schema

Microsoft Schema

graph LR
    AzureTenant -- RESOURCE --> EntraAppRoleAssignment
    AzureTenant -- RESOURCE --> EntraApplication
    AzureTenant -- RESOURCE --> EntraGroup
    AzureTenant -- RESOURCE --> EntraOU
    AzureTenant -- RESOURCE --> EntraRoleAssignment
    AzureTenant -- RESOURCE --> EntraRoleDefinition
    AzureTenant -- RESOURCE --> EntraServicePrincipal
    AzureTenant -- RESOURCE --> EntraUser
    AzureTenant -- RESOURCE --> IntuneCompliancePolicy
    AzureTenant -- RESOURCE --> IntuneDetectedApp
    AzureTenant -- RESOURCE --> IntuneManagedDevice
    AzureTenant -- RESOURCE --> M365License
    AzureTenant -- RESOURCE --> M365ServicePlan
    EntraAppRoleAssignment -- ASSIGNED_TO --> EntraApplication
    EntraApplication -- SERVICE_PRINCIPAL --> EntraServicePrincipal
    EntraGroup -- HAS_APP_ROLE --> EntraAppRoleAssignment
    EntraGroup -- HAS_ROLE --> EntraRoleAssignment
    EntraGroup -- MEMBER_OF --> EntraGroup
    EntraRoleAssignment -- ASSIGNED_TO --> EntraRoleDefinition
    EntraServicePrincipal -- HAS_ROLE --> EntraRoleAssignment
    EntraUser -- ASSIGNED_LICENSE --> M365License
    EntraUser -- ENROLLED_TO --> IntuneManagedDevice
    EntraUser -- HAS_APP_ROLE --> EntraAppRoleAssignment
    EntraUser -- HAS_ROLE --> EntraRoleAssignment
    EntraUser -- MEMBER_OF --> EntraGroup
    EntraUser -- REPORTS_TO --> EntraUser
    IntuneCompliancePolicy -- APPLIES_TO --> IntuneManagedDevice
    IntuneCompliancePolicy -- ASSIGNED_TO --> EntraGroup
    IntuneManagedDevice -- HAS_APP --> IntuneDetectedApp
    M365License -- HAS_SERVICE_PLAN --> M365ServicePlan

AzureTenant

A Microsoft tenant, with EntraTenant retained as a compatibility label.

Ontology Mapping: This node uses the ontology label Tenant.

Additional Labels: This node also uses EntraTenant.

Additional Label Definitions:

  • EntraTenant: A microsoft node participating in the shared EntraTenant graph interface.

Properties

Ontology-generated fields are shown in italics.

Field Index Description
id Yes Microsoft tenant ID.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
created_date_time Timestamp when the tenant was created.
default_usage_location Default tenant usage location.
deleted_date_time Timestamp when the tenant was deleted.
display_name Display name of the tenant.
marketing_notification_emails Email addresses that receive marketing notifications.
mobile_device_management_authority Mobile device management authority for the tenant.
on_premises_last_sync_date_time Timestamp of the latest on-premises directory synchronization.
on_premises_sync_enabled Whether on-premises directory synchronization is enabled.
partner_tenant_type Partner relationship type of the tenant.
postal_code Postal code of the tenant address.
preferred_language Preferred language of the tenant.
state State or province of the tenant address.
street Street portion of the tenant address.
tenant_type Microsoft directory tenant type.
_ont_name Yes Normalized field sourced from display_name.
_ont_source Module that populated this node's ontology fields.

Relationships

  • (:AzureManagementGroup)-[:PARENT]->(:AzureTenant): A root Azure management group has the tenant as its parent.

  • (:AzureTenant)-[:RESOURCE]->(:AzureManagementGroup): An Azure tenant contains the management group as a resource.

  • (:AzureTenant)-[:RESOURCE]->(:AzurePrincipal): An Azure tenant contains the principal as a resource.

  • (:AzureTenant)-[:RESOURCE]->(:AzureSubscription): An Azure tenant contains the subscription as a resource.

  • (:AzureTenant)-[:RESOURCE]->(:EntraAppRoleAssignment): Links a Microsoft tenant to one of its app role assignments.

  • (:AzureTenant)-[:RESOURCE]->(:EntraApplication): Links a Microsoft tenant to one of its Entra applications.

  • (:AzureTenant)-[:RESOURCE]->(:EntraGroup): Links a Microsoft tenant to one of its Entra groups.

  • (:AzureTenant)-[:RESOURCE]->(:EntraOU): Links a Microsoft tenant to one of its administrative units.

  • (:AzureTenant)-[:RESOURCE]->(:EntraRoleAssignment): Links a Microsoft tenant to one of its directory role assignments.

  • (:AzureTenant)-[:RESOURCE]->(:EntraRoleDefinition): Links a Microsoft tenant to one of its directory role definitions.

  • (:AzureTenant)-[:RESOURCE]->(:EntraServicePrincipal): Links a Microsoft tenant to one of its service principals.

  • (:AzureTenant)-[:RESOURCE]->(:EntraUser): Links a Microsoft tenant to one of its Entra users.

  • (:AzureTenant)-[:RESOURCE]->(:IntuneCompliancePolicy): Links a Microsoft tenant to one of its Intune compliance policies.

  • (:AzureTenant)-[:RESOURCE]->(:IntuneDetectedApp): Links a Microsoft tenant to a detected Intune application.

  • (:AzureTenant)-[:RESOURCE]->(:IntuneManagedDevice): Links a Microsoft tenant to one of its Intune managed devices.

  • (:AzureTenant)-[:RESOURCE]->(:M365License): Links a Microsoft tenant to one of its Microsoft 365 licenses.

  • (:AzureTenant)-[:RESOURCE]->(:M365ServicePlan): Links a Microsoft tenant to one of its Microsoft 365 service plans.

EntraApplication

An application registration in Microsoft Entra ID.

Ontology Mapping: This node uses the ontology label ThirdPartyApp.

Properties

Ontology-generated fields are shown in italics.

Field Index Description
id Yes Entra application object ID.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
_ont_enabled Property generated by analysis job: Ontology - Entra application projection.
app_id Application client ID.
display_name Display name of the application.
publisher_domain Verified publisher domain of the application.
sign_in_audience Accounts allowed to sign in to the application.
_ont_client_id Yes Normalized field sourced from app_id.
_ont_name Yes Normalized field sourced from display_name.
_ont_protocol Yes Property generated by the ontology mapping.
_ont_source Module that populated this node's ontology fields.

Relationships

  • (:AzureTenant)-[:RESOURCE]->(:EntraApplication): Links a Microsoft tenant to one of its Entra applications.

  • (:EntraAppRoleAssignment)-[:ASSIGNED_TO]->(:EntraApplication): Links an app role assignment to its Entra application.

  • (:EntraApplication)-[:SERVICE_PRINCIPAL]->(:EntraServicePrincipal): Links an Entra application to its deployed service principal.

  • (:User)-[:AUTHORIZED]->(:ThirdPartyApp): generated by analysis job Ontology - User AUTHORIZED ThirdPartyApp linking.

    • Properties:

      Field Description
      scopes Property generated by analysis job: Ontology - User AUTHORIZED ThirdPartyApp linking.

EntraAppRoleAssignment

An application role assignment in Microsoft Entra ID.

Properties

Field Index Description
id Yes Entra app role assignment ID.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
app_role_id ID of the assigned application role.
application_app_id Client ID of the assigned application.
created_date_time Timestamp when the assignment was created.
principal_display_name Display name of the assigned principal.
principal_id ID of the principal receiving the role.
principal_type Type of the assigned principal.
resource_display_name Display name of the resource service principal.
resource_id ID of the resource service principal.

Relationships

  • (:AzureTenant)-[:RESOURCE]->(:EntraAppRoleAssignment): Links a Microsoft tenant to one of its app role assignments.

  • (:EntraAppRoleAssignment)-[:ASSIGNED_TO]->(:EntraApplication): Links an app role assignment to its Entra application.

  • (:EntraGroup)-[:HAS_APP_ROLE]->(:EntraAppRoleAssignment): Links an Entra group to an app role assignment it holds.

  • (:EntraUser)-[:HAS_APP_ROLE]->(:EntraAppRoleAssignment): Links an Entra user to an app role assignment they hold.

EntraGroup

A group in Microsoft Entra ID.

Ontology Mapping: This node uses the ontology label UserGroup.

Additional Labels: This node also uses EntraIdentity, EntraPrincipal.

Additional Label Definitions:

  • EntraIdentity: A microsoft node participating in the shared EntraIdentity graph interface.
  • EntraPrincipal: A Microsoft identity participating in the shared EntraPrincipal graph interface.

Properties

Ontology-generated fields are shown in italics.

