Microsoft Graph Is a Maze. GraphLens Gives You the Map
If you work with Microsoft Graph, this will sound familiar. You give an app a permission, grant admin consent and move on. Months later, things have shifted without anyone telling you: the endpoint now also accepts a smaller permission, the one you granted is now rated as more powerful, or the beta endpoint you used is simply gone. You usually find out the hard way, when something breaks or a security review asks why your app has so much access. And that hurts, because you always want to give an app the least privileged permission it needs, and nothing more. You can only do that if you know what your options are, and when they change.
I’m not the first one to tackle this. The community has built some great tools to look up Graph permissions, and I’ve used plenty of them. But I often still had to go somewhere else to get the full picture: how a permission, its endpoints and the admin roles connect, for both v1.0 and beta, and above all what changed - not just what is true today. I wanted all of that in one place. So I built GraphLens, live at graphlens.rksolutions.nl.
Table of Contents
Why Graph is so hard to keep track of
To answer one simple question, “which permission do I need for this call?”, you have to puzzle together several sources. The API itself, the permissions it accepts and the admin roles that go with them are each documented somewhere else, and each of them changes on its own schedule, some of them almost every night. What none of them gives you is the story of what changed: that an endpoint now also accepts a narrower permission, or that a permission you granted months ago is now rated as more powerful. You only see today’s version, never the difference.
And it is about to get harder. In September Microsoft announced changes to Microsoft Learn’s public documentation repositories: most public documentation repositories on GitHub will be retired by the end of December 2026. A retired repository is no longer publicly visible, and with it go the history, pull requests and issues. That history was exactly where you could still see what changed in the docs and when. Once it is gone, the published page is all that is left, and that page only ever shows you today. That is exactly why GraphLens keeps its own change history: every night it records what Microsoft publishes, so the before and after stay visible even when the history behind the docs does not.
What is GraphLens?
GraphLens is a free website that checks Microsoft Graph every night and turns it into one searchable catalog. Every object has a Current definition and a Changes history, so you see not only what something looks like today, but also what it looked like before. It has four tabs:
- Enterprise permissions: every Graph permission with its Application and Delegated definition, whether it needs admin consent, the endpoints that accept it, and the Entra roles Microsoft names for it.
- Entra roles: all built-in Entra roles, which ones Microsoft marks as privileged, and the Graph permissions each role is named for.
- Intune roles: all built-in Intune roles and the actions they may perform.
- Endpoints: every v1.0 and beta endpoint as a tree, with the accepted and least privileged permissions per method and the response you get back.
On every tab you also get:
- Change history: a timeline of what changed on each object, with a before and after.
- Changed in the last N days: type
7and the tab shows only what changed in the last week, with a New, Updated or Removed badge.
A good example of why the change history matters. Microsoft gives every Graph permission a privilege level: its own rating of how powerful a permission is. The scale runs from 1 for light, low-impact access to 4 for the heavy hitters, the same level as Application.ReadWrite.All and AppRoleAssignment.ReadWrite.All, permissions that can effectively hand an app admin rights. On 22 October, the delegated EntitlementManagement.ReadWrite.All went from 3 to 4. Same name, same description, same consent requirement: only Microsoft’s own risk rating went up. If an app of yours holds it, that is worth a second look, and if you only read the docs, you would never have noticed.
Requirements
The best part? Nothing at all. No install, no sign-in, no app registration and no permissions to grant. Open graphlens.rksolutions.nl in your browser and you’re in. The site never touches your tenant: it only shows public Microsoft metadata.
The MCP server
Rather ask than click? GraphLens also comes as an MCP server, graphlens-mcp, so your AI assistant can answer from the same data. It runs on your own machine, needs no key or account, and works with Claude, Copilot, Codex, Gemini, Cursor and most other AI tools. Click MCP in the header of the site, or open graphlens.rksolutions.nl/#/mcp, for the setup of your tool.
Then just ask, for example:
- Which permissions does
GET /v1.0/usersaccept, and which one is least privileged? - Which Entra roles are named for
User.Read.All? - What changed in Microsoft Graph in the last 3 days?
Conclusion
With this post I wanted to show what GraphLens is for: taking the hard part of Microsoft Graph and making it simple. Permissions, endpoints and admin roles used to be a maze of corridors spread over different sources, each changing on its own and none of them telling you what moved. GraphLens gives you the map. You see what an app really needs before you grant consent, which roles go with a permission, and what changed last night, all in one place.
Have a look at graphlens.rksolutions.nl and let me know what you think.
Related
- Entra ID Admin Roles Report - GraphLens shows what each Entra role can do; this report shows who in your tenant actually holds them.
- Thought Global Reader Could Read Everything? Intune Says 401 - an Entra role is not a Graph permission, and this is how far apart the two can be.
- RKSolutions PowerShell Module - Graph reports for Intune and Entra that connect with a fixed set of Graph scopes; look each one up in GraphLens to see what it unlocks before you grant consent.