Cannot fetch transitive information about groups so group size and presnce of guest users will not be correct. Please investigate #40
Description
We are encountering an issue with the “CLEANUP - Admin | Sync Template v3 (Orphaned Users)” flow, which is part of the managed “Center of Excellence - Core Components” solution.
The flow uses a service account to run, and we’ve noticed that it cannot fetch transitive group membership information. As a result:
Group size calculations are inaccurate.
Presence of guest users in nested groups is not detected correctly.
This impacts the reliability of cleanup and reporting tasks.
We understand that to access transitive group data via Microsoft Graph, permissions like Group.Read.All are required. However:
Service accounts cannot be assigned the Group Reader role directly.
Using a service principal would require editing the flow, which introduces an unmanaged layer.
Every time the COE solution is updated, this unmanaged customization would need to be reapplied, which is not ideal for maintainability.
Request:
Could the Power CAT team please investigate this limitation and suggest a supported approach to enable transitive group access in a fully managed COE environment using a service account?
Is there a recommended workaround or enhancement planned to support this scenario?
Thank you!