azureblog.co.uk
← cd ~/roles
// roles/entra

Attribute Log ReaderMicrosoft Entra built-in role

Read audit logs related to custom security attributes.

Role ID9c99539d-8186-4804-835f-fd51ef9e2dcd
PrivilegedNo
Permissions1

What it can do

PermissionWhat it allows
microsoft.directory/customSecurityAttributeAuditLogs/allProperties/readRead audit logs related to custom secruity attributes

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines
Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Attribute Log Reader for <reason>"
    RoleDefinitionId = "9c99539d-8186-4804-835f-fd51ef9e2dcd"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines
Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '9c99539d-8186-4804-835f-fd51ef9e2dcd'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Find the smallest role for a task →

Sources