// roles/entra · privileged

Global ReaderMicrosoft Entra built-in role

Can read everything that a Global Administrator can, but not update anything.

Role ID	`f2ef992c-3afb-46b9-b7cf-a126ee74c451`
Privileged	Yes. Microsoft marks this role as privileged.
Permissions	99

Before you assign it

Microsoft labels this a privileged role, so make it eligible through PIM rather than permanent, require phishing-resistant MFA to activate it, and review who has it regularly.

What it can do

Permission	What it allows
`microsoft.agentRegistry/allEntities/allProperties/read`	Read all properties of Agent Registry in Microsoft Entra ID
`microsoft.azure.serviceHealth/allEntities/allTasks`	Read and configure Azure Service Health
`microsoft.backup/allEntities/allProperties/read`	Read all aspects of Microsoft 365 Backup
`microsoft.cloudPC/allEntities/allProperties/read`	Read all aspects of Windows 365
`microsoft.commerce.billing/allEntities/allProperties/read`	Read all resources of Office 365 billing
`microsoft.commerce.billing/purchases/standard/read`	Read purchase services in Microsoft 365 admin center.
`microsoft.directory/accessReviews/allProperties/read`	Read all properties of access reviews
`microsoft.directory/accessReviews/definitions/allProperties/read`	Read all properties of access reviews of all reviewable resources in Microsoft Entra ID
`microsoft.directory/adminConsentRequestPolicy/allProperties/read`	Read all properties of admin consent request policies in Microsoft Entra ID
`microsoft.directory/administrativeUnits/allProperties/read`	Read all properties of administrative units, including members
`microsoft.directory/appConsent/appConsentRequests/allProperties/read`	Read all properties of consent requests for applications registered with Microsoft Entra ID
`microsoft.directory/applications/allProperties/read`	Read all properties (including privileged properties) on all types of applications
`microsoft.directory/applications/synchronization/standard/read`	Read provisioning settings associated with the application object
`microsoft.directory/auditLogs/allProperties/read`	Read all properties on audit logs, excluding custom security attributes audit logs
`microsoft.directory/authorizationPolicy/standard/read`	Read standard properties of authorization policy
`microsoft.directory/bitlockerKeys/key/read`	Read bitlocker metadata and key on devices
`microsoft.directory/cloudAppSecurity/allProperties/read`	Read all properties for Cloud app security
`microsoft.directory/conditionalAccessPolicies/allProperties/read`	Read all properties of Conditional Access policies
`microsoft.directory/connectorGroups/allProperties/read`	Read all properties of application proxy connector groups
`microsoft.directory/connectors/allProperties/read`	Read all properties of application proxy connectors
`microsoft.directory/contacts/allProperties/read`	Read all properties for contacts
`microsoft.directory/crossTenantAccessPolicy/default/standard/read`	Read basic properties of the default cross-tenant access policy
`microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/standard/read`	Read basic properties of cross-tenant sync policy
`microsoft.directory/crossTenantAccessPolicy/partners/standard/read`	Read basic properties of cross-tenant access policy for partners
`microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/standard/read`	Read basic properties of cross tenant sync policy templates for multi-tenant organization
`microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/standard/read`	Read basic properties of cross tenant access policy templates for multi-tenant organization
`microsoft.directory/crossTenantAccessPolicy/standard/read`	Read basic properties of cross-tenant access policy
`microsoft.directory/customAuthenticationExtensions/allProperties/read`	Read custom authentication extensions
`microsoft.directory/deviceLocalCredentials/standard/read`	Read all properties of the backed up local administrator account credentials for Microsoft Entra joined devices, except the password
`microsoft.directory/deviceManagementPolicies/standard/read`	Read standard properties on mobile device management and mobile app management policies
`microsoft.directory/deviceRegistrationPolicy/standard/read`	Read standard properties on device registration policies
`microsoft.directory/devices/allProperties/read`	Read all properties of devices
`microsoft.directory/directoryRoles/allProperties/read`	Read all properties of directory roles
`microsoft.directory/directoryRoleTemplates/allProperties/read`	Read all properties of directory role templates
`microsoft.directory/domains/allProperties/read`	Read all properties of domains
`microsoft.directory/domains/federationConfiguration/standard/read`	Read standard properties of federation configuration for domains
`microsoft.directory/entitlementManagement/allProperties/read`	Read all properties in Microsoft Entra entitlement management
`microsoft.directory/externalUserProfiles/standard/read`	Read standard properties of external user profiles in the extended directory for Teams
`microsoft.directory/groups/allProperties/read`	Read all properties (including privileged properties) on Security groups and Microsoft 365 groups, including role-assignable groups
`microsoft.directory/groupSettings/allProperties/read`	Read all properties of group settings
`microsoft.directory/groupSettingTemplates/allProperties/read`	Read all properties of group setting templates
`microsoft.directory/identityProtection/allProperties/read`	Read all resources in Microsoft Entra ID Protection
`microsoft.directory/lifecycleWorkflows/workflows/allProperties/read`	Read all properties of lifecycle workflows and tasks in Microsoft Entra ID
`microsoft.directory/loginOrganizationBranding/allProperties/read`	Read all properties for your organization's branded sign-in page
`microsoft.directory/multiTenantOrganization/joinRequest/standard/read`	Read properties of a multi-tenant organization join request
`microsoft.directory/multiTenantOrganization/standard/read`	Read basic properties of a multi-tenant organization
`microsoft.directory/multiTenantOrganization/tenants/organizationDetails/read`	Read organization details of a tenant participating in a multi-tenant organization
`microsoft.directory/multiTenantOrganization/tenants/standard/read`	Read basic properties of a tenant participating in a multi-tenant organization
`microsoft.directory/namedLocations/standard/read`	Read basic properties of custom rules that define network locations
`microsoft.directory/oAuth2PermissionGrants/allProperties/read`	Read all properties of OAuth 2.0 permission grants
`microsoft.directory/onPremisesSynchronization/standard/read`	Read standard on-premises directory synchronization information
`microsoft.directory/organization/allProperties/read`	Read all properties for an organization
`microsoft.directory/pendingExternalUserProfiles/standard/read`	Read standard properties of external user profiles in the extended directory for Teams
`microsoft.directory/permissionGrantPolicies/standard/read`	Read standard properties of permission grant policies
`microsoft.directory/policies/allProperties/read`	Read all properties of policies
`microsoft.directory/privilegedIdentityManagement/allProperties/read`	Read all resources in Privileged Identity Management
`microsoft.directory/provisioningLogs/allProperties/read`	Read all properties of provisioning logs
`microsoft.directory/roleAssignments/allProperties/read`	Read all properties of role assignments
`microsoft.directory/roleDefinitions/allProperties/read`	Read all properties of role definitions
`microsoft.directory/scopedRoleMemberships/allProperties/read`	View members in administrative units
`microsoft.directory/serviceAction/getAvailableExtentionProperties`	Can perform the getAvailableExtentionProperties service action
`microsoft.directory/servicePrincipalCreationPolicies/standard/read`	Read standard properties of service principal creation policies
`microsoft.directory/servicePrincipals/allProperties/read`	Read all properties (including privileged properties) on servicePrincipals
`microsoft.directory/servicePrincipals/synchronization/standard/read`	Read provisioning settings associated with your service principal
`microsoft.directory/signInReports/allProperties/read`	Read all properties on sign-in reports, including privileged properties
`microsoft.directory/subscribedSkus/allProperties/read`	Read all properties of product subscriptions
`microsoft.directory/users/allProperties/read`	Read all properties of users
`microsoft.directory/users/authenticationMethods/standard/restrictedRead`	Read standard properties of authentication methods that do not include personally identifiable information for users
`microsoft.directory/verifiableCredentials/configuration/allProperties/read`	Read configuration required to create and manage verifiable credentials
`microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/read`	Read a verifiable credential contract
`microsoft.directory/verifiableCredentials/configuration/contracts/cards/allProperties/read`	Read a verifiable credential card
`microsoft.edge/allEntities/allProperties/read`	Read all aspects of Microsoft Edge
`microsoft.graph.dataConnect/allEntities/allProperties/read`	Read aspects of Microsoft Graph Data Connect
`microsoft.hardware.support/shippingAddress/allProperties/read`	Read shipping addresses for Microsoft hardware warranty claims, including existing shipping addresses created by others
`microsoft.hardware.support/shippingStatus/allProperties/read`	Read shipping status for open Microsoft hardware warranty claims
`microsoft.hardware.support/warrantyClaims/allProperties/read`	Read Microsoft hardware warranty claims
`microsoft.healthPlatform/allEntities/allProperties/read`	Read all aspects of Microsoft Dragon admin center
`microsoft.insights/allEntities/allProperties/read`	Read all aspects of Viva Insights
`microsoft.microsoft365.organizationalData/allEntities/allProperties/read`	Read all aspects of organizational data in Microsoft 365
`microsoft.networkAccess/allEntities/allProperties/read`	Read all aspects of Microsoft Entra Network Access
`microsoft.office365.copilot/allEntities/allProperties/read`	Read all settings for Microsoft Copilot
`microsoft.office365.fileStorageContainers/allEntities/allProperties/read`	Read entities and permissions of SharePoint Embedded containers
`microsoft.office365.messageCenter/messages/read`	Read messages in Message Center in the Microsoft 365 admin center, excluding security messages
`microsoft.office365.messageCenter/securityMessages/read`	Read security messages in Message Center in the Microsoft 365 admin center
`microsoft.office365.network/performance/allProperties/read`	Read all network performance properties in the Microsoft 365 admin center
`microsoft.office365.organizationalMessages/allEntities/allProperties/read`	Read all aspects of Microsoft 365 Organizational Messages
`microsoft.office365.protectionCenter/allEntities/allProperties/read`	Read all properties in the Security and Compliance centers
`microsoft.office365.securityComplianceCenter/allEntities/read`	Read standard properties in Microsoft 365 Security and Compliance Center
`microsoft.office365.serviceHealth/allEntities/allTasks`	Read and configure Service Health in the Microsoft 365 admin center
`microsoft.office365.usageReports/allEntities/allProperties/read`	Read Office 365 usage reports
`microsoft.office365.webPortal/allEntities/standard/read`	Read basic properties on all resources in the Microsoft 365 admin center
`microsoft.office365.yammer/allEntities/allProperties/read`	Read all aspects of Yammer
`microsoft.permissionsManagement/allEntities/allProperties/read`	Read all aspects of Microsoft Entra Permissions Management
`microsoft.teams/allEntities/allProperties/read`	Read all properties of Microsoft Teams
`microsoft.virtualVisits/allEntities/allProperties/read`	Read all aspects of Virtual Visits
`microsoft.viva.glint/allEntities/allProperties/read`	Read all Microsoft Viva Glint settings in the Microsoft 365 admin center
`microsoft.viva.goals/allEntities/allProperties/read`	Read all aspects of Microsoft Viva Goals
`microsoft.viva.pulse/allEntities/allProperties/read`	Read all aspects of Microsoft Viva Pulse
`microsoft.windows.updatesDeployments/allEntities/allProperties/read`	Read all aspects of Windows Update Service

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Global Reader for <reason>"
    RoleDefinitionId = "f2ef992c-3afb-46b9-b7cf-a126ee74c451"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq 'f2ef992c-3afb-46b9-b7cf-a126ee74c451'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Security Administrator · 81 permissions · privileged
Application Administrator · 73 permissions · privileged
AI Administrator · 70 permissions · privileged
Agent ID Administrator · 64 permissions · privileged
Cloud Application Administrator · 61 permissions · privileged
Hybrid Identity Administrator · 61 permissions · privileged
User Administrator · 56 permissions · privileged
Partner Tier2 Support · 46 permissions · privileged

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles