EntraIDCanvas - Microsoft Entra ID Documentation Tool

 

Introducing EntraIDCanvas

Microsoft Entra ID Documentation Tool

 

Run one PowerShell script. Open one self-contained HTML file. Document the current state of your Microsoft Entra ID tenant.

 

Microsoft Entra ID has become one of the most important identity control planes in modern organizations. It manages users, groups, applications, devices, directory roles, Conditional Access, domains, licensing, and many of the identity relationships that support cloud and hybrid environments.

Download the Tool

EntraIDCanvas is open source and available on GitHub. View EntraIDCanvas on GitHub

Direct download: Download the latest main-branch ZIP

The challenge is that these settings are distributed across multiple portals, blades, Microsoft Graph endpoints, and administrative experiences. When you need a point-in-time document for an architecture review, migration, audit, handover, customer engagement, or simply to understand what is configured today, manually collecting that information can become time-consuming.

That is the problem I created EntraIDCanvas to address. EntraIDCanvas is a PowerShell-based Microsoft Entra ID documentation tool that queries the tenant through Microsoft Graph and generates a portable, self-contained HTML report.

Figure 1 - EntraIDCanvas executive summary and tenant configuration view, showing the report's sidebar navigation, tenant summary, domains, and license information.

Why Entra ID Documentation Matters

Cloud identity changes quickly. New users and applications appear, licenses are reassigned, Conditional Access policies are introduced, service principals accumulate, credentials approach expiration, devices move between join states, and administrative roles change. The Microsoft Entra admin center is excellent for administration, but it is not designed to produce a single archival document describing the entire tenant.

Good documentation provides a stable reference point. It allows an identity team to capture the tenant as it exists at a particular time and retain that state for comparison, review, governance, or operational handover.

EntraIDCanvas is designed to document the tenant's current state. It is not intended to replace the Microsoft Entra admin center or a formal security assessment.

 

What Is EntraIDCanvas?

EntraIDCanvas is delivered as a single PowerShell script. During collection, the script authenticates to Microsoft Graph, queries the tenant using read-only Graph permissions, and generates an HTML report containing the collected information and visual summaries.

·         Single PowerShell script.

·         Microsoft Graph-based data collection.

·         Read-only Graph permissions.

·         Self-contained HTML output.

·         No agents or web server required.

·         No external CSS, JavaScript, or chart dependencies after report generation.

·         Responsive report design for desktop, tablet, and mobile.

·         Print-friendly output.

·         Resilient collection: the report can still generate when individual data calls are unavailable.

Figure 2 - EntraIDCanvas collection and report-generation console. The script connects to Microsoft Graph, collects each documentation component, and summarizes the resulting tenant data.

What EntraIDCanvas Documents

The report is organized around the core areas an identity administrator or architect typically needs when documenting a Microsoft Entra ID tenant: tenant configuration, identity objects, applications, security configuration, and visual summaries.

1. Tenant and Organization Configuration

The tenant-level section establishes the basic identity boundary and provides the organizational context for the rest of the report.

·         Tenant name and tenant ID.

·         Tenant creation date.

·         Technical contacts.

·         Directory synchronization status.

·         Last synchronization time.

·         Verified domains and authentication type.

·         Default and initial domain indicators.

·         Supported services associated with each domain.

·         Subscribed licenses / SKUs, including total, consumed, and available counts.

·         Microsoft Entra Security Defaults status.

·         Authorization policy details, including guest access and user application-registration permissions.

2. Users

User documentation is summarized so that the report provides both scale and identity-source context without turning into an unreadable object dump.

·         Total users.

·         Enabled and disabled users.

·         Member and guest accounts.

·         Synchronized and cloud-only users.

·         Licensed and unlicensed users.

·         Users inactive for 90 days or more.

·         Users that have never signed in, where the Graph data is available.

3. Groups

·         Total group count.

·         Security groups.

·         Microsoft 365 groups.

·         Distribution groups.

·         Dynamic versus assigned membership.

·         Synchronized versus cloud-only group source.

