is saved locally in the browser and completed levels receive a checkmark. You can choose any level; God Mode is a tutorial name, not elevated tenant access.

Basic (8 steps): User → search engin → open identity → linked group → copy ID → rail Reset → Fit → graph JSON.

Advanced (10 steps): Group → search tier0 → open group → Impact → impact export → impact graph → Compare maps → open impact from compare → compare JSON → compare CSV.

Expert (12 steps): Group → tier0 → open group → Details → Impact → impact map → unmanaged → non-compliant → reset focus → filtered export → compare → fit.

God Mode (13 steps): Device → win11 → open endpoint → copy ID → reset layout → App → portal → open app → copy ID → CA Policy → mfa → open policy → fit. The tutorial app is a synthetic teaching object; live App search is Intune app search.

The coach highlights the expected target and displays What this does / Why it matters. Waiting for action means the expected interaction has not completed. Tutorial exports may be simulated with a toast, so use live or planner-lab exports to test actual files.

All 18 scopes below are requested as delegated permissions in this release. Consent is handled by Microsoft and your organization’s policy. EntraMap’s read-only Graph calls do not require you to grant write scopes.

Permission checks probe representative endpoints. OK means that probe succeeded; it does not guarantee every domain/sub-endpoint is available. Missing, Not licensed and Not applicable have different meanings. Domain-specific scan coverage remains the evidence for a particular scan.

A graph is a bounded exploration, not an exhaustive tenant inventory. A group impact scan covers the 20 implemented domains, subject to permission, workload, endpoint, paging and resource limits. Public tutorials show simplified coverage, not production completeness.

Ordinary Graph results may be cached for five minutes. Map reload and Planner captures request fresh reads. Freshness bypasses EntraMap’s cache, not Microsoft’s replication delay. Separate requests are observations over time, not an atomic transaction.

Statuses: ok means collection completed within the implemented scope; partial means some collection failed or was truncated; no_permission means access was denied; not_licensed means the API reported unavailable licensed functionality; error means collection failed; not_scanned is a comparison placeholder when a domain is absent. Read the accompanying reason and evidence. Workload non-applicability may be recorded separately from an ok domain status.

A reached collection limit or failed later page is incomplete coverage. Empty data from an unreadable domain is never evidence of removal. Resource 404s may mean no backing workload, but a failed collection is a limitation.

Enterprise app group assignments do not flow through nested group membership. Conditional Access needs actual sign-in context to evaluate. Intune has workload-specific applicability rules. Dynamic/synchronized groups require source-system review. Microsoft 365 group replacement does not migrate Teams, SharePoint, mailbox or Planner content.

Start with the exact message, app version, selected mode and scan timestamps. Preserve originals before retrying. Do not post tokens, signed live snapshots or tenant evidence in a public issue.

Live Graph requests run through the server using the signed-in session. Server-side sessions contain identity and an encrypted token-cache blob. A stable FLASK_SECRET_KEY is needed to keep sessions/signatures usable; operators must protect both the secret and session storage.

The browser holds the loaded map and planner workspace. Local storage holds tutorial progress, impact filter profile, group checklist state and the permission-warning skip preference. These are browser/origin-local, not shared workflow records. Disconnect clears local/session storage on the app’s origin.

Planner snapshots and dossiers saved to disk persist independently of sign-out. Treat them according to your organization’s handling rules. Pseudonymize applies only to Planner report exports, not saved snapshots, live UI, map exports or impact exports.

The documentation is public and performs no Graph requests. Screenshots here were captured from actual built-in synthetic tutorial/lab screens. No live tenant screenshots are published.

The repository is the source of truth for deployment-specific settings. This page describes the 0.6.0 implementation. Use a stable HTTPS public origin with REDIRECT_URI ending /auth/callback, and configure the identical Web redirect URI in the Microsoft app registration.

For production, protect CLIENT_SECRET and FLASK_SECRET_KEY in your hosting configuration. Keep the Flask secret identical across workers. Filesystem sessions on ephemeral container storage can disappear during restart; multi-instance deployments need a shared session backend such as the supported Redis option.

The repository’s GitHub Actions validates Python regressions, frontend DOM tests and an HTTP smoke check before deploying main to Azure App Service. A successful deployment event can precede worker activation; verify public health/version and a fresh session after the new worker is serving.

Local development: install requirements.txt, set CLIENT_ID / CLIENT_SECRET / FLASK_SECRET_KEY and a local redirect URI, then run python app.py. Default port is 5000. Run python -m unittest discover -s tests -v and npm ci --prefix tests/frontend --ignore-scripts followed by npm test --prefix tests/frontend.

These are application endpoints, not a separately versioned public API service. Live reads require the browser’s EntraMap session. Never expose session cookies or tokens in scripts, URLs or issue reports. The public labs and docs work without tenant access.

Planner POST requests use JSON plus X-EntraMap-Request: planner. Comparison/export validate signed inputs and ownership for live data. A missing header or invalid envelope yields 400; live scans without authentication yield 401. The supported user workflow is the planner UI.

A signed snapshot envelope has data and signature. Data includes schemaVersion, scanVersion, id, tenantId, ownerId, demo, capturedAt, scope and result. Result contains group, summary, domains and direct membership. Preserve every field exactly. Editing data invalidates its signature.

Use Tab/Shift+Tab to reach focusable controls, Enter to activate buttons/links, Space for checkboxes and arrow keys for native select options. Escape in the map search clears results. Native disclosure rows in Planner open with Enter/Space. Graph canvas manipulation also uses pointer gestures.

Toolbar icons have hover titles; the reference above gives their names. The graph is a visual investigation tool: use the linked-object rail, detail text and exported evidence when a canvas relationship is hard to inspect. Do not rely on node color alone; read types, labels and scope text.

The signed-in relationship map includes a small Asteroids easter egg: enter Up Up Down Down Left Right Left Right B A, without long pauses. While signed out it shows a playful refusal instead. The game has no tenant permissions or Graph actions.

Chapters and controls have stable fragment links so you can share a precise explanation. The complete handbook is server-rendered and readable without JavaScript. Search, automatic index sorting and the print button use JavaScript; browser Find and Print remain available without it.