Optimize graph traversal for large tenants (1000+ devices/users)

[juandresrodca]

Overview

Benchmark and optimize IntuneGraph's core graph traversal algorithms (Get-IntuneTarget, Get-IntuneBlastRadius, Find-IntuneOrphan) to handle enterprise-scale Intune environments efficiently.

Current State

The tool is designed for fixture-driven testing and demo scenarios. Real-world enterprise tenants may have:

• 5,000+ managed devices
• 1,000+ Azure AD security groups
• 500+ policies, apps, and compliance rules
• Deep group nesting (5+ levels)
• Complex exclusion and filter combinations

Performance characteristics at scale are not yet documented or optimized.

Performance Goals

• Get-IntuneTarget should complete in < 1s per device on a 5K-device tenant
• Get-IntuneBlastRadius should complete in < 500ms per group change
• Find-IntuneOrphan full scan should complete in < 5 seconds
• Memory usage should stay under 1GB for 5K-device snapshot

Investigation Areas

1. Graph traversal efficiency

   • Profile current algorithm complexity (likely O(n*m) or worse with nesting)
   • Identify bottlenecks in group membership resolution
   • Look for duplicate traversals or redundant lookups

2. Caching & memoization

   • Can we cache group membership paths between queries?
   • Should filter evaluation results be memoized?
   • Can we precompute transitive closure for nested groups?

3. Algorithm selection

   • Consider switching from recursive traversal to iterative with queue/stack
   • Evaluate topological sort vs. current graph walk strategy
   • Consider lazy evaluation for rarely-accessed assignments

4. Data structure optimization

   • Is the in-memory representation efficient for multiple queries?
   • Would indexing (hash tables) on group IDs, device IDs improve lookups?
   • Can we minimize object duplication in the graph.json snapshot?

Implementation Plan

1. Create performance benchmarks using fixture data at multiple scales (100, 500, 1K, 5K devices)
2. Profile current implementation with PowerShell's -Verbose and custom timing
3. Document baseline numbers
4. Implement optimizations iteratively
5. Re-run benchmarks after each optimization
6. Add continuous performance testing to CI/CD

Success Criteria

• Benchmarks created and documented for 1K and 5K device scenarios
• Current performance baseline established
• At least 2 optimization areas identified and tested
• Performance targets met or documented roadmap if not achievable
• PR includes before/after performance numbers

Labels

• enhancement