4. Devices

Device identity is an important part of Entra ID documentation because device state is frequently used by Conditional Access and Zero Trust controls.

·         Total device count.

·         Microsoft Entra joined devices.

·         Hybrid Microsoft Entra joined devices.

·         Registered devices.

·         Compliant and managed-device information.

·         Operating-system distribution.

5. Directory Roles and Administrative Units

·         Active directory roles.

·         Role member counts.

·         Role member names.

·         Administrative Units.

·         Administrative Unit membership type.

This gives administrators a useful current-state record of who holds privileged or delegated directory roles and how administrative scoping is structured.

6. Applications and Enterprise Applications

Applications are one of the fastest-growing areas in many Entra ID tenants. EntraIDCanvas documents both application registrations and service principals so the report can show the tenant's application footprint.

·         Application registrations.

·         Sign-in audience.

·         Application creation date.

·         Enterprise applications / service principals.

·         Service principal type, including applications and managed identities.

·         Application secrets and certificates that are expired or expire within 30 days.

The expiring-credential section is particularly useful as documentation because it creates a point-in-time record of application credential lifecycle exposure.

7. Conditional Access and Named Locations

Conditional Access is a central Entra ID security control. EntraIDCanvas records policy state and the major policy components so the report can be used as an architectural reference.

·         Conditional Access policy name.

·         Enabled, disabled, or report-only state.

·         Policy conditions.

·         Grant controls.

·         Named locations and their type.

8. Consolidated Security Configuration

The report includes a consolidated security-configuration view that brings several identity-security indicators together without turning them into a score.

·         Security Defaults status.

·         Global Administrator count.

·         Conditional Access policy count.

·         Guest-user count.

·         User application-registration permissions.

·         Device compliance ratio.

·         Expiring application credentials.

Visual Documentation: 12 Interactive Charts

One of the strengths of the report is that it does not rely only on tables. EntraIDCanvas generates 12 visual components that make the tenant easier to understand at a glance.

·         User Status - enabled, disabled, members, and guests.

·         User Source - cloud-only versus synchronized.

·         User Licensing - licensed versus unlicensed.

·         Group Types - security, Microsoft 365, and distribution.

·         Group Membership Type - dynamic versus assigned.

·         Group Source - cloud versus synchronized.

·         Device Join Type - Entra joined, hybrid joined, and registered.

·         Device Compliance - compliant versus non-compliant.

·         Device OS Distribution.

·         Conditional Access Policy Status - enabled, disabled, and report-only.

·         Service Principal Types - application and managed identity.

·         Directory Roles - top roles by member count.

Figure 3 - EntraIDCanvas visual dashboard. The report provides 12 charts covering users, groups, devices, Conditional Access, enterprise applications, and directory roles.

A Report Designed for Navigation

The generated HTML uses a left-side navigation model so a reader can move directly to the section they need. The current navigation groups information under Overview, Identity, Applications, Security, and Visuals.

Figure 4 - EntraIDCanvas navigation structure: Overview, Identity, Applications, Security, and Visuals.

How EntraIDCanvas Works

EntraIDCanvas uses the Microsoft Graph PowerShell module to retrieve tenant data. Internet access is required during collection so the script can reach Microsoft Graph. Once the report is generated, the HTML report itself has no external dependencies and can be opened locally in a browser.

Requirements

·         Windows PowerShell 5.1 or later, or PowerShell 7+.

·         Microsoft.Graph PowerShell module.

·         An Entra ID account with appropriate read access; Global Reader is recommended by the project.

·         Internet access during data collection to reach Microsoft Graph.

Quick Start

Install the Microsoft Graph PowerShell module once:

Install-Module Microsoft.Graph -Scope CurrentUser

Then run EntraIDCanvas:

.\EntraIDCanvas.ps1

To choose a report directory:

.\EntraIDCanvas.ps1 -OutputPath C:\Reports

Microsoft Graph Permissions

The current script requests read-only Graph scopes for directory, user, group, application, policy, role, device, organization, audit-log, domain, Conditional Access, and authentication-method information.

Directory.Read.All, User.Read.All, Group.Read.All, Application.Read.All,
Policy.Read.All, RoleManagement.Read.Directory, Device.Read.All,
Organization.Read.All, AuditLog.Read.All, Domain.Read.All,
Policy.Read.ConditionalAccess, UserAuthenticationMethod.Read.All

All permissions requested by the current project are read-only; the script does not modify the tenant.

 

Why a Self-Contained HTML Report Matters

For documentation, portability matters. A report that requires a server, a cloud dashboard, or external JavaScript libraries is harder to archive and harder to move between customers or teams. EntraIDCanvas embeds its CSS, JavaScript, and SVG resources inside the generated report.

·         Open the report directly from disk.

·         Store it with project or audit documentation.

·         Attach it to a handover package.

·         Archive dated copies as point-in-time tenant records.

·         Print or save it as a PDF using the browser's print capability.

·         Review the report after collection without requiring continued Microsoft Graph connectivity.

Where EntraIDCanvas Fits

Scenario	Documentation value
Tenant discovery	Create an initial picture of users, groups, devices, applications, roles, policies, domains, and licenses.
Architecture review	Provide architects with a single tenant reference before redesign or modernization work.
Mergers & acquisitions	Capture tenant state before consolidation, migration, or coexistence planning.
Operational handover	Give a new administrator, MSP, or support team a structured current-state document.
Audit preparation	Create a repeatable factual record of identity configuration and object populations.
Conditional Access projects	Document the existing policy footprint and named locations before major policy changes.
Application governance	Establish the app-registration, enterprise-app, and credential baseline.
License review	Capture subscribed SKUs and utilization at the time of collection.
Zero Trust programs	Document users, devices, applications, roles, and Conditional Access inputs that support identity-centric Zero Trust.

Documentation, Not Just Another Portal View

The Microsoft Entra admin center remains the place to administer the tenant. EntraIDCanvas serves a different purpose: it converts the live tenant into a structured document that can be read, shared, archived, and used outside the portal.

That distinction is important. Documentation is about establishing a known state. It should answer practical questions such as: What domains are configured? Is directory synchronization enabled? How many guest users exist? Which directory roles are active? How many enterprise applications exist? What Conditional Access policies are present? Are any application credentials close to expiration?

EntraIDCanvas turns Microsoft Entra ID configuration into a portable current-state document.

 

Recommended Documentation Workflow

1.       Run EntraIDCanvas using an account that has the required read access.

2.       Confirm that all expected collection components completed successfully.

3.       Review the Executive Summary first to establish tenant scale and identity posture.

4.       Review domains, synchronization status, users, groups, devices, and licensing.

5.       Review directory roles and Administrative Units for privileged and delegated administration context.

6.       Review app registrations, enterprise applications, and expiring credentials.

7.       Review Conditional Access, named locations, and the consolidated security-configuration section.

8.       Archive the HTML report with a date and project or tenant identifier.

9.       Repeat the collection before and after major tenant changes to maintain point-in-time documentation.

#MicrosoftEntra #EntraID #PowerShell #IdentitySecurity #IAM

 #MicrosoftGraph #ConditionalAccess #AzureAD #ZeroTrust #CloudSecurity #IdentityManagement #CyberSecurity #MicrosoftSecurity #CloudIdentity #EntraIDGovernance

Conclusion

Microsoft Entra ID is no longer a small collection of cloud users and groups. It is an identity platform that connects people, devices, applications, authentication controls, administrative roles, and cloud access policy. As that environment grows, documentation becomes increasingly important.

EntraIDCanvas provides a simple way to create that documentation. It uses familiar PowerShell and Microsoft Graph tooling, collects the tenant through read-only permissions, and produces one portable HTML report that can serve as a baseline for operations, architecture, migration, governance, and identity-security work.

The project is available on GitHub under the MIT License, and contributions and feedback are welcome.

Project / Download: https://github.com/SanthoshSivarajan/EntraIDCanvas

Posted in: