🔐 Azure Permissions Viewer & Cleanup Tool

1. Go to Azure Portal → Azure Active Directory → App registrations
2. Click "New registration"
3. Name: "Azure Permissions Viewer" (or any name)
4. Supported account types: "Accounts in this organizational directory only"
5. Redirect URI: Select "Single-page application (SPA)" and enter the URL where you're hosting this file (or file:/// if running locally)
6. Click "Register"
7. Copy the "Application (client) ID" - this is your Client ID
8. Copy the "Directory (tenant) ID" - this is your Tenant ID
9. API Permissions (Optional): You can skip this step to use user-delegated permissions only. Or, to pre-approve permissions:
   • Go to "API permissions" → "Add a permission"
   • Add Microsoft Graph delegated permissions: Directory.Read.All, User.Read.All, RoleManagement.Read.Directory
   • Add Azure Service Management delegated permission: user_impersonation
   • Click "Grant admin consent" (requires admin privileges)

Note: Without admin consent, each user will consent for themselves and can only access data they already have permissions to view.

You need to register your own Azure AD application to use this tool. Click "Configure App" above for instructions.

• Option A (Recommended): Use your own user permissions - no admin consent needed
• Option B: Pre-approve permissions for all users (requires admin consent)

Your user account needs:

• Entra ID: Global Reader, Directory Readers, or Privileged Role Administrator role
• Azure RBAC: Reader role at subscription level