Microsoft Entra ID Group Lookup is a Splunk add-on that provides an external lookup for resolving a user’s Microsoft Entra ID group memberships through Microsoft Graph. Given a user principal name or Entra object ID, the lookup returns direct or transitive group memberships, including group ID, display name, mail address, group type, and security/mail-enabled flags.