LOOM_GRAPH_USERS_ENABLED=true and grant the Console UAMI Directory.Read.All + User.Read.All in Microsoft Graph (run scripts/csa-loom/grant-uami-graph-roles.sh) for display name, department, account status, license SKU assignments, and per-user workspace-role expansion. Without Graph, the page still shows UPN + activity + roles from Cosmos.