🔐 Recipe · Entra ID & Identity

Identify What an Unknown Entra ID GUID Refers To

Resolve a mystery GUID to a user, group, app, service principal, role, license, or other directory object — then count assignments

Complexity

Intermediate

Impact

troubleshooting + audit + identity + access-review

Context

Why This Matters

Administrators routinely encounter bare GUIDs in audit logs, sign-in logs, conditional access reports, Intune exports, PowerShell output, and support tickets with no indication of what type of object they refer to. A GUID like 7a896ff9-8734-4cc8-b7d0-cb2c312c96b1 could be any of the following:

A user object ID
A group object ID
An application (App registration) object ID or App ID
A service principal object ID or App ID
A directory role definition or template ID
A license SKU ID
An administrative unit ID
A conditional access policy ID
A managed device (Intune) ID
A tenant ID

This recipe provides a deterministic probe sequence that tests the GUID against each object type in Microsoft Graph until one responds with a match, and then — if the match is an application or group — counts the users effectively assigned.

Expected Outcomes

After completing this recipe you will have:

Positively identified the object type associated with the unknown GUID
The human-readable display name and description of the object
(If applicable) A deduplicated count of users assigned to the object, including users inherited via nested group membership
A repeatable script you can run whenever a mystery GUID appears

Risks & Considerations

Things to watch for

App ID vs Object ID collision. An application has two GUIDs: its object id (id) and its app id (appId). The same app's service principal has its own object id but shares the appId. Probe both.
SKU filter quirk. subscribedSkus does not support $filter. You must list all SKUs and match client-side.
403 vs 404. A 403 means the token is missing the scope for that resource type (e.g. Policy.Read.All for conditional access), not that the object doesn't exist. Treat 403 as "inconclusive" and continue probing.
Group assignments inflate user counts. When counting users assigned to an enterprise app, expand each assigned group to its members and deduplicate — users often appear in multiple assigned groups.
Nested groups. /members returns direct members only. Use /transitiveMembers if nested group membership is in use.
Do not log the GUID externally until you know what it is — it may reference a privileged role or sensitive service principal.

Required Permissions

Permission	Why It's Needed
Directory.Read.All	Read users, groups, applications, service principals, administrative units, and directory roles
Application.Read.All	Read applications and service principals and their app role assignments
Organization.Read.All	Read subscribedSkus to identify license SKU IDs
DeviceManagementManagedDevices.Read.All	Read Intune managed devices if the GUID may refer to a device
Policy.Read.All	Read conditional access policies if the GUID may refer to a CA policy
RoleManagement.Read.Directory	Read directory role definitions and assignments

The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.

For IT Admins

Paste into Dex Pro

Identify what the Entra ID GUID {guid} refers to (user, group, app, service principal, role, SKU, AU, CA policy, or device). Once identified, if it is an application or group, count the total unique users effectively assigned — expanding any assigned groups transitively and deduplicating. Return the object type, display name, and user count.

Try in Dex Pro

Identify an unknown GUID via the Entra admin portal

The Entra admin center does not have a single search box that accepts a bare object ID across every object type, so you'll need to probe each area. Work through the list below in order — most unknown GUIDs resolve in the first three checks.

1. Try the global search

Sign in to https://entra.microsoft.com as a Global Reader or better.
Paste the GUID into the top search bar. Entra will match user, group, application, and service principal object IDs here. If a result appears, click it and you're done.

2. Check Users

Entra admin center → Identity → Users → All users

Paste the GUID into the search field. If it resolves, the GUID is a user object ID.

3. Check Groups

Entra admin center → Identity → Groups → All groups

Search by object ID. If it resolves, note the group's assigned apps, roles, and member count on its Overview blade.

4. Check Enterprise applications and App registrations

Entra admin center → Identity → Applications → Enterprise applications → All applications

Change the filter to Application ID starts with and paste the GUID. If nothing matches, switch to Object ID starts with.

Entra admin center → Identity → Applications → App registrations → All applications

Repeat the App ID / Object ID probe.

5. Check Roles, Administrative Units, and Licenses

Identity → Roles & admins → Roles — role template IDs are well-known constants; compare against the published list.
Identity → Administrative units — paste GUID into search.
Billing → Licenses → All products — inspect the skuId column (hidden by default; enable via Columns).

6. Count users assigned (if the GUID is an app or group)

Open the Enterprise application → Users and groups blade.
Record each assigned principal. Groups need to be expanded to member users.
For each assigned group: Groups → {group} → Members. Copy the member list.
Combine all member lists into a spreadsheet and deduplicate by UPN.

The portal workflow is reliable but tedious. For anything more than a quick spot-check, prefer the API or script approach below.

Probe the GUID against Microsoft Graph

Issue the following requests in order. The first one that returns HTTP 200 with a populated body tells you the object type. A 404 is a clean negative; a 403 means "insufficient scope" — not a negative — so continue probing.

1. Is it a group?

GET https://graph.microsoft.com/v1.0/groups/{guid}?$select=id,displayName,description,groupTypes

2. Is it a user?

GET https://graph.microsoft.com/v1.0/users/{guid}?$select=id,displayName,userPrincipalName,accountEnabled

3. Is it an application object ID?

GET https://graph.microsoft.com/v1.0/applications/{guid}?$select=id,appId,displayName

4. Is it an App ID (applications)?

GET https://graph.microsoft.com/v1.0/applications?$filter=appId eq '{guid}'&$select=id,appId,displayName

5. Is it a service principal object ID?

GET https://graph.microsoft.com/v1.0/servicePrincipals/{guid}?$select=id,appId,displayName,servicePrincipalType

6. Is it an App ID (service principals)?

GET https://graph.microsoft.com/v1.0/servicePrincipals?$filter=appId eq '{guid}'&$select=id,appId,displayName

7. Is it an administrative unit?

GET https://graph.microsoft.com/v1.0/directory/administrativeUnits/{guid}

8. Is it a directory role definition?

GET https://graph.microsoft.com/v1.0/roleManagement/directory/roleDefinitions/{guid}

9. Is it a license SKU?

Note: subscribedSkus does not support $filter. List all SKUs and match client-side:

GET https://graph.microsoft.com/v1.0/subscribedSkus?$select=skuId,skuPartNumber,consumedUnits,prepaidUnits

10. Is it a conditional access policy?

GET https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies/{guid}

11. Is it a managed device?

GET https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/{guid}

Once identified — count users assigned

For an enterprise application (service principal)

GET https://graph.microsoft.com/v1.0/servicePrincipals/{spObjectId}/appRoleAssignedTo?$select=principalId,principalDisplayName,principalType&$top=999

Each assignment's principalType is either User or Group. For groups, resolve members:

GET https://graph.microsoft.com/v1.0/groups/{groupId}/transitiveMembers/microsoft.graph.user?$select=id,userPrincipalName&$count=true
ConsistencyLevel: eventual

Deduplicate the union of all user principals across direct and group-inherited assignments to get the true user count.

For a group

GET https://graph.microsoft.com/v1.0/groups/{groupId}/transitiveMembers/$count
ConsistencyLevel: eventual

Example: real resolution

In a live trace, GUID 7a896ff9-8734-... returned 404 on /groups, /users, /servicePrincipals/{guid}, and /directory/administrativeUnits/{guid}. It returned a hit on /applications?$filter=appId eq '...' — identifying it as the App ID for "Production - Workday to Active Directory User Provisioning". Its service principal had two groups assigned, which expanded to 24 unique users.

Resolve and count with the Microsoft Graph PowerShell SDK

The accompanying Resolve-EntraGuid.ps1 script automates the full probe sequence and, for apps and groups, returns a deduplicated user count.

Prerequisites

Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "Directory.Read.All","Application.Read.All","Organization.Read.All"

Run the probe

.\Resolve-EntraGuid.ps1 -Guid '7a896ff9-8734-4cc8-b7d0-cb2c312c96b1'

What it does

Issues Get-Mg* calls against each candidate object type, suppressing expected 404s.
Prints the object type, display name, and object ID of the first match.
If the match is an application or service principal, it enumerates appRoleAssignedTo, expands every assigned group via transitiveMembers, and prints the deduplicated user count and the assignment breakdown.
If the match is a group, it prints the transitive user member count.

Interpretation hints

A 403 is logged as inconclusive — re-run with the additional scope named in the log.
If two matches occur (e.g. an app and its service principal both match an App ID probe), both are reported; the service principal is the one with assignments.

Next steps

More Entra ID & Identity recipes

Browse the rest of this category in the Dex Cookbook.

Automate this with Dex Pro

Let the autonomous IT engineer run this task under your policies.

Start free

Point Dex at a tenant and try it for 30 days, no credit card.