Identity Atlas v1.0.0

Identity Atlas v1.0.0

Release date: 5 August 2026

Publisher: Control Alt Delete Tech Bits

Identity Atlas 1.0.0 is the first stable release of the local, read-only Microsoft Entra relationship explorer.

Security changes

1. Comparison reports no longer embed tenant data inside an inline browser script.
2. Comparison data and application logic are separate local resources protected by a restrictive Content Security Policy.
3. Hostile tenant strings are covered by automated script-injection regression tests.
4. Connect-IdentityAtlas accepts optional dedicated ClientId and TenantId values for an isolated Microsoft Graph consent boundary.
5. Settings includes a two-step control for clearing Identity Atlas pins, review states and layout preferences from browser storage.

The main interactive report was not affected by the comparison issue. Version 0.16.0-preview.1 users should upgrade before opening newly generated comparison HTML.

Stable capabilities

1. Local collection through delegated Microsoft Graph read permissions.
2. Users, groups, nested memberships, applications, service principals, devices and authentication methods.
3. Directory roles, active and eligible role assignments, and PIM for Groups.
4. Conditional Access policies, named locations and authentication strengths.
5. Cross-tenant access, application management policies and Administrative Units.
6. Entitlement Management and Access Reviews.
7. Evidence-backed access paths with confidence and collection coverage.
8. Permission blast radius, security insights, action plans and review states.
9. Timeline, report comparison and JSON, CSV, Markdown, Mermaid, SVG and PNG exports.
10. Offline single-page report served only on the local loopback interface.

Install from PowerShell Gallery

Install-PSResource IdentityAtlas -Scope CurrentUser -TrustRepository
Import-Module IdentityAtlas

PowerShellGet users can run:

Install-Module IdentityAtlas -Scope CurrentUser
Import-Module IdentityAtlas

Run

Connect-IdentityAtlas -UseDeviceCode -ContextScope Process
Invoke-IdentityAtlas `
    -OutputPath "$env:USERPROFILE\Documents\IdentityAtlas-$(Get-Date -Format 'yyyyMMdd-HHmmss')" `
    -OpenReport

Use the Governance profile when its additional read permissions and licensed Microsoft Entra features are required.

Upgrade

Update-PSResource IdentityAtlas -Scope CurrentUser

PowerShellGet users can run:

Update-Module IdentityAtlas

Close existing PowerShell sessions before upgrading if Microsoft Graph modules are loaded.

Data handling

Identity Atlas reports contain administrative evidence and are not encrypted. Keep reports in an access-controlled folder, stop the local report server after use, disconnect Microsoft Graph and delete reports according to organisational retention requirements.

Identity Atlas v0.16.0 preview 1

Identity Atlas v0.16.0 preview 1

Release date: 5 August 2026

Publisher: Control Alt Delete Tech Bits

Identity Atlas v0.16.0 improves the normal administrator experience from collection through to reviewing the local report. PowerShell now shows continuous collection status instead of appearing idle during large tenant exports. When collection finishes, -OpenReport serves the generated live tenant report on the local loopback interface and opens it in the default browser.

Collection progress

The progress display includes:

1. The active collector and its position in the Core or Governance profile.
2. Current item and total item counts for per-object work.
3. Cumulative Microsoft Graph request and retry totals.
4. Collected object, relationship and evidence totals.
5. Elapsed collection time.

Microsoft Graph throttling and temporary service errors produce a visible warning with the HTTP condition, retry delay and attempt number.

Bounded Graph batches

Authentication method requests are grouped into bounded Microsoft Graph JSON batches instead of issuing one blocking request after another for every user. Application role assignments and owner lookups use the same approach. The default batch size is ten and administrators can select a value from 1 to 20 with -BatchSize.

Every resource subrequest remains GET. The module permits POST only to the Microsoft Graph v1.0 batch transport and validates every contained URI before sending it.

Reduced collection options

-SkipSlowCollectors omits the slower per-object group, device, authentication method and application relationship calls. Granular selection is available through -SkipCollector with these values:

1. GroupMembersAndOwners
2. DeviceOwners
3. AuthenticationMethods
4. ApplicationRoleAssignments
5. ApplicationOwners

Skipped work is never presented as complete. The generated report records partial coverage, a readable warning and collector metrics identifying each omission.

Cancellation and report opening

Ctrl+C stops the active collection and prints a summary with elapsed time, completed stages and collected totals. An incomplete report package is not written.

After a successful collection, -OpenReport starts the packaged loopback server on 127.0.0.1. Port 8766 is used by default. If it is occupied, Identity Atlas checks the next permitted ports and returns the selected URL and server process ID in the command result.

Example

Import-Module IdentityAtlas
Connect-IdentityAtlas -UseDeviceCode -ContextScope Process
$result = Invoke-IdentityAtlas `
    -OutputPath "$env:USERPROFILE\Documents\IdentityAtlasReport" `
    -OpenReport

$result | Select-Object OutputPath, ReportUrl, ServerProcessId, Duration, RequestCount, RetryCount

For a deliberately reduced collection:

Invoke-IdentityAtlas `
    -OutputPath "$env:USERPROFILE\Documents\IdentityAtlasReport" `
    -OpenReport `
    -SkipSlowCollectors

Validation status

1. PowerShell tests: 64 passed.
2. JavaScript graph worker tests: 14 passed.
3. PowerShell Script Analyzer: no findings.
4. Tenant-data, credential and secret scans: no findings.
5. Public release security checks: 13 passed.
6. PowerShell Gallery package checks: 16 passed, including isolated discovery, save and clean import.
7. Browser interaction checks against existing live development tenant data: passed with no console errors.
8. The JSON batch transport passed automated mocked Graph tests but did not receive a fresh live Core collection during this release cycle. It remains preview functionality requiring community field testing.

Identity Atlas v0.15.1 preview 1

Identity Atlas v0.15.1 preview 1

Release status: PowerShell Gallery release candidate

Summary

Identity Atlas v0.15.1 prepares the existing Microsoft Entra relationship explorer for its first PowerShell Gallery publication. The application features and delegated Microsoft Graph permission boundary remain unchanged from v0.15.0.

Installation improvements

1. Microsoft.Graph.Authentication 2.38.1 or later is now a declared module dependency.
2. PowerShell Gallery installations can acquire the Graph authentication dependency automatically.
3. The module declares PowerShell Core compatibility and PowerShell 7 as its minimum version.
4. Gallery metadata includes the approved Identity Atlas branding, project link, MIT Licence link, tags and release notes.

After Gallery publication, install the preview with:

Install-PSResource IdentityAtlas -Prerelease -Scope CurrentUser -TrustRepository
Import-Module IdentityAtlas

Package integrity

1. The Gallery package is built from the matching checksummed GitHub release archive.
2. The NuGet package receives its own SHA256 checksum.
3. The package gate checks metadata, dependencies, archive contents, tenant-data and secret patterns, module validity and clean import.
4. The package contains no tenant report, automated-test fixture, release output, Git metadata or publisher credential.

Permission boundary

Identity Atlas continues to request delegated, read-only Microsoft Graph permissions. The Core profile remains the default. Governance collection remains explicit and optional. No Microsoft Graph write permission has been added.

Publication status

This candidate has not yet been published to the PowerShell Gallery. Publication requires a Control Alt Delete Tech Bits publisher account and a privately handled Gallery API key.

Identity Atlas v0.15.0 preview 1

Identity Atlas v0.15.0 preview 1

Release status: community preview

Identity Atlas v0.15.0 extends the local relationship model into Microsoft Entra external access and Identity Governance. Core collection remains the default. The new Governance profile is opt-in and requests five additional delegated, read-only Microsoft Graph permissions.

New collection features

1. Nested group membership is represented as a first-class relationship and can be followed through evidence-backed access paths.
2. Cross-tenant access includes the tenant default, partner configurations and cross-tenant synchronisation state.
3. Application management policies include the tenant default, targeted policies and the applications or service principals governed by them.
4. Administrative Units include members, scoped directory role assignments and direct administrator relationships.
5. PIM for Groups includes active and eligible membership or ownership schedule instances.
6. Entitlement Management includes catalogues, access packages, assignment policies, assignments and governed resource roles.
7. Access Reviews include definitions, reviewer scopes, instances, decisions and reviewed resources.

Report changes

1. Added External access and Governance views.
2. Added filters, labels, icons and evidence panels for each new object and relationship type.
3. Extended access explanations for nested groups, PIM group assignments, access packages, Administrative Units and Access Reviews.
4. Increased evidence-backed path traversal to eight relationships with loop protection.
5. Added collection-profile and governance-capability information to the report manifest.

Collection profiles

The default Core profile keeps the existing permission set:

Connect-IdentityAtlas -UseDeviceCode -CollectionProfile Core -ContextScope CurrentUser
Invoke-IdentityAtlas -CollectionProfile Core -OutputPath .\Output\Tenant

The Governance profile adds these delegated read permissions:

AdministrativeUnit.Read.All
PrivilegedAssignmentSchedule.Read.AzureADGroup
PrivilegedEligibilitySchedule.Read.AzureADGroup
EntitlementManagement.Read.All
AccessReview.Read.All

Use the profile explicitly for both connection and collection:

Connect-IdentityAtlas -UseDeviceCode -CollectionProfile Governance -ContextScope CurrentUser
Invoke-IdentityAtlas -CollectionProfile Governance -OutputPath .\Output\Tenant

Identity Atlas does not request any Microsoft Graph write permission. The signed-in account must still hold a Microsoft Entra role accepted by each endpoint. Some Identity Governance data also requires the relevant tenant licence and configured resources. An unavailable endpoint is recorded as partial coverage rather than silently represented as complete.

Validation evidence

The focused implementation suite covers every new collector and permission boundary:

PowerShell tests: 56 passed, 0 failed
JavaScript tests: 14 passed, 0 failed
PSScriptAnalyzer errors and warnings: 0
Source safety gate: passed
Public release security gate: passed
Browser navigation and filtering against a real-tenant Core report: passed
Browser console errors and warnings: 0

The published archive checksum is supplied separately in IdentityAtlas-v0.15.0-preview.1-SHA256.txt. Verify the downloaded ZIP against that file before extracting it.

Live collection against a tenant containing representative Administrative Units, PIM groups, access packages and Access Reviews remains a post-release validation priority. A tenant without those configured resources can prove endpoint access and empty-result handling, but it cannot prove rendering of data that does not exist.

Known limits

1. PIM for Groups requires two filtered Microsoft Graph requests for each collected group. Large-tenant throughput needs further live measurement.
2. Identity Governance endpoints may return no objects when the tenant has no matching configuration.
3. A granted delegated scope does not replace the Microsoft Entra role required by an endpoint.
4. The report contains administrative evidence and must be stored and shared as sensitive tenant data.
5. This is preview software. Wider tenant configurations may expose cases that were not present during development testing.

Identity Atlas v0.14.0-preview.1

Identity Atlas v0.14.0-preview.1

Identity Atlas is a local, read-only visual explorer for Microsoft Entra objects, relationships and access paths. This is the first community preview from Control Alt Delete Tech Bits.

Identity Atlas is an independent community project. It is not a Microsoft product and is not affiliated with, endorsed by or sponsored by Microsoft.

Highlights

1. Collects users, groups, applications, service principals, directory roles, eligible role assignments, devices, authentication methods and Conditional Access resources through delegated Microsoft Graph read permissions.
2. Generates an offline single-page report with local search, filtering, relationship expansion and graph navigation.
3. Explains why a user or application has access using evidence-backed paths and coverage confidence.
4. Exports graph evidence as Mermaid, SVG, PNG and Markdown.
5. Adds severity, action plans, review states, remediation PowerShell snippets and per-finding evidence export.
6. Includes permission blast-radius, Conditional Access impact, stale-device and authentication-method hygiene views.
7. Supports report comparison, a change timeline, relationship grouping, breadcrumbs and tenant-specific pinned objects.

Security boundaries

1. Default Microsoft Graph permissions are delegated and read only.
2. The collector sends GET requests to allow-listed Microsoft Graph hosts and API versions.
3. Authentication material is removed from recorded collector errors.
4. The browser report uses a restrictive Content Security Policy and makes no browser network requests.
5. The local server binds to 127.0.0.1, refuses test fixture reports and rejects unsupported HTTP methods.
6. Generated reports and release archives are excluded from source control.

Reports contain sensitive administrative evidence. Store them in an access-controlled location, do not publish them and stop the local server after use.

Install

1. Download IdentityAtlas-v0.14.0-preview.1.zip.
2. Download IdentityAtlas-v0.14.0-preview.1-SHA256.txt.
3. Verify the ZIP checksum.
4. Extract the ZIP into an access-controlled folder.
5. Import IdentityAtlas.psd1 from PowerShell 7 or later.

$expected = (Get-Content .\IdentityAtlas-v0.14.0-preview.1-SHA256.txt).Split(' ')[0]
$actual = (Get-FileHash .\IdentityAtlas-v0.14.0-preview.1.zip -Algorithm SHA256).Hash
if ($actual -ne $expected) {
    throw 'The downloaded Identity Atlas archive does not match its published checksum.'
}

The verified release candidate SHA256 is:

E062075D5169AEF9E7566DADFE82A1C94058D79BA33C398B8C06CC8AB180CE20

Known limitations

1. Coverage is partial when Microsoft Graph permissions or the signed-in user’s Microsoft Entra role does not allow a resource to be read.
2. Directory-role access paths do not traverse nested group membership.
3. Conditional Access impact is based on collected evidence and does not replace Microsoft policy evaluation.
4. Reports contain tenant identifiers, user principal names, role assignments and other administrative evidence.
5. This preview has been tested in a development tenant, but wider tenant configurations may expose cases not present in that test.

Feedback and security reports

Use GitHub Issues for reproducible bugs and feature requests after the repository is public.

Report suspected vulnerabilities privately by following SECURITY.md.

Support: Mark@controlaltdeletetechbits.co.uk

Donate: https://buymeacoffee.com/cadtb