Field Index Description
id Yes Entra group ID.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
created_date_time Timestamp when the group was created.
deleted_date_time Timestamp when the group was deleted.
description Description of the group.
display_name Display name of the group.
group_types Microsoft Graph group type values.
is_assignable_to_role Whether directory roles can be assigned to the group.
mail Primary email address of the group.
mail_enabled Whether the group has mail enabled.
mail_nickname Mail alias of the group.
security_enabled Whether the group has security enabled.
visibility Visibility setting of the group.
_ont_description Normalized field sourced from description.
_ont_email Yes Normalized field sourced from mail.
_ont_name Yes Normalized field sourced from display_name.
_ont_source Module that populated this node's ontology fields.

Relationships

  • (:AzureTenant)-[:RESOURCE]->(:EntraGroup): Links a Microsoft tenant to one of its Entra groups.

  • (:EntraGroup)-[:CAN_MANAGE]->(:AzureSQLServer): EntraGroup receives evaluated CAN_MANAGE access to AzureSQLServer from AZURE IAM policies.

    • Evaluated permissions: Microsoft.Sql/servers/delete

  • (:EntraGroup)-[:CAN_READ]->(:AzureSQLServer): EntraGroup receives evaluated CAN_READ access to AzureSQLServer from AZURE IAM policies.

    • Evaluated permissions: Microsoft.Sql/servers/read

  • (:EntraGroup)-[:CAN_WRITE]->(:AzureSQLServer): EntraGroup receives evaluated CAN_WRITE access to AzureSQLServer from AZURE IAM policies.

    • Evaluated permissions: Microsoft.Sql/servers/write

  • (:EntraGroup)-[:HAS_APP_ROLE]->(:EntraAppRoleAssignment): Links an Entra group to an app role assignment it holds.

  • (:EntraGroup)-[:HAS_ROLE]->(:EntraRoleAssignment): Links an Entra group to a directory role assignment it holds.

  • (:EntraGroup)-[:HAS_ROLE_ASSIGNMENT]->(:AzureRoleAssignment): A Microsoft Entra group has the Azure role assignment.

  • (:EntraGroup)-[:MEMBER_OF]->(:EntraGroup): Links nested Entra groups to their parent group.

  • (:EntraIdentity)-[:OWNER_OF]->(:EntraGroup): Links Entra identities to a group they own.

  • (:EntraUser)-[:MEMBER_OF]->(:EntraGroup): Links Entra users to a group they belong to.

  • (:IntuneCompliancePolicy)-[:ASSIGNED_TO]->(:EntraGroup): Links an Intune compliance policy to an assigned Entra group.

EntraOU

An administrative unit in Microsoft Entra ID.

Properties

Field Index Description
id Yes Entra administrative unit ID.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
deleted_date_time Timestamp when the administrative unit was deleted.
description Description of the administrative unit.
display_name Display name of the administrative unit.
is_member_management_restricted Whether member management is restricted.
membership_type Membership type of the administrative unit.
visibility Visibility setting of the administrative unit.

Relationships

  • (:AzureTenant)-[:RESOURCE]->(:EntraOU): Links a Microsoft tenant to one of its administrative units.

EntraRoleAssignment

A directory role assignment in Microsoft Entra ID.

Properties

Field Index Description
id Yes Entra role assignment ID.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
app_scope_id Application-specific scope of the assignment.
directory_scope_id Directory scope of the assignment.
principal_id Yes ID of the principal granted the role.
role_definition_id Yes ID of the assigned role definition.

Relationships

  • (:AzureTenant)-[:RESOURCE]->(:EntraRoleAssignment): Links a Microsoft tenant to one of its directory role assignments.

  • (:EntraGroup)-[:HAS_ROLE]->(:EntraRoleAssignment): Links an Entra group to a directory role assignment it holds.

  • (:EntraRoleAssignment)-[:ASSIGNED_TO]->(:EntraRoleDefinition): Links a role assignment to the directory role it grants.

  • (:EntraServicePrincipal)-[:HAS_ROLE]->(:EntraRoleAssignment): Links a service principal to a directory role assignment it holds.

  • (:EntraUser)-[:HAS_ROLE]->(:EntraRoleAssignment): Links an Entra user to a directory role assignment they hold.

EntraRoleDefinition

A directory role definition in Microsoft Entra ID.

Properties

Field Index Description
id Yes Entra role definition ID.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
description Description of the permissions granted by the role.
display_name Display name of the directory role.
is_built_in Whether this is a Microsoft built-in role.
is_enabled Whether the role definition is enabled.
template_id Template ID of the directory role.

Relationships

  • (:AzureTenant)-[:RESOURCE]->(:EntraRoleDefinition): Links a Microsoft tenant to one of its directory role definitions.

  • (:EntraRoleAssignment)-[:ASSIGNED_TO]->(:EntraRoleDefinition): Links a role assignment to the directory role it grants.

EntraServicePrincipal

A service principal in Microsoft Entra ID.

Ontology Mapping: This node uses the ontology label ServiceAccount.

Additional Labels: This node also uses EntraPrincipal.

Additional Label Definitions:

  • EntraPrincipal: A Microsoft identity participating in the shared EntraPrincipal graph interface.

Properties

Ontology-generated fields are shown in italics.

Field Index Description
id Yes Entra service principal ID.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
account_enabled Whether the service principal is enabled.
app_id Client ID of the associated application.
app_owner_organization_id Tenant ID of the application's owning organization.
aws_identity_center_instance_id AWS Identity Center instance ID derived from reply URLs.
display_name Display name of the service principal.
login_url Login URL of the service principal.
preferred_single_sign_on_mode Preferred single sign-on mode.
preferred_token_signing_key_thumbprint Thumbprint of the preferred token-signing certificate.
reply_urls Reply URLs registered for the service principal.
service_principal_type Type of service principal.
sign_in_audience Accounts allowed to sign in.
tags Tags assigned to the service principal.
token_encryption_key_id Key ID used to encrypt issued tokens.
_ont_active Yes Normalized field sourced from account_enabled.
_ont_name Yes Normalized field sourced from display_name.
_ont_source Module that populated this node's ontology fields.

Relationships

  • (:AzureFunctionApp)-[:RUNS_AS]->(:EntraServicePrincipal): An Azure Function App runs as one of its managed identities.

  • (:AzureTenant)-[:RESOURCE]->(:EntraServicePrincipal): Links a Microsoft tenant to one of its service principals.

  • (:AzureVirtualMachine)-[:RUNS_AS]->(:EntraServicePrincipal): The virtual machine runs as a managed identity's service principal.

  • (:EntraApplication)-[:SERVICE_PRINCIPAL]->(:EntraServicePrincipal): Links an Entra application to its deployed service principal.

  • (:EntraServicePrincipal)-[:CAN_MANAGE]->(:AzureSQLServer): EntraServicePrincipal receives evaluated CAN_MANAGE access to AzureSQLServer from AZURE IAM policies.

    • Evaluated permissions: Microsoft.Sql/servers/delete

  • (:EntraServicePrincipal)-[:CAN_READ]->(:AzureSQLServer): EntraServicePrincipal receives evaluated CAN_READ access to AzureSQLServer from AZURE IAM policies.

    • Evaluated permissions: Microsoft.Sql/servers/read

  • (:EntraServicePrincipal)-[:CAN_WRITE]->(:AzureSQLServer): EntraServicePrincipal receives evaluated CAN_WRITE access to AzureSQLServer from AZURE IAM policies.

    • Evaluated permissions: Microsoft.Sql/servers/write

  • (:EntraServicePrincipal)-[:FEDERATES_TO]->(:AWSIdentityCenter): Links an Entra service principal to its federated AWS Identity Center.

  • (:EntraServicePrincipal)-[:HAS_ROLE]->(:EntraRoleAssignment): Links a service principal to a directory role assignment it holds.

  • (:EntraServicePrincipal)-[:HAS_ROLE_ASSIGNMENT]->(:AzureRoleAssignment): A Microsoft Entra service principal has the Azure role assignment.

  • (:GCPBigQueryConnection)-[:CONNECTS_WITH]->(:EntraServicePrincipal)

EntraUser

A user account in Microsoft Entra ID.

Ontology Mapping: This node uses the ontology label UserAccount.

Additional Labels: This node also uses EntraIdentity, EntraPrincipal.

Additional Label Definitions:

  • EntraIdentity: A microsoft node participating in the shared EntraIdentity graph interface.
  • EntraPrincipal: A Microsoft identity participating in the shared EntraPrincipal graph interface.

Properties

Ontology-generated fields are shown in italics.

Field Index Description
id Yes Entra user ID.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
account_enabled Whether the user account is enabled.
age_group Age group classification of the user.
business_phones Business phone numbers of the user.
city City in the user's address.
company_name Company name associated with the user.
country Country or region in the user's address.
department Department of the user.
display_name Display name of the user.
email Yes Primary email address of the user.
employee_id Employee identifier of the user.
employee_type Employment type of the user.
given_name Given name of the user.
job_title Job title of the user.
manager_id Entra user ID of the user's manager.
mobile_phone Mobile phone number of the user.
office_location Office location of the user.
preferred_language Preferred language of the user.
state State or province in the user's address.
surname Surname of the user.
user_principal_name User principal name.
_ont_active Yes Normalized field sourced from account_enabled.
_ont_email Yes Normalized field sourced from email.
_ont_firstname Yes Normalized field sourced from given_name.
_ont_fullname Yes Normalized field sourced from display_name.
_ont_lastname Yes Normalized field sourced from surname.
_ont_source Module that populated this node's ontology fields.

Relationships

  • (:AzureTenant)-[:RESOURCE]->(:EntraUser): Links a Microsoft tenant to one of its Entra users.

  • (:EntraUser)-[:ASSIGNED_LICENSE]->(:M365License): Links an Entra user to a Microsoft 365 license assigned to them.

  • (:EntraUser)-[:CAN_MANAGE]->(:AzureSQLServer): EntraUser receives evaluated CAN_MANAGE access to AzureSQLServer from AZURE IAM policies.

    • Evaluated permissions: Microsoft.Sql/servers/delete

  • (:EntraUser)-[:CAN_READ]->(:AzureSQLServer): EntraUser receives evaluated CAN_READ access to AzureSQLServer from AZURE IAM policies.

    • Evaluated permissions: Microsoft.Sql/servers/read

  • (:EntraUser)-[:CAN_SIGN_ON_TO]->(:AWSSSOUser): Links an Entra user to their federated AWS Identity Center user.

  • (:EntraUser)-[:CAN_WRITE]->(:AzureSQLServer): EntraUser receives evaluated CAN_WRITE access to AzureSQLServer from AZURE IAM policies.

    • Evaluated permissions: Microsoft.Sql/servers/write

  • (:EntraUser)-[:ENROLLED_TO]->(:IntuneManagedDevice): Links an Entra user to a device they enrolled in Intune.

  • (:EntraUser)-[:HAS_APP_ROLE]->(:EntraAppRoleAssignment): Links an Entra user to an app role assignment they hold.

  • (:EntraUser)-[:HAS_ROLE]->(:EntraRoleAssignment): Links an Entra user to a directory role assignment they hold.

  • (:EntraUser)-[:HAS_ROLE_ASSIGNMENT]->(:AzureRoleAssignment): A Microsoft Entra user has the Azure role assignment.

  • (:EntraUser)-[:MEMBER_OF]->(:EntraGroup): Links Entra users to a group they belong to.

  • (:EntraUser)-[:REPORTS_TO]->(:EntraUser): Links an Entra user to their manager.

  • (:User)-[:HAS_ACCOUNT]->(:UserAccount)

IntuneCompliancePolicy

A device compliance policy configured in Microsoft Intune.

Properties

Field Index Description
id Yes Intune compliance policy ID.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
applies_to_all_devices Whether the policy applies to all managed devices.
applies_to_all_users Whether the policy applies to all licensed users.
created_date_time Timestamp when the policy was created.
description Administrator-provided policy description.
display_name Display name of the compliance policy.
last_modified_date_time Timestamp when the policy was last modified.
platform Device platform targeted by the policy.
version Version of the compliance policy.

Relationships

  • (:AzureTenant)-[:RESOURCE]->(:IntuneCompliancePolicy): Links a Microsoft tenant to one of its Intune compliance policies.

  • (:IntuneCompliancePolicy)-[:APPLIES_TO]->(:IntuneManagedDevice): generated by analysis job Intune compliance policy to device resolution.

  • (:IntuneCompliancePolicy)-[:ASSIGNED_TO]->(:EntraGroup): Links an Intune compliance policy to an assigned Entra group.

IntuneDetectedApp

An application detected on devices managed by Microsoft Intune.

Properties

Field Index Description
id Yes Intune report application key for the detected app.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
application_id Application ID reported by Intune when available.
device_count Number of devices with the application detected.
display_name Display name of the detected application.
platform Platform on which the application was detected.
publisher Publisher of the detected application.
version Detected application version.

Relationships

  • (:AzureTenant)-[:RESOURCE]->(:IntuneDetectedApp): Links a Microsoft tenant to a detected Intune application.

  • (:IntuneManagedDevice)-[:HAS_APP]->(:IntuneDetectedApp): Links an Intune managed device to an application detected on it.

IntuneManagedDevice

A device managed by Microsoft Intune.

Ontology Projection: IntuneManagedDevice contributes data to canonical Device nodes.

Properties

Field Index Description
id Yes Intune managed device ID.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
azure_ad_device_id Microsoft Entra device ID.
azure_ad_registered Whether the device is registered in Entra ID.
compliance_state Intune compliance state of the device.
device_enrollment_type Method used to enroll the device.
device_name Yes Name of the managed device.
device_registration_state Registration state of the device.
eas_activated Whether Exchange ActiveSync is activated.
eas_device_id Exchange ActiveSync device ID.
enrolled_date_time Timestamp when the device was enrolled.
ethernet_mac_address Ethernet MAC address of the device.
free_storage_space_in_bytes Available device storage in bytes.
imei International Mobile Equipment Identity of the device.
is_encrypted Whether the device storage is encrypted.
is_supervised Whether the device is supervised.
jail_broken Whether the device is jailbroken or rooted.
last_sync_date_time Timestamp of the latest Intune synchronization.
managed_device_owner_type Ownership type of the managed device.
management_agent Management channel used by the device.
manufacturer Manufacturer of the device.
meid Mobile Equipment Identifier of the device.
model Model of the device.
operating_system Operating system of the device.
os_version Operating system version of the device.
partner_reported_threat_state Threat state reported by a mobile threat defense partner.
physical_memory_in_bytes Physical memory capacity in bytes.
serial_number Yes Serial number of the device.
total_storage_space_in_bytes Total device storage capacity in bytes.
user_id Entra user ID associated with the device.
user_principal_name User principal name associated with the device.
wifi_mac_address Wi-Fi MAC address of the device.

Relationships

  • (:AzureTenant)-[:RESOURCE]->(:IntuneManagedDevice): Links a Microsoft tenant to one of its Intune managed devices.

  • (:Device)-[:OBSERVED_AS]->(:IntuneManagedDevice)

  • (:EntraUser)-[:ENROLLED_TO]->(:IntuneManagedDevice): Links an Entra user to a device they enrolled in Intune.

  • (:IntuneCompliancePolicy)-[:APPLIES_TO]->(:IntuneManagedDevice): generated by analysis job Intune compliance policy to device resolution.

  • (:IntuneManagedDevice)-[:HAS_APP]->(:IntuneDetectedApp): Links an Intune managed device to an application detected on it.

M365License

A Microsoft 365 license subscription held by a tenant.

Properties

Field Index Description
id Yes Tenant-scoped identifier for the subscribed Microsoft 365 SKU.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
applies_to Resource type to which the subscribed SKU applies.
capability_status Current capability status of the subscribed SKU.
consumed_units Number of licenses currently assigned.
prepaid_enabled Number of prepaid licenses currently enabled.
prepaid_suspended Number of prepaid licenses currently suspended.
prepaid_warning Number of prepaid licenses in warning state.
sku_id Yes Microsoft product SKU GUID.
sku_part_number Yes Microsoft product SKU part number.

Relationships

  • (:AzureTenant)-[:RESOURCE]->(:M365License): Links a Microsoft tenant to one of its Microsoft 365 licenses.

  • (:EntraUser)-[:ASSIGNED_LICENSE]->(:M365License): Links an Entra user to a Microsoft 365 license assigned to them.

  • (:M365License)-[:HAS_SERVICE_PLAN]->(:M365ServicePlan): Links a Microsoft 365 license to one of its included service plans.

M365ServicePlan

A service entitlement included in a Microsoft 365 license.

Properties

Field Index Description
id Yes Tenant-scoped Microsoft 365 service plan identifier.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
applies_to Resource type to which the service plan applies.
provisioning_status Current provisioning status of the service plan.
service_plan_id Yes Microsoft service plan GUID.
service_plan_name Yes Microsoft service plan name.

Relationships

  • (:AzureTenant)-[:RESOURCE]->(:M365ServicePlan): Links a Microsoft tenant to one of its Microsoft 365 service plans.

  • (:M365License)-[:HAS_SERVICE_PLAN]->(:M365ServicePlan): Links a Microsoft 365 license to one of its included service plans.

On this page
Microsoft SchemaAzureTenantEntraApplicationEntraAppRoleAssignmentEntraGroupEntraOUEntraRoleAssignmentEntraRoleDefinitionEntraServicePrincipalEntraUserIntuneCompliancePolicyIntuneDetectedAppIntuneManagedDeviceM365LicenseM365ServicePlan