← All Roles

Global Reader

PrivilegedEnabled
Versionv4
Last Updated2026-06-27
CategoryreadOnly
Assignment Modeallowed
Built-inYes
Template IDf2ef992c-3afb-46b9-b7cf-a126ee74c451

Description

Can read everything that a Global Administrator can, but not update anything.

Details

Users with this role can read everything that a Global Administrator can, but not update anything.

Directory Actions103

ActionCondition
microsoft.agentRegistry/allEntities/allProperties/readnull
microsoft.azure.serviceHealth/allEntities/allTasksnull
microsoft.backup/allEntities/allProperties/readnull
microsoft.cloudPC/allEntities/allProperