When you switch on a compliance policy, the portal eventually shows a green check. But what happens between "device enrolled" and "Conditional Access lets it in"? The answer isn't a live query — it's a check-in loop, an expiry clock, and a handoff to Entra ID.
You don't need a live tenant connection to build a useful Power BI report. Point it at a sanitized CSV a read-only job already wrote, and the whole report stays containable — here's the wiring, end to end.
Every click in the Intune and Entra portals fires a Microsoft Graph call underneath — and once you can see it, the portal stops being magic. This series decodes what the portal actually sends, and which permission each call needs.
It began with a permission error that wouldn't quit. Sites.Selected looked right, the role assignment looked right — and Graph still returned 403. Chasing why led somewhere better than a fix: an architecture where the AI never touches a live system at all.