Docs menu
Reference
How GraphnAI is built, what it collects, and how it models your directories.
10 guides
Architecture
- Security architectureHow GraphnAI secures identity data: outbound-only bridges, mTLS, AES-256-GCM encryption at rest, credential handling, OIDC sign-in and RBAC.
- Identity graph and simulationGraphnAI models identities as a graph of nodes and typed edges with Tiered Fidelity levels, and simulates access changes without touching live data.
- Identity Folding and risk weightingIdentity Folding merges the ACL permissions between two identities into one weighted edge with a severity, so the worst access ranks first.
What’s collected
- Active Directory permissionsHow GraphnAI maps DCSync rights, constrained delegation, RBCD, gMSA password readers, WriteGPLink and AddSelf as graph edges after a full sync.Active Directory
- Entra ID permissionsSee Entra ID attack paths: abusable Microsoft Graph API permissions, OAuth 2.0 delegated grants, Conditional Access coverage, PIM eligible roles and guests.Entra ID
- Entra ID apps and directory rolesHow GraphnAI links app registrations to service principals, scopes directory role assignments and shows which Entra ID data is collected.Entra ID
- Attribute syncChoose which LDAP attributes and Microsoft Graph properties each Active Directory and Entra ID sync collects, including personal data for GDPR.
- Group membership between full syncsHow a delta sync picks up Active Directory group membership changes (memberOf, global catalog, range retrieval) and repairs gaps without a full sync.Active Directory
- Sync phase timelineRead the sync phase timeline: per-phase timing and nested step bars show where a slow sync spends its time, from import to build permissions to analytics.
- Large readsHow GraphnAI keeps large reads fast, with cursor pagination, streamed reach data and explicit cap fields.
- Detection catalogEvery detection rule GraphnAI ships, on its own page.
- Posture check catalogEvery posture check GraphnAI ships, on its own page.