← cd ~/compare
// compare · entra roles
Security Operator vs Security Reader
Two Microsoft Entra built-in roles that are often confused, compared permission by permission.
In short: Security Operator has 17 permissions, privileged. Security Reader has 33 permissions, privileged. Assign the one with less access that still covers the job, and use PIM for whichever is privileged.
| Security Operator | Security Reader | |
|---|---|---|
| What Microsoft says | Creates and manages security events and performs identity containment actions during security incidents. | Can read security information and reports in Microsoft Entra ID and Office 365. |
| Size | 17 permissions, privileged | 33 permissions, privileged |
Permissions only Security Operator lists (12)
microsoft.azure.advancedThreatProtection/allEntities/allTasksmicrosoft.azure.supportTickets/allEntities/allTasksmicrosoft.directory/cloudAppSecurity/allProperties/allTasksmicrosoft.directory/identityProtection/allProperties/allTasksmicrosoft.directory/users/disablemicrosoft.directory/users/enablemicrosoft.directory/users/invalidateAllRefreshTokensmicrosoft.directory/users/password/updatemicrosoft.intune/allEntities/readmicrosoft.office365.securityComplianceCenter/allEntities/allTasksmicrosoft.office365.supportTickets/allEntities/allTasksmicrosoft.windows.defenderAdvancedThreatProtection/allEntities/allTasks
Permissions only Security Reader lists (28)
microsoft.agentRegistry/allEntities/allProperties/readmicrosoft.azure.serviceHealth/allEntities/allTasksmicrosoft.directory/accessReviews/definitions/allProperties/readmicrosoft.directory/bitlockerKeys/key/readmicrosoft.directory/conditionalAccessPolicies/owners/readmicrosoft.directory/conditionalAccessPolicies/policyAppliedTo/readmicrosoft.directory/conditionalAccessPolicies/standard/readmicrosoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/standard/readmicrosoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/standard/readmicrosoft.directory/deviceLocalCredentials/standard/readmicrosoft.directory/domains/federationConfiguration/standard/readmicrosoft.directory/entitlementManagement/allProperties/readmicrosoft.directory/identityProtection/allProperties/readmicrosoft.directory/multiTenantOrganization/joinRequest/standard/readmicrosoft.directory/multiTenantOrganization/standard/readmicrosoft.directory/multiTenantOrganization/tenants/organizationDetails/readmicrosoft.directory/multiTenantOrganization/tenants/standard/readmicrosoft.directory/namedLocations/standard/readmicrosoft.directory/policies/owners/readmicrosoft.directory/policies/policyAppliedTo/readmicrosoft.directory/policies/standard/readmicrosoft.networkAccess/allEntities/allProperties/readmicrosoft.office365.protectionCenter/allEntities/standard/readmicrosoft.office365.protectionCenter/attackSimulator/payload/allProperties/readmicrosoft.office365.protectionCenter/attackSimulator/reports/allProperties/readmicrosoft.office365.protectionCenter/attackSimulator/simulation/allProperties/readmicrosoft.office365.serviceHealth/allEntities/allTasksmicrosoft.office365.webPortal/allEntities/standard/read
Permissions are listed as Microsoft writes them. A broad one, such as one ending in allTasks, can cover several narrower ones listed for the other role.