← cd ~/compare
// compare · entra roles
Global Administrator vs Global Reader
Two Microsoft Entra built-in roles that are often confused, compared permission by permission.
In short: Global Administrator has 252 permissions, privileged. Global Reader has 99 permissions, privileged. Assign the one with less access that still covers the job, and use PIM for whichever is privileged.
| Detail | Global Administrator | Global Reader |
|---|---|---|
| What Microsoft says | Can manage all aspects of Microsoft Entra ID and Microsoft services that use Microsoft Entra identities. | Can read everything that a Global Administrator can, but not update anything. |
| Size | 252 permissions, privileged | 99 permissions, privileged |
Permissions only Global Administrator lists (210)
microsoft.agentRegistry/allEntities/allProperties/allTasksmicrosoft.azure.advancedThreatProtection/allEntities/allTasksmicrosoft.azure.informationProtection/allEntities/allTasksmicrosoft.azure.supportTickets/allEntities/allTasksmicrosoft.backup/allEntities/allProperties/allTasksmicrosoft.cloudPC/allEntities/allProperties/allTasksmicrosoft.commerce.billing/allEntities/allProperties/allTasksmicrosoft.commerce.tenantRelationships/customerDelegatedAdminPrivileges/allProperties/allTasksmicrosoft.directory/accessReviews/allProperties/allTasksmicrosoft.directory/accessReviews/definitions/allProperties/allTasksmicrosoft.directory/adminConsentRequestPolicy/allProperties/allTasksmicrosoft.directory/administrativeUnits/allProperties/allTasksmicrosoft.directory/agentIdentities/appRoleAssignedTo/updatemicrosoft.directory/agentIdentities/authentication/updatemicrosoft.directory/agentIdentities/basic/updatemicrosoft.directory/agentIdentities/createmicrosoft.directory/agentIdentities/deletemicrosoft.directory/agentIdentities/disablemicrosoft.directory/agentIdentities/enablemicrosoft.directory/agentIdentities/owners/updatemicrosoft.directory/agentIdentities/tag/updatemicrosoft.directory/agentIdentityBlueprintPrincipals/appRoleAssignedTo/updatemicrosoft.directory/agentIdentityBlueprintPrincipals/authentication/updatemicrosoft.directory/agentIdentityBlueprintPrincipals/basic/updatemicrosoft.directory/agentIdentityBlueprintPrincipals/createmicrosoft.directory/agentIdentityBlueprintPrincipals/deletemicrosoft.directory/agentIdentityBlueprintPrincipals/disablemicrosoft.directory/agentIdentityBlueprintPrincipals/enablemicrosoft.directory/agentIdentityBlueprintPrincipals/owners/updatemicrosoft.directory/agentIdentityBlueprintPrincipals/tag/updatemicrosoft.directory/agentIdentityBlueprints/allProperties/updatemicrosoft.directory/agentIdentityBlueprints/appRoles/updatemicrosoft.directory/agentIdentityBlueprints/audience/updatemicrosoft.directory/agentIdentityBlueprints/authentication/updatemicrosoft.directory/agentIdentityBlueprints/basic/updatemicrosoft.directory/agentIdentityBlueprints/createmicrosoft.directory/agentIdentityBlueprints/credentials/updatemicrosoft.directory/agentIdentityBlueprints/deletemicrosoft.directory/agentIdentityBlueprints/owners/updatemicrosoft.directory/agentIdentityBlueprints/permissions/update
…and 170 more.
Permissions only Global Reader lists (57)
microsoft.agentRegistry/allEntities/allProperties/readmicrosoft.backup/allEntities/allProperties/readmicrosoft.cloudPC/allEntities/allProperties/readmicrosoft.commerce.billing/allEntities/allProperties/readmicrosoft.directory/accessReviews/allProperties/readmicrosoft.directory/accessReviews/definitions/allProperties/readmicrosoft.directory/adminConsentRequestPolicy/allProperties/readmicrosoft.directory/administrativeUnits/allProperties/readmicrosoft.directory/applications/allProperties/readmicrosoft.directory/authorizationPolicy/standard/readmicrosoft.directory/cloudAppSecurity/allProperties/readmicrosoft.directory/conditionalAccessPolicies/allProperties/readmicrosoft.directory/contacts/allProperties/readmicrosoft.directory/customAuthenticationExtensions/allProperties/readmicrosoft.directory/deviceLocalCredentials/standard/readmicrosoft.directory/devices/allProperties/readmicrosoft.directory/directoryRoles/allProperties/readmicrosoft.directory/directoryRoleTemplates/allProperties/readmicrosoft.directory/domains/allProperties/readmicrosoft.directory/entitlementManagement/allProperties/readmicrosoft.directory/groups/allProperties/readmicrosoft.directory/groupSettings/allProperties/readmicrosoft.directory/groupSettingTemplates/allProperties/readmicrosoft.directory/identityProtection/allProperties/readmicrosoft.directory/lifecycleWorkflows/workflows/allProperties/readmicrosoft.directory/loginOrganizationBranding/allProperties/readmicrosoft.directory/oAuth2PermissionGrants/allProperties/readmicrosoft.directory/organization/allProperties/readmicrosoft.directory/policies/allProperties/readmicrosoft.directory/roleAssignments/allProperties/readmicrosoft.directory/roleDefinitions/allProperties/readmicrosoft.directory/scopedRoleMemberships/allProperties/readmicrosoft.directory/servicePrincipals/allProperties/readmicrosoft.directory/subscribedSkus/allProperties/readmicrosoft.directory/users/allProperties/readmicrosoft.directory/users/authenticationMethods/standard/restrictedReadmicrosoft.edge/allEntities/allProperties/readmicrosoft.graph.dataConnect/allEntities/allProperties/readmicrosoft.hardware.support/shippingAddress/allProperties/readmicrosoft.hardware.support/warrantyClaims/allProperties/read
…and 17 more.
Permissions are listed as Microsoft writes them. A broad one, such as one ending in allTasks, can cover several narrower ones listed for the other role.
Spotted something out of date or wrong? Tell us and we'll fix it.