EXTENSIONS

Broad Microsoft Graph extension — nine model types over one shared app-only client: calendar (room/user calendarView, current/next meeting), places (room resources), users (Entra directory reads, manager, memberOf), groups, mail (Outlook messages), teams (chats/teams/channels/messages), presence, sharepoint (document-library navigation, search, and file download, working under either Sites.Read.All or Sites.Selected), and intune (enrolled devices, compliance policies, configuration profiles and settings catalog, remediation scripts, confirmation-gated device actions, and async report exports). Token caching, automatic paging, and a raw-bytes downloader; app credentials supplied from a vault. Supersedes the narrow ms-graph-calendar and absorbs azure-ad-user's lookup.

Microsoft Purview compliance-portal RBAC — role groups, their constituent management roles, membership, and the eDiscovery Administrator list, over Security & Compliance PowerShell. Exists because eDiscovery permission is invisible from Entra: Global Administrator maps to OrganizationManagement, which carries Case Management, Compliance Search, Hold and Search And Purge but not Export, Preview, Review, RMS Decrypt or Custodian, so a tenant admin can run a search yet be unable to export a single item. auditPrincipals separates canSearch from canExport and flags eDiscovery Administrators, who can open every case in the tenant. Carries its own credential surface because the compliance endpoint rejects Azure CLI tokens regardless of user.