// roles/entra · privileged

AI ReaderMicrosoft Entra built-in role

Read all aspects of Microsoft Copilot and AI-related enterprise services in Microsoft 365.

Role ID	`1fe13547-53f6-408d-ac04-7f8eed167b38`
Privileged	Yes. Microsoft marks this role as privileged.
Permissions	45

Before you assign it

Microsoft labels this a privileged role, so make it eligible through PIM rather than permanent, require phishing-resistant MFA to activate it, and review who has it regularly.

What it can do

Permission	What it allows
`microsoft.azure.serviceHealth/allEntities/allTasks`	Read and configure Azure Service Health
`microsoft.directory/administrativeUnits/members/read`	Read members of administrative units
`microsoft.directory/administrativeUnits/standard/read`	Read basic properties on administrative units
`microsoft.directory/adminConsentRequestPolicy/allProperties/read`	Read all properties of admin consent request policies in Microsoft Entra ID
`microsoft.directory/agentIdentities/allProperties/read`	Read all properties of agent identities
`microsoft.directory/agentIdentityBlueprintPrincipals/allProperties/read`	Read all properties of agent identity blueprint principals
`microsoft.directory/agentIdentityBlueprints/allProperties/read`	Read all properties of agent identity blueprints
`microsoft.directory/agentUsers/lifeCycleInfo/read`	Read lifecycle information of agent users, such as employeeLeaveDateTime
`microsoft.directory/applicationPolicies/standard/read`	Read standard properties of application policies
`microsoft.directory/applications/owners/read`	Read owners of applications
`microsoft.directory/applications/policies/read`	Read policies of applications
`microsoft.directory/applications/standard/read`	Read standard properties of applications
`microsoft.directory/contacts/memberOf/read`	Read the group membership for all contacts in Microsoft Entra ID
`microsoft.directory/contacts/standard/read`	Read basic properties on contacts in Microsoft Entra ID
`microsoft.directory/contracts/standard/read`	Read basic properties on partner contracts
`microsoft.directory/domains/standard/read`	Read basic properties on domains
`microsoft.directory/entitlementManagement/allProperties/read`	Read all properties in Microsoft Entra entitlement management
`microsoft.directory/groups/appRoleAssignments/read`	Read application role assignments of groups
`microsoft.directory/groups/memberOf/read`	Read the memberOf property on Security groups and Microsoft 365 groups, including role-assignable groups
`microsoft.directory/groups/members/read`	Read members of Security groups and Microsoft 365 groups, including role-assignable groups
`microsoft.directory/groups/owners/read`	Read owners of Security groups and Microsoft 365 groups, including role-assignable groups
`microsoft.directory/groups/settings/read`	Read settings of groups
`microsoft.directory/groups/standard/read`	Read standard properties of Security groups and Microsoft 365 groups, including role-assignable groups
`microsoft.directory/groupSettings/standard/read`	Read basic properties on group settings
`microsoft.directory/groupSettingTemplates/standard/read`	Read basic properties on group setting templates
`microsoft.directory/oAuth2PermissionGrants/standard/read`	Read basic properties on OAuth 2.0 permission grants
`microsoft.directory/organization/standard/read`	Read basic properties on an organization
`microsoft.directory/organization/trustedCAsForPasswordlessAuth/read`	Read trusted certificate authorities for passwordless authentication
`microsoft.directory/roleAssignments/standard/read`	Read basic properties on role assignments
`microsoft.directory/roleDefinitions/standard/read`	Read basic properties on role definitions
`microsoft.directory/servicePrincipals/appRoleAssignedTo/read`	Read service principal role assignments
`microsoft.directory/servicePrincipals/appRoleAssignments/read`	Read role assignments assigned to service principals
`microsoft.directory/servicePrincipals/memberOf/read`	Read the group memberships on service principals
`microsoft.directory/servicePrincipals/oAuth2PermissionGrants/read`	Read delegated permission grants on service principals
`microsoft.directory/servicePrincipals/ownedObjects/read`	Read owned objects of service principals
`microsoft.directory/servicePrincipals/owners/read`	Read owners of service principals
`microsoft.directory/servicePrincipals/policies/read`	Read policies of service principals
`microsoft.directory/servicePrincipals/standard/read`	Read basic properties of service principals
`microsoft.directory/subscribedSkus/standard/read`	Read basic properties on subscriptions
`microsoft.directory/users/allProperties/read`	Read all properties of users
`microsoft.office365.copilot/allEntities/allProperties/read`	Read all settings for Microsoft Copilot
`microsoft.office365.messageCenter/messages/read`	Read messages in Message Center in the Microsoft 365 admin center, excluding security messages
`microsoft.office365.network/performance/allProperties/read`	Read all network performance properties in the Microsoft 365 admin center
`microsoft.office365.serviceHealth/allEntities/allTasks`	Read and configure Service Health in the Microsoft 365 admin center
`microsoft.office365.webPortal/allEntities/standard/read`	Read basic properties on all resources in the Microsoft 365 admin center

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs AI Reader for <reason>"
    RoleDefinitionId = "1fe13547-53f6-408d-ac04-7f8eed167b38"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '1fe13547-53f6-408d-ac04-7f8eed167b38'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Partner Tier2 Support · 46 permissions · privileged
Directory Writers · 42 permissions · privileged
Partner Tier1 Support · 40 permissions · privileged
Intune Administrator · 38 permissions · privileged
User Administrator · 56 permissions · privileged
Security Reader · 33 permissions · privileged
Cloud Application Administrator · 61 permissions · privileged
Hybrid Identity Administrator · 61 permissions · privileged

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles