Built for Microsoft Entra ID
VisualizerEngine turns your Entra ID groups, nesting, and licence assignments into a live, interactive map, so you can find the circular references, inherited licences, and policy drift that the Azure portal never shows you.
The problem
Every Entra ID tenant grows the same way: groups get nested inside groups, licences get assigned to groups, people inherit access through chains nobody remembers building. The Azure portal shows you flat lists. It cannot answer the questions that actually matter.
Licence inheritance flows through nested group membership. When assignments overlap, when service plans conflict, or when a group three levels up grants a licence, the portal shows you the result but never the path.
There is no undo in a directory. Moving a group or changing a group licence cascades through every nested member, and you find out who lost access when the tickets arrive.
Circular nesting, abandoned groups, and runaway depth accumulate silently. Nothing in the native tooling flags them.
Directories drift. Without point-in-time snapshots, you cannot prove what changed, when, or whether you are still compliant with your own rules.
Duplicate assignments, disabled service plans, and unused seats hide in the same invisible structure.
IT teams answer these questions today with PowerShell scripts, exported CSVs, and institutional memory. VisualizerEngine answers them with a picture.
The solution
VisualizerEngine mirrors your directory through read-only Microsoft Graph permissions, then makes its structure visible, testable, and provable.
Explore nesting, memberships, and licence flows as an interactive hierarchy, graph, or sunburst, instead of flat lists.
Simulate group moves and licence changes inside VisualizerEngine, and see the full blast radius before the directory is touched.
Capture snapshots, diff any two points in time, score policy compliance, and export reports that carry provenance metadata.
Features
Nine capabilities, one live mirror of your directory. Explore all features in depth.
Hierarchy tree, force-directed graph, and sunburst over the same live directory.
Learn moreCircular reference detection, depth analysis against your thresholds, orphan and overlap detection.
Learn moreInheritance paths, cost by SKU and group, conflicts, duplicates, and removal impact.
Learn moreModel group moves and licence changes before touching the directory.
Learn moreEncode governance rules, score violations, and watch compliance drift over time.
Learn morePoint-in-time captures of the directory, diffable to prove exactly what changed.
Learn moreAn advanced query language over groups, users, and memberships, with saved searches.
Learn moreCSV, JSON, branded PDF, and PNG or SVG exports carrying provenance metadata.
Learn moreA notification centre with configurable alerts and a change-history panel.
Learn moreSecurity
Attackers already see your directory as a graph. It is time you did too. Every control listed on this site exists in the platform today, and controls we do not provide are not claimed anywhere.
Every row is bound to a tenant, and Postgres row-level security is FORCE-enabled. Isolation is proven by test.
Every administrative and read action lands in an HMAC-chained, append-only audit log with chain verification.
Read-only Graph permissions, split database roles, and file-mounted secrets, never in code.
How it works
A global admin grants read-only consent via a standard Entra admin-consent link. No agents, nothing installed.
VisualizerEngine crawls the directory once, then stays current with Microsoft Graph delta queries.
The full nesting map, licence flows, violations, and trends are live in your browser.
VisualizerEngine is pre-launch. Onboarding is a read-only admin-consent link: no agents, nothing installed, nothing modified.