🏛️ Recipe · Microsoft 365 Governance

Generate an Organization Tree Map and Entity List via Microsoft Graph

Build a complete hierarchical org chart and entity inventory from your Microsoft 365 tenant using Graph API, manager relationships, departments, and groups.

Complexity

Intermediate

Impact

read-only + reporting + governance + audit-ready

Context

Why This Matters

Understanding an organization's structure is foundational to governance, onboarding, access reviews, and communications planning. While Microsoft 365 stores rich organizational data — user profiles, manager relationships, departments, and group memberships — there is no built-in admin view that presents a complete hierarchical tree alongside an entity inventory.

This recipe walks through generating that view programmatically by combining data from /users, /users/{id}/manager, and /groups in Microsoft Graph. The result is a visual reporting-line tree plus a consolidated list of departments and groups that exist in the tenant.

When to run this recipe

During annual access reviews or governance audits
Before a reorganization, merger, or acquisition
When onboarding new HR or IT leadership who need to understand the org
As part of a readiness assessment for Conditional Access, Sensitivity Labels, or lifecycle workflows that depend on department/manager attributes
To detect data quality issues (missing managers, missing departments, orphaned users)

Expected Outcomes

After completing this recipe you will have:

A hierarchical ASCII/text tree showing every reporting chain in the tenant, starting from users with no manager (CEOs, contractors, service accounts)
A complete list of departments with employee counts per department
An inventory of all Microsoft 365 Groups and Security Groups, including descriptions and type
Summary statistics: total users, top-level managers, department count, group count
A downloadable organization-map.txt report suitable for sharing with HR, leadership, or auditors

You can feed the same data into Visio, Mermaid diagrams, or BI tools for richer visualizations.

Risks & Considerations

Data accuracy

The tree is only as good as the manager attribute in Entra ID. Many tenants have incomplete manager data — users without managers will appear as roots, producing a flat-looking tree.
Users with department left blank will be grouped under "No Department".
Guest users (userType = Guest) are included by default. Filter them out if you only want employees.

Performance and throttling

Fetching manager relationships requires one API call per user. For tenants with 10,000+ users, batch requests or use $expand=manager to reduce call volume.
Microsoft Graph throttles at roughly 10,000 requests / 10 minutes per app per tenant. Implement retry with exponential backoff on HTTP 429.

Privacy and handling

The output contains PII (names, titles, email addresses, reporting lines). Treat the file as confidential and store it only in approved locations.
Do not email the raw report externally — it can reveal sensitive org structure to attackers for spear-phishing.

Do not

Do not mutate user or group data from this recipe — it is read-only by design.
Do not rely on the tree for compliance attestations without validating manager data against HRIS first.

Required Permissions

Permission	Why It's Needed
User.Read.All	Enumerate all users and read profile properties (displayName, jobTitle, department, mail).
Directory.Read.All	Read manager relationships via /users/{id}/manager to build the reporting hierarchy.
Group.Read.All	Enumerate Microsoft 365 Groups and Security Groups as organizational entities.
Organization.Read.All	Retrieve tenant organization details (display name, verified domains).

The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.

For IT Admins

Paste into Dex Pro

Generate an organization tree map and entity list for our Microsoft 365 tenant. Include the full reporting hierarchy (based on manager relationships), a breakdown of departments with employee counts, and an inventory of all Microsoft 365 and Security Groups. Deliver the output as a downloadable text report.

Try in Dex Pro

For End Users

How an employee would ask Dex for help

Can you show me our company's org chart — who reports to who, what departments we have, and what Teams or groups exist?

Try in Dex Playground

Manual walkthrough in the Microsoft 365 admin center and Entra portal

There is no single GUI that produces a complete tree map, but you can assemble equivalent information across three admin surfaces. This approach is suitable for small tenants (<50 users) or spot-checks.

Step 1 — Export the user list from Microsoft 365 admin center

Sign in to https://admin.microsoft.com as a Global Reader or User Admin.
Navigate to Users → Active users.
Click Export users in the toolbar. A CSV containing display name, UPN, licenses, and basic profile data will download.

Step 2 — Capture manager/department detail from Entra ID

Go to https://entra.microsoft.com → Identity → Users → All users.
Click Download users → Start. The resulting CSV includes department, jobTitle, and city, but not manager. Manager must be read per-user:
For each user you care about, open the user blade → Job info tab → note the Manager field.

Step 3 — Inventory groups

In Entra, go to Groups → All groups.
Click Download groups → Start. The CSV lists every group with its type (Security / Microsoft 365), mail-enabled flag, and description.

Step 4 — Build the tree

Open the user CSV in Excel. Add a Manager column populated from Step 2.
Use a PivotTable or a tool like Visio → Create from Data → Organization Chart Wizard, pointing at the CSV with Name and Reports to columns. Visio will render a hierarchy automatically.

Because manager data is read one user at a time in the GUI, the API or PowerShell approach below is strongly recommended for tenants with more than a handful of users.

Graph API recipe

Three Graph endpoints are combined to produce the tree map and entity list.

1. Read tenant organization details

GET https://graph.microsoft.com/v1.0/organization

Returns tenant display name and verified domains. Useful as the report header.

2. Enumerate users with paging

GET https://graph.microsoft.com/v1.0/users?$select=id,displayName,jobTitle,department,mail,userPrincipalName&$top=999

Follow the @odata.nextLink until it is absent. Keep $select narrow to minimize payload.

3. Resolve manager per user

The list endpoint does not return manager in the default projection. Either expand it or call per-user:

// Option A: expand on the list call
GET /v1.0/users?$select=id,displayName,department,jobTitle&$expand=manager($select=id,displayName)

// Option B: per-user lookup (used in the reference script)
GET /v1.0/users/{user-id}/manager?$select=id,displayName

A 404 on the per-user manager call means the user has no manager assigned — treat them as a tree root. Do not treat 404 as an error.

4. Enumerate groups

GET /v1.0/groups?$select=id,displayName,description,groupTypes,mailEnabled,securityEnabled&$top=999

Groups where groupTypes contains Unified are Microsoft 365 Groups; otherwise they are Security or Distribution groups.

Sample response fragment

{
  "value": [
    {
      "id": "2f2d3187-5fad-4d73-a9f5-3c356e68a038",
      "displayName": "Patti Fernandez",
      "jobTitle": "Chief Executive Officer",
      "department": "Executive"
    }
  ]
}

Throttling

On HTTP 429, honor the Retry-After header. For large tenants, use JSON batching (20 requests per batch) to fetch manager relationships more efficiently.

PowerShell recipe using Microsoft.Graph

The reference script below uses the official Microsoft.Graph module. It authenticates interactively, pages through all users, resolves managers, collects groups, and writes a formatted organization-map.txt.

Prerequisites

PowerShell 7+ (recommended) or Windows PowerShell 5.1
Install-Module Microsoft.Graph -Scope CurrentUser
A Global Reader (or higher) account for the target tenant

How it works

Connect-MgGraph prompts for consent on the four required scopes.
Get-MgUser -All -ExpandProperty Manager fetches every user in a single paged call with the manager attribute expanded — avoiding one-call-per-user.
The script builds a hashtable keyed by user ID, attaches children to their manager, and identifies roots (users with no manager).
A recursive Write-Tree function emits the ASCII tree with ├──, └──, and indentation.
Get-MgGroup -All pulls the group inventory.
Everything is written to organization-map.txt in the current directory.

Running the script

.\Generate-OrgTreeMap.ps1 -OutputPath "C:\Reports\org-map.txt"

Use -IncludeGuests:$false (the default) to exclude external guests from the tree.

Next steps

More Microsoft 365 Governance recipes

Browse the rest of this category in the Dex Cookbook.

Automate this with Dex Pro

Let the autonomous IT engineer run this task under your policies.

Start free

Point Dex at a tenant and try it for 30 days, no credit card.