Drag an entity onto the canvas
Everything connected to it comes too. An app registration brings its service principal, what that was actually granted, and who can sign in to it.
Each one you take out of the palette starts a fresh canvas. Hold shift to keep what is already there and compare two.
double-click a node to expand it · right-click for more · / to search
Entity: shape
App registration
Registered in another tenant
Enterprise app
Managed identity
Permission
Directory role
User
Group
CA policy
Named location
CA policy: fill
Enabled
Report-only, enforces nothing
Disabled
Applies to all users or apps, so it draws no lines to them
Risk: fill
Critical
High
Medium
Low
Ring: worst single permission, when it differs
Connections
App registration → its service principal
Holds this permission (consented)
Declared in the manifest, never consented
Declared and consented (the solid line above says it)
Can sign in to / consented to the app
Member of a group
Holds a directory role
In scope of a CA policy
Excluded from a CA policy
Markers
Connected entities not on the canvas yet
Sign-in disabled, but grants still stand
Selected