Make Access Grants Legible Before You Approve

Tier: Core · Workflow area: Identity, endpoint & patch · ~30 minutes

This playbook builds a repeatable "what does this grant actually grant?" pattern: export the group and role graph around a requested entitlement, have AI flatten it into effective access, and attach that summary to the approval — so the approver reads consequences, not group names. (UC-31)

When to use

• Any request touching a group with childrennested security groups, groups assigned to enterprise apps, groups that confer Entra or Azure roles. The name never tells you.
• Privileged or finance/HR-adjacent accesswhere the cost of a wrong approve is audit findings, not just clutter.
• Approvers outside ITmanagers approve most access; giving them a legible impact statement is the only realistic way their approval means anything.

When NOT to use

• Flat, well-named, single-purpose groupsif SG-Printer-3F grants exactly one printer, adding an AI summary is ceremony.
• Emergency break-glass accessthat flow is pre-approved, time-boxed and logged by design; do not insert an analysis step into it.
• As a substitute for cleaning up the group sprawlif every summary comes back "this grants 40 things via 6 nested levels", the fix is redesign, not better explanations of the mess.

The recipe

1. 1.

   Export the entitlement graph around the requested group. For Entra, pull the group, its transitive members-of and its assignments:

   Copy

   Connect-MgGraph -Scopes "Group.Read.All","Application.Read.All","RoleManagement.Read.Directory"
   $g = Get-MgGroup -Filter "displayName eq 'SG-Finance-Apps'"
   # What this group is itself a member of (transitive = nesting resolved)
   Get-MgGroupTransitiveMemberOf -GroupId $g.Id |
     Select-Object -ExpandProperty AdditionalProperties |
     ForEach-Object { $_['displayName'] }
   # Which enterprise apps the group is assigned to
   Get-MgGroupAppRoleAssignment -GroupId $g.Id |
     Select-Object ResourceDisplayName, AppRoleId
   # Any directory roles assigned to the group
   Get-MgRoleManagementDirectoryRoleAssignment -All |
     Where-Object PrincipalId -eq $g.Id
   

   For on-prem AD, Get-ADPrincipalGroupMembership recursively, plus wherever the group appears in ACLs you care about (file shares, GPO security filtering).

2. 2.

   Have AI flatten it into an impact statement. Paste the exports:

   Copy

   A user has requested membership in SG-Finance-Apps. Below are exports:
   (a) groups this group is transitively a member of, (b) enterprise app
   assignments, (c) directory role assignments. Produce an approval
   impact statement:
   
   1. EFFECTIVE ACCESS: a flat bullet list of everything membership
      grants, one line each, plainest possible English
      ("Read/write access to the NetSuite production instance")
   2. INHERITANCE CHAIN: for each item, the path that grants it
      (SG-Finance-Apps -> SG-ERP-Users -> NetSuite app assignment)
   3. RISK FLAGS: anything privileged, anything granting admin roles,
      anything whose purpose you cannot determine from the data
   4. QUESTIONS: what you'd need to know that this export doesn't show
   
   Do not speculate about access not present in the data. If a group
   name implies access but no assignment appears, list it under
   QUESTIONS, not under EFFECTIVE ACCESS.
   

3. 3.

   Expect and use the QUESTIONS section. Sample output worth acting on:

   Copy

   RISK FLAGS
   - SG-Finance-Apps is transitively a member of SG-AllStaff-Legacy,
     which is assigned to 14 enterprise apps — membership grants all 14
   - App role for "Concur-Prod" is a GUID with no friendly name; verify
     whether this is the Approver or User role before approving
   
   QUESTIONS
   - SG-ERP-Admins appears as a member OF SG-Finance-Apps (not the
     reverse) — confirm no ACLs grant this group rights over admins
   

   The GUID app-role flag is typical: resolve it in the app's manifest (Get-MgServicePrincipal and match AppRoles) rather than letting anyone guess.

4. 4.

   Attach the statement to the approval itself. Paste the impact statement into the ITSM approval task or access-package description — not a side channel. The approver's record should show what they were told at the moment they clicked approve.

5. 5.

   Use Security Copilot in Entra where you have it. In the Entra admin center, Copilot can summarize a user's access, group details and risky sign-ins conversationally — use it as the quick first pass ("summarize what membership in this group grants"), and keep the export-plus-prompt pattern for anything it cannot see (on-prem ACLs, third-party apps) or anything you need as an attachable artifact.

6. 6.

   Feed findings back into hygiene. Every "QUESTIONS" item that turns out to be dead nesting or an orphaned app assignment goes on the cleanup backlog. The summaries get shorter as the graph gets cleaner — that shrinkage is your progress metric.

Make it yours

• Entra + access packages shopgenerate the impact statement once per access package and store it in the package description; re-generate on any change to the package's resource roles, and let per-request approvals inherit it.
• Hybrid AD shopthe nesting that bites is usually on-prem; export with Get-ADGroupMember -Recursive and include file-share ACL dumps (Get-Acl on the key shares) in the same prompt so the statement covers shares, not just apps.
• Google Workspace / Okta shopsame pattern: export group-to-app assignments from the Okta API or Workspace admin SDK; the prompt structure is identical, only the export changes.

Quality check

• The statement lists only what the export proves. Spot-check one inheritance chain per statement by walking it manually in the console; a fabricated chain means the prompt or export is broken — stop and fix before the pattern earns false trust.
• GUIDs never survive to the approver. Every app role and template ID gets resolved to a name, by you if not by the export.
• Approvals without a statement are the exception, logged as such for the group classes you scoped in.
• Time-box the workflowif producing a statement takes over ten minutes, pre-generate for your top 20 most-requested groups and cache them with a review date.