← All Roles

AI Reader

PrivilegedEnabled
Versionv11
Last Updated2026-07-20
Categorycollaboration,identity
Assignment Modeallowed
Built-inYes
Template ID1fe13547-53f6-408d-ac04-7f8eed167b38

Description

Read all aspects of Microsoft 365 Copilot and AI-related enterprise services in Microsoft 365.

Details

Assign the AI Reader role to users who need to do the following tasks:

  • Read all aspects of Microsoft 365 Copilot
  • Read AI-related enterprise services, extensibility, and copilot agents
  • Read information for directory objects including applications, users, groups, agent identities, agent identity blueprints, agent identity blueprint principals, and agent users
  • Read and configure Azure and Microsoft 365 service health dashboards

Directory Actions46

  • microsoft.azure.serviceHealth/allEntities/allTasks
  • microsoft.directory/adminConsentRequestPolicy/allProperties/read
  • microsoft.directory/administrativeUnits/members/read
  • microsoft.directory/administrativeUnits/standard/read
  • microsoft.directory/agentIdentities/allProperties/read
  • microsoft.directory/agentIdentityBlueprintPrincipals/allProperties/read
  • microsoft.directory/agentIdentityBlueprints/allProperties/read
  • microsoft.directory/agentUsers/lifeCycleInfo/read
  • microsoft.directory/applicationPolicies/standard/read
  • microsoft.directory/applications/owners/read
  • microsoft.directory/applications/policies/read
  • microsoft.directory/applications/standard/read
  • microsoft.directory/contacts/memberOf/read
  • microsoft.directory/contacts/standard/read
  • microsoft.directory/contracts/standard/read
  • microsoft.directory/domains/standard/read
  • microsoft.directory/entitlementManagement/allProperties/read
  • microsoft.directory/groups/appRoleAssignments/read
  • microsoft.directory/groupSettings/standard/read
  • microsoft.directory/groupSettingTemplates/standard/read
  • microsoft.directory/groups/memberOf/read
  • microsoft.directory/groups/members/read
  • microsoft.directory/groups/owners/read
  • microsoft.directory/groups/settings/read
  • microsoft.directory/groups/standard/read
  • microsoft.directory/oAuth2PermissionGrants/standard/read
  • microsoft.directory/organization/standard/read
  • microsoft.directory/organization/trustedCAsForPasswordlessAuth/read
  • microsoft.directory/roleAssignments/standard/read
  • microsoft.directory/roleDefinitions/standard/read
  • microsoft.directory/servicePrincipals/appRoleAssignedTo/read
  • microsoft.directory/servicePrincipals/appRoleAssignments/read
  • microsoft.directory/servicePrincipals/memberOf/read
  • microsoft.directory/servicePrincipals/oAuth2PermissionGrants/read
  • microsoft.directory/servicePrincipals/ownedObjects/read
  • microsoft.directory/servicePrincipals/owners/read
  • microsoft.directory/servicePrincipals/policies/read
  • microsoft.directory/servicePrincipals/standard/read
  • microsoft.directory/subscribedSkus/standard/read
  • microsoft.directory/users/allProperties/read
  • microsoft.office365.copilot/allEntities/allProperties/read
  • microsoft.office365.messageCenter/messages/read
  • microsoft.office365.network/performance/allProperties/read
  • microsoft.office365.serviceHealth/allEntities/allTasks
  • microsoft.office365.usageReports/allEntities/allProperties/read
  • microsoft.office365.webPortal/allEntities/standard/read

Graph API Permissions38

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

  • AdministrativeUnit.Read.All
  • AgentIdentity.Read.All
  • AgentIdentityBlueprint.Read.All
  • AgentIdentityBlueprintPrincipal.Read.All
  • AgentIdUser.ReadWrite.All
  • Application.Read.All
  • ChangeManagement.Read.All
  • ConsentRequest.Read.All
  • DelegatedPermissionGrant.Read.All
  • Directory.Read.All
  • Domain.Read.All
  • EntitlementManagement.Read.All
  • Group.Read.All
  • GroupMember.Read.All
  • GroupSettings.Read.All
  • LicenseAssignment.Read.All
  • NetworkAccess-Reports.Read.All
  • Organization.Read.All
  • OrgContact.Read.All
  • Policy.Read.All
  • Policy.Read.PermissionGrant
  • Reports.Read.All
  • ReportSettings.Read.All
  • RoleManagement.Read.All
  • RoleManagement.Read.Directory
  • ServiceActivity-Exchange.Read.All
  • ServiceActivity-Microsoft365Web.Read.All
  • ServiceActivity-OneDrive.Read.All
  • ServiceActivity-Teams.Read.All
  • ServiceHealth.Read.All
  • ServiceMessage.Read.All
  • ServiceMessageViewpoint.Write
  • ServicePrincipalEndpoint.Read.All
  • SignInIdentifier.Read.All
  • User-LifeCycleInfo.Read.All
  • User.Read.All
  • User.ReadBasic.All
  • UserAuthenticationMethod.Read.All