azureblog.co.uk
← cd ~/roles
// roles/entra

Global Secure Access Log ReaderMicrosoft Entra built-in role

Provides designated security personnel with read-only access to network traffic logs in Microsoft Entra Internet Access and Microsoft Entra Private Access for detailed analysis.

Role ID843318fb-79a6-4168-9e6f-aa9a07481cc4
PrivilegedNo
Permissions1

What it can do

PermissionWhat it allows
microsoft.networkAccess/trafficLogs/standard/readRead standard properties of traffic logs such as DeviceId, DestinationIp and PolicyRuleId

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines
Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Global Secure Access Log Reader for <reason>"
    RoleDefinitionId = "843318fb-79a6-4168-9e6f-aa9a07481cc4"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines
Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '843318fb-79a6-4168-9e6f-aa9a07481cc4'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Find the smallest role for a task →

Sources