azureblog.co.uk
← cd ~/roles
// roles/entra

Tenant Governance Relationship ReaderMicrosoft Entra built-in role

Can read tenant governance relationships and relevant objects.

Role ID124577f8-48ed-456a-839f-13b419002e33
PrivilegedNo
Permissions6

What it can do

PermissionWhat it allows
microsoft.directory/tenantGovernance/invitations/standard/readRead tenant governance invitations
microsoft.directory/tenantGovernance/policyTemplates/standard/readRead tenant governance policy templates
microsoft.directory/tenantGovernance/relationships/standard/readRead tenant governance relationships
microsoft.directory/tenantGovernance/requests/standard/readRead tenant governance requests
microsoft.directory/tenantGovernance/settings/standard/readRead tenant governance settings
microsoft.office365.webPortal/allEntities/standard/readRead basic properties on all resources in the Microsoft 365 admin center

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines
Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Tenant Governance Relationship Reader for <reason>"
    RoleDefinitionId = "124577f8-48ed-456a-839f-13b419002e33"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines
Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '124577f8-48ed-456a-839f-13b419002e33'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Find the smallest role for a task →

Sources