Check tenant, permission and completeness in Graph
An account inventory can look plausible while coming from the wrong tenant, missing a needed property or stopping at the first page. Prove the context and the completeness of the query before handing the report to someone else.
Diagnostic scenario · recorded fictional outcomes · Microsoft documentation
The task
Connect-MgGraph establishes a Graph context; Get-MgContext shows it. The context has a tenant, an authentication type and permissions. A successful connection does not prove it targets your intended tenant or grants the data access your particular query needs. Browser website login and a Microsoft Graph session are separate systems.
- Verify TenantId, authentication type and granted scopes.
- Distinguish an interactive delegated session from app-only access.
- Check paging and requested properties before trusting an inventory count.
Genie tip: Verify TenantId, authentication type and granted scopes.
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
Get-MgContext | Select-Object TenantId,AuthType,Scopes- Stage 1Get-MgContext
Positional values or no named parameters - Stage 2Select-Object
Positional values or no named parameters
Build the reasoning
Inspect the context
Compare TenantId with the approved tenant ID. For delegated access, inspect the granted scopes; app-only access uses application permissions and a different identity model.
Request the intended access
This delegated example requests full user-profile read access in an explicit tenant. Administrator consent may be required. Process scope limits this context to the current PowerShell process.
Retrieve the inventory
Request the fields that the report needs and retrieve all pages when the task is an inventory. Do not treat the first returned batch as the tenant total.
Predict → Check → Explain
Choose a case, predict the next useful check and run that diagnostic choice. Outputs below are fictional recordings, not network results.
Recorded outcome
0 of 3 cases solved
Find the mistake
Confusing kinds of login
Signing into this learning website does not connect your PowerShell session to Microsoft Graph or grant tenant permissions.
Confusing identity models
This is a delegated pattern. Unattended app-only automation needs an approved application identity and application permissions; do not reuse the delegated consent story unchanged.
For each case, name the evidence that rules out the other choices. A successful earlier check narrows the next question; it does not prove the whole operation works.
Prove it: write it alone
Solve all three recorded cases before this final decision opens.
Prove it: repair the evidence gap
A report labels every user as disabled. The context and read permission are correct. The query requested only DisplayName and UserPrincipalName. Its later filter compares AccountEnabled with $false.
Take it to a real environment
Record the TenantId, query, authentication type, relevant permission and inventory count with the report. Azure subscription context and Exchange connection state need their own checks; Get-MgContext does not verify those separate sessions. This lab never signs into Microsoft Graph or queries a real tenant.