// roles/entra

Guest InviterMicrosoft Entra built-in role

Can invite guest users independent of the 'members can invite guests' setting.

Role ID	`95e79109-95c0-4d8e-aee3-d01accf2d47b`
Privileged	No
Permissions	17

What it can do

Permission	What it allows
`microsoft.directory/users/appRoleAssignments/read`	Read application role assignments for users
`microsoft.directory/users/deviceForResourceAccount/read`	Read deviceForResourceAccount of users
`microsoft.directory/users/directReports/read`	Read the direct reports for users
`microsoft.directory/users/invitedBy/read`	Read the user that invited an external user to a tenant
`microsoft.directory/users/inviteGuest`	Invite guest users
`microsoft.directory/users/licenseDetails/read`	Read license details of users
`microsoft.directory/users/manager/read`	Read manager of users
`microsoft.directory/users/memberOf/read`	Read the group memberships of users
`microsoft.directory/users/oAuth2PermissionGrants/read`	Read delegated permission grants on users
`microsoft.directory/users/ownedDevices/read`	Read owned devices of users
`microsoft.directory/users/ownedObjects/read`	Read owned objects of users
`microsoft.directory/users/photo/read`	Read photo of users
`microsoft.directory/users/registeredDevices/read`	Read registered devices of users
`microsoft.directory/users/scopedRoleMemberOf/read`	Read user's membership of a Microsoft Entra role, that is scoped to an administrative unit
`microsoft.directory/users/sponsorOf/read`	Read all the agents or applications the user is sponsor of
`microsoft.directory/users/sponsors/read`	Read sponsors of users
`microsoft.directory/users/standard/read`	Read basic properties on users

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Guest Inviter for <reason>"
    RoleDefinitionId = "95e79109-95c0-4d8e-aee3-d01accf2d47b"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '95e79109-95c0-4d8e-aee3-d01accf2d47b'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

SharePoint Backup Administrator · 17 permissions
Authentication Policy Administrator · 19 permissions
Yammer Administrator · 15 permissions
Global Secure Access Administrator · 20 permissions
Knowledge Administrator · 13 permissions
Tenant Governance Relationship Administrator · 13 permissions
Exchange Backup Administrator · 12 permissions
Knowledge Manager · 11 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles