← All Roles

Directory Readers

Enabled
Versionv1
Date Added2026-06-21
CategoryreadOnly
Assignment Modeallowed
Built-inYes
Template ID88d8e3e3-8f55-4a1e-953a-9b9898b8876b

Description

Can read basic directory information. Commonly used to grant directory read access to applications and guests.

Details

Users in this role can read basic directory information. This role should be used for: 1. Granting a specific set of guest users read access instead of granting it to all guest users. 1. Granting a specific set of non-admin users access to the administration portal when "Restrict access to Microsoft Entra ID administration portal" is set to "Yes". 1. Granting service principals access to directory where Directory.Read.All is not an option.

Directory Actions55

  • microsoft.directory/administrativeUnits/members/read
  • microsoft.directory/administrativeUnits/standard/read
  • microsoft.directory/applicationPolicies/standard/read
  • microsoft.directory/applications/owners/read
  • microsoft.directory/applications/policies/read
  • microsoft.directory/applications/standard/read
  • microsoft.directory/contacts/memberOf/read
  • microsoft.directory/contacts/standard/read
  • microsoft.directory/contracts/standard/read
  • microsoft.directory/devices/memberOf/read
  • microsoft.directory/devices/registeredOwners/read
  • microsoft.directory/devices/registeredUsers/read
  • microsoft.directory/devices/standard/read
  • microsoft.directory/directoryRoles/eligibleMembers/read
  • microsoft.directory/directoryRoles/members/read
  • microsoft.directory/directoryRoles/standard/read
  • microsoft.directory/domains/standard/read
  • microsoft.directory/groups/appRoleAssignments/read
  • microsoft.directory/groupSettings/standard/read
  • microsoft.directory/groupSettingTemplates/standard/read
  • microsoft.directory/groups/memberOf/read
  • microsoft.directory/groups/members/read
  • microsoft.directory/groups/owners/read
  • microsoft.directory/groups/settings/read
  • microsoft.directory/groups/standard/read
  • microsoft.directory/oAuth2PermissionGrants/standard/read
  • microsoft.directory/organization/standard/read
  • microsoft.directory/organization/trustedCAsForPasswordlessAuth/read
  • microsoft.directory/roleAssignments/standard/read
  • microsoft.directory/roleDefinitions/standard/read
  • microsoft.directory/servicePrincipals/appRoleAssignedTo/read
  • microsoft.directory/servicePrincipals/appRoleAssignments/read
  • microsoft.directory/servicePrincipals/memberOf/read
  • microsoft.directory/servicePrincipals/oAuth2PermissionGrants/read
  • microsoft.directory/servicePrincipals/ownedObjects/read
  • microsoft.directory/servicePrincipals/owners/read
  • microsoft.directory/servicePrincipals/policies/read
  • microsoft.directory/servicePrincipals/standard/read
  • microsoft.directory/subscribedSkus/standard/read
  • microsoft.directory/users/appRoleAssignments/read
  • microsoft.directory/users/deviceForResourceAccount/read
  • microsoft.directory/users/directReports/read
  • microsoft.directory/users/invitedBy/read
  • microsoft.directory/users/licenseDetails/read
  • microsoft.directory/users/manager/read
  • microsoft.directory/users/memberOf/read
  • microsoft.directory/users/oAuth2PermissionGrants/read
  • microsoft.directory/users/ownedDevices/read
  • microsoft.directory/users/ownedObjects/read
  • microsoft.directory/users/photo/read
  • microsoft.directory/users/registeredDevices/read
  • microsoft.directory/users/scopedRoleMemberOf/read
  • microsoft.directory/users/sponsorOf/read
  • microsoft.directory/users/sponsors/read
  • microsoft.directory/users/standard/read

Graph API Permissions43

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

  • AdministrativeUnit.Read.All
  • Application.Read.All
  • DelegatedPermissionGrant.Read.All
  • Device.Read.All
  • DeviceLocalCredential.ReadBasic.All
  • DeviceTemplate.Read.All
  • Directory.Read.All
  • Domain.Read.All
  • Group.Read.All
  • GroupMember.Read.All
  • GroupSettings.Read.All
  • LicenseAssignment.Read.All
  • LicenseAssignment.ReadWrite.All
  • Organization.Read.All
  • OrgContact.Read.All
  • Policy.Read.All
  • Policy.Read.PermissionGrant
  • RoleManagement.Read.All
  • RoleManagement.Read.Directory
  • ServicePrincipalEndpoint.Read.All
  • SignInIdentifier.Read.All
  • SignInIdentifier.ReadWrite.All
  • User-ConvertToInternal.ReadWrite.All
  • User-LifeCycleInfo.Read.All
  • User-LifeCycleInfo.ReadWrite.All
  • User-Mail.ReadWrite.All
  • User-OnPremisesSyncBehavior.ReadWrite.All
  • User-PasswordProfile.ReadWrite.All
  • User.Create
  • User.DeleteRestore.All
  • User.EnableDisableAccount.All
  • User.Export.All
  • User.Invite.All
  • User.ManageIdentities.All
  • User.Read.All
  • User.ReadBasic.All
  • User.ReadWrite.All
  • User.RevokeSessions.All
  • UserAuthenticationMethod.Read.All
  • UserAuthenticationMethod.ReadWrite.All
  • UserAuthMethod-External.ReadWrite.All
  • UserAuthMethod-HardwareOATH.ReadWrite.All
  • UserAuthMethod-TAP.ReadWrite.All