← cd ~/compare
// compare · entra roles
Global Reader vs Directory Readers
Two Microsoft Entra built-in roles that are often confused, compared permission by permission.
In short: Global Reader has 99 permissions, privileged. Directory Readers has 55 permissions. Assign the one with less access that still covers the job, and use PIM for whichever is privileged.
| Global Reader | Directory Readers | |
|---|---|---|
| What Microsoft says | Can read everything that a Global Administrator can, but not update anything. | Can read basic directory information. Commonly used to grant directory read access to applications and guests. |
| Size | 99 permissions, privileged | 55 permissions |
Permissions only Global Reader lists (99)
microsoft.agentRegistry/allEntities/allProperties/readmicrosoft.azure.serviceHealth/allEntities/allTasksmicrosoft.backup/allEntities/allProperties/readmicrosoft.cloudPC/allEntities/allProperties/readmicrosoft.commerce.billing/allEntities/allProperties/readmicrosoft.commerce.billing/purchases/standard/readmicrosoft.directory/accessReviews/allProperties/readmicrosoft.directory/accessReviews/definitions/allProperties/readmicrosoft.directory/adminConsentRequestPolicy/allProperties/readmicrosoft.directory/administrativeUnits/allProperties/readmicrosoft.directory/appConsent/appConsentRequests/allProperties/readmicrosoft.directory/applications/allProperties/readmicrosoft.directory/applications/synchronization/standard/readmicrosoft.directory/auditLogs/allProperties/readmicrosoft.directory/authorizationPolicy/standard/readmicrosoft.directory/bitlockerKeys/key/readmicrosoft.directory/cloudAppSecurity/allProperties/readmicrosoft.directory/conditionalAccessPolicies/allProperties/readmicrosoft.directory/connectorGroups/allProperties/readmicrosoft.directory/connectors/allProperties/readmicrosoft.directory/contacts/allProperties/readmicrosoft.directory/crossTenantAccessPolicy/default/standard/readmicrosoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/standard/readmicrosoft.directory/crossTenantAccessPolicy/partners/standard/readmicrosoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/standard/readmicrosoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/standard/readmicrosoft.directory/crossTenantAccessPolicy/standard/readmicrosoft.directory/customAuthenticationExtensions/allProperties/readmicrosoft.directory/deviceLocalCredentials/standard/readmicrosoft.directory/deviceManagementPolicies/standard/readmicrosoft.directory/deviceRegistrationPolicy/standard/readmicrosoft.directory/devices/allProperties/readmicrosoft.directory/directoryRoles/allProperties/readmicrosoft.directory/directoryRoleTemplates/allProperties/readmicrosoft.directory/domains/allProperties/readmicrosoft.directory/domains/federationConfiguration/standard/readmicrosoft.directory/entitlementManagement/allProperties/readmicrosoft.directory/externalUserProfiles/standard/readmicrosoft.directory/groups/allProperties/readmicrosoft.directory/groupSettings/allProperties/read
…and 59 more.
Permissions only Directory Readers lists (55)
microsoft.directory/administrativeUnits/members/readmicrosoft.directory/administrativeUnits/standard/readmicrosoft.directory/applicationPolicies/standard/readmicrosoft.directory/applications/owners/readmicrosoft.directory/applications/policies/readmicrosoft.directory/applications/standard/readmicrosoft.directory/contacts/memberOf/readmicrosoft.directory/contacts/standard/readmicrosoft.directory/contracts/standard/readmicrosoft.directory/devices/memberOf/readmicrosoft.directory/devices/registeredOwners/readmicrosoft.directory/devices/registeredUsers/readmicrosoft.directory/devices/standard/readmicrosoft.directory/directoryRoles/eligibleMembers/readmicrosoft.directory/directoryRoles/members/readmicrosoft.directory/directoryRoles/standard/readmicrosoft.directory/domains/standard/readmicrosoft.directory/groups/appRoleAssignments/readmicrosoft.directory/groups/memberOf/readmicrosoft.directory/groups/members/readmicrosoft.directory/groups/owners/readmicrosoft.directory/groups/settings/readmicrosoft.directory/groups/standard/readmicrosoft.directory/groupSettings/standard/readmicrosoft.directory/groupSettingTemplates/standard/readmicrosoft.directory/oAuth2PermissionGrants/standard/readmicrosoft.directory/organization/standard/readmicrosoft.directory/organization/trustedCAsForPasswordlessAuth/readmicrosoft.directory/roleAssignments/standard/readmicrosoft.directory/roleDefinitions/standard/readmicrosoft.directory/servicePrincipals/appRoleAssignedTo/readmicrosoft.directory/servicePrincipals/appRoleAssignments/readmicrosoft.directory/servicePrincipals/memberOf/readmicrosoft.directory/servicePrincipals/oAuth2PermissionGrants/readmicrosoft.directory/servicePrincipals/ownedObjects/readmicrosoft.directory/servicePrincipals/owners/readmicrosoft.directory/servicePrincipals/policies/readmicrosoft.directory/servicePrincipals/standard/readmicrosoft.directory/subscribedSkus/standard/readmicrosoft.directory/users/appRoleAssignments/read
…and 15 more.
Permissions are listed as Microsoft writes them. A broad one, such as one ending in allTasks, can cover several narrower ones listed for the other role.