← cd ~/compare
// compare · entra roles
Security Reader vs Global Reader
Two Microsoft Entra built-in roles that are often confused, compared permission by permission.
In short: Security Reader has 33 permissions, privileged. Global Reader has 99 permissions, privileged. Assign the one with less access that still covers the job, and use PIM for whichever is privileged.
| Detail | Security Reader | Global Reader |
|---|---|---|
| What Microsoft says | Can read security information and reports in Microsoft Entra ID and Office 365. | Can read everything that a Global Administrator can, but not update anything. |
| Size | 33 permissions, privileged | 99 permissions, privileged |
Permissions only Security Reader lists (10)
microsoft.directory/conditionalAccessPolicies/owners/readmicrosoft.directory/conditionalAccessPolicies/policyAppliedTo/readmicrosoft.directory/conditionalAccessPolicies/standard/readmicrosoft.directory/policies/owners/readmicrosoft.directory/policies/policyAppliedTo/readmicrosoft.directory/policies/standard/readmicrosoft.office365.protectionCenter/allEntities/standard/readmicrosoft.office365.protectionCenter/attackSimulator/payload/allProperties/readmicrosoft.office365.protectionCenter/attackSimulator/reports/allProperties/readmicrosoft.office365.protectionCenter/attackSimulator/simulation/allProperties/read
Permissions only Global Reader lists (76)
microsoft.backup/allEntities/allProperties/readmicrosoft.cloudPC/allEntities/allProperties/readmicrosoft.commerce.billing/allEntities/allProperties/readmicrosoft.commerce.billing/purchases/standard/readmicrosoft.directory/accessReviews/allProperties/readmicrosoft.directory/adminConsentRequestPolicy/allProperties/readmicrosoft.directory/administrativeUnits/allProperties/readmicrosoft.directory/appConsent/appConsentRequests/allProperties/readmicrosoft.directory/applications/allProperties/readmicrosoft.directory/applications/synchronization/standard/readmicrosoft.directory/cloudAppSecurity/allProperties/readmicrosoft.directory/conditionalAccessPolicies/allProperties/readmicrosoft.directory/connectorGroups/allProperties/readmicrosoft.directory/connectors/allProperties/readmicrosoft.directory/contacts/allProperties/readmicrosoft.directory/crossTenantAccessPolicy/default/standard/readmicrosoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/standard/readmicrosoft.directory/crossTenantAccessPolicy/partners/standard/readmicrosoft.directory/crossTenantAccessPolicy/standard/readmicrosoft.directory/customAuthenticationExtensions/allProperties/readmicrosoft.directory/deviceManagementPolicies/standard/readmicrosoft.directory/deviceRegistrationPolicy/standard/readmicrosoft.directory/devices/allProperties/readmicrosoft.directory/directoryRoles/allProperties/readmicrosoft.directory/directoryRoleTemplates/allProperties/readmicrosoft.directory/domains/allProperties/readmicrosoft.directory/externalUserProfiles/standard/readmicrosoft.directory/groups/allProperties/readmicrosoft.directory/groupSettings/allProperties/readmicrosoft.directory/groupSettingTemplates/allProperties/readmicrosoft.directory/lifecycleWorkflows/workflows/allProperties/readmicrosoft.directory/loginOrganizationBranding/allProperties/readmicrosoft.directory/oAuth2PermissionGrants/allProperties/readmicrosoft.directory/onPremisesSynchronization/standard/readmicrosoft.directory/organization/allProperties/readmicrosoft.directory/pendingExternalUserProfiles/standard/readmicrosoft.directory/permissionGrantPolicies/standard/readmicrosoft.directory/policies/allProperties/readmicrosoft.directory/roleAssignments/allProperties/readmicrosoft.directory/roleDefinitions/allProperties/read
…and 36 more.
Permissions are listed as Microsoft writes them. A broad one, such as one ending in allTasks, can cover several narrower ones listed for the other role.
Spotted something out of date or wrong? Tell us and we'll fix it.