// roles/entra · privileged

Security ReaderMicrosoft Entra built-in role

Can read security information and reports in Microsoft Entra ID and Office 365.

Role ID	`5d6b6bb7-de71-4623-b4af-96380a352509`
Privileged	Yes. Microsoft marks this role as privileged.
Permissions	33

Before you assign it

Microsoft labels this a privileged role, so make it eligible through PIM rather than permanent, require phishing-resistant MFA to activate it, and review who has it regularly.

What it can do

Permission	What it allows
`microsoft.agentRegistry/allEntities/allProperties/read`	Read all properties of Agent Registry in Microsoft Entra ID
`microsoft.azure.serviceHealth/allEntities/allTasks`	Read and configure Azure Service Health
`microsoft.directory/accessReviews/definitions/allProperties/read`	Read all properties of access reviews of all reviewable resources in Microsoft Entra ID
`microsoft.directory/auditLogs/allProperties/read`	Read all properties on audit logs, excluding custom security attributes audit logs
`microsoft.directory/authorizationPolicy/standard/read`	Read standard properties of authorization policy
`microsoft.directory/bitlockerKeys/key/read`	Read bitlocker metadata and key on devices
`microsoft.directory/conditionalAccessPolicies/owners/read`	Read the owners of Conditional Access policies
`microsoft.directory/conditionalAccessPolicies/policyAppliedTo/read`	Read the "applied to" property for Conditional Access policies
`microsoft.directory/conditionalAccessPolicies/standard/read`	Read Conditional Access for policies
`microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/standard/read`	Read basic properties of cross tenant sync policy templates for multi-tenant organization
`microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/standard/read`	Read basic properties of cross tenant access policy templates for multi-tenant organization
`microsoft.directory/deviceLocalCredentials/standard/read`	Read all properties of the backed up local administrator account credentials for Microsoft Entra joined devices, except the password
`microsoft.directory/domains/federationConfiguration/standard/read`	Read standard properties of federation configuration for domains
`microsoft.directory/entitlementManagement/allProperties/read`	Read all properties in Microsoft Entra entitlement management
`microsoft.directory/identityProtection/allProperties/read`	Read all resources in Microsoft Entra ID Protection
`microsoft.directory/multiTenantOrganization/joinRequest/standard/read`	Read properties of a multi-tenant organization join request
`microsoft.directory/multiTenantOrganization/standard/read`	Read basic properties of a multi-tenant organization
`microsoft.directory/multiTenantOrganization/tenants/organizationDetails/read`	Read organization details of a tenant participating in a multi-tenant organization
`microsoft.directory/multiTenantOrganization/tenants/standard/read`	Read basic properties of a tenant participating in a multi-tenant organization
`microsoft.directory/namedLocations/standard/read`	Read basic properties of custom rules that define network locations
`microsoft.directory/policies/owners/read`	Read owners of policies
`microsoft.directory/policies/policyAppliedTo/read`	Read policies.policyAppliedTo property
`microsoft.directory/policies/standard/read`	Read basic properties on policies
`microsoft.directory/privilegedIdentityManagement/allProperties/read`	Read all resources in Privileged Identity Management
`microsoft.directory/provisioningLogs/allProperties/read`	Read all properties of provisioning logs
`microsoft.directory/signInReports/allProperties/read`	Read all properties on sign-in reports, including privileged properties
`microsoft.networkAccess/allEntities/allProperties/read`	Read all aspects of Microsoft Entra Network Access
`microsoft.office365.protectionCenter/allEntities/standard/read`	Read standard properties of all resources in the Security and Compliance centers
`microsoft.office365.protectionCenter/attackSimulator/payload/allProperties/read`	Read all properties of attack payloads in Attack Simulator
`microsoft.office365.protectionCenter/attackSimulator/reports/allProperties/read`	Read reports of attack simulation, responses, and associated training
`microsoft.office365.protectionCenter/attackSimulator/simulation/allProperties/read`	Read all properties of attack simulation templates in Attack Simulator
`microsoft.office365.serviceHealth/allEntities/allTasks`	Read and configure Service Health in the Microsoft 365 admin center
`microsoft.office365.webPortal/allEntities/standard/read`	Read basic properties on all resources in the Microsoft 365 admin center

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Security Reader for <reason>"
    RoleDefinitionId = "5d6b6bb7-de71-4623-b4af-96380a352509"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '5d6b6bb7-de71-4623-b4af-96380a352509'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Intune Administrator · 38 permissions · privileged
Privileged Role Administrator · 28 permissions · privileged
Partner Tier1 Support · 40 permissions · privileged
Directory Writers · 42 permissions · privileged
Tenant Governance Administrator · 24 permissions · privileged
AI Reader · 45 permissions · privileged
Partner Tier2 Support · 46 permissions · privileged
Privileged Authentication Administrator · 20 permissions · privileged

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles