Table of Contents
Preview of Entra ID Group Insights Don’t Deliver Anything Particularly Insightful
Entra ID Group Insights are a new preview feature that turned up in the Entra admin center in early February 2026 without benefit of a formal announcement or documentation. Divided into owner, member, lifecycle, and security and compliance, the insights (Figure 1) appear to be an attempt to bring easily addressable issues to the attention of tenant administrators.
Depending on the tenant configuration, some tenants will not apply. For example, if a tenant doesn’t use container management sensitivity labels to manage Microsoft 365 groups, the insight about the number of groups without labels is useless. Tenants without Entra P1 licenses can’t use dynamic Microsoft 365 groups or dynamic security groups, so the insights covering this topic won’t apply, and so on.
The insights are all very worthy, but there’s no magic here. Everything reported can be easily found with a few lines of PowerShell. Of course, the value is that administrators don’t have to master PowerShell to find the information, but the point is still valid that the current set of insights deliver no massive breakthrough in understanding about the overall health of groups within a tenant.
Identifiers Get in the Way of Understanding
In fact, the value of the insights is somewhat diminished by the output of group identifiers (GUIDs – Figure 2) instead of group names. I don’t know of many tenant administrators who speak fluent GUID. Computers do, but humans prefer names. I’m sure Microsoft will fix this issue before Entra ID Group Insights reach general availability.
Fetching Group Insights
Obviously, Microsoft doesn’t run PowerShell against every Entra tenant to create the data that underlines the insights revealed in the admin center. However, background processes do populate a data source for the insights, much like the Graph reports API generates data to report the usage of Microsoft 365 workloads. The preview seems to compute insights daily.
Like the Graph reports API, you can fetch the Entra ID Groups Insights with a GET call to the identityAnalytics Graph endpoint (the exact URI is easily found by observing browser traffic). The data is returned in an array, with an entry for each group found in the tenant. The calculatedDateTime property notes when the background process generated the insight data. The information for groups created, restored, or soft-deleted after a processing run won’t be accurate, but this shouldn’t affect the overall value of the insights.
$Uri = "https://graph.microsoft.com/beta/reports/identityAnalytics/groups" [array]$Data = Invoke-MgGraphRequest -Uri $Uri -Method Get -OutputType PsObject | Select-Object -ExpandProperty Value $Data[0] tenantId : a662313f-14fc-43a2-9a7a-d2e27f4f3478 id : 6ce28036-7129-4742-b59b-a73c310cbb6c calculatedDateTime : 28/03/2026 00:00:00 softDeletionDateTime : 01/01/0001 00:00:00 createdDateTime : 11/03/2019 11:20:10 dynamicMembershipType : groupExpirationDateTime : 01/01/0001 00:00:00 membershipRuleProcessingState : preferredDataLocation : lastRestorationDateTime : 01/01/0001 00:00:00 membershipRuleExpressionCount : 0 membershipRuleContainsCount : 0 membershipRuleMatchCount : 0 membershipRuleMemberOfCount : 0 assignedRoleCount : 0 sensitivityLabelCount : 1 guestOwnerCount : 0 memberOwnerCount : 1 servicePrincipalOwnerCount : 0 guestTransitiveUserCount : 0 memberTransitiveUserCount : 4 transitiveUserCount : 4 transitiveServicePrincipalCount : 0 directGroupMemberCount : 0 isValidGroup : True groupType : isCloudGroup isCloudM365Group : True isCloudDistributionListGroup : False isDynamicGroup : False isCloudSecurityGroup : False isOnPremiseSecurityGroup : False isOnPremiseMailEnabledSecurityGroup : False isCloudMailEnabledSecurityGroup : False isOnPremiseDistributionListGroup : False
Generating Tenant-Specific Group Insights
Being able to fetch the data makes it possible to interpret how the Entra ID admin center derives and presents the insights for a tenant. It also makes it possible to create a custom version of the Group Insights and add value like resolving the group identifier to find group names, finding who owns the groups, noting the group with most guest members, and so on.
As an example, I wrote a script to fetch information about the groups in a tenant and combine that data with the groups insights to generate a more complete view. It’s the same technique that’s used to supplement workload usage data with account information. Figure 3 shows the summary information generated at the end of the HTML version of the report (the script also creates an XLS or CSV file).
You can download the script to report Entra ID Group Insights from the Office 365 for IT Pros repository. The code is straightforward PowerShell, so feel free to change it to meet your tenant’s needs.
Improved Insights Must be Coming
I’m sure that Microsoft will improve the quality and quantity of the Entra ID Group Insights before the feature becomes generally available. Treat the preview as a sign of how Microsoft wants to deliver useful information to tenant administrators and be patient. Or build your own insights, which isn’t all that difficult to do.
Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365. Only humans contribute to our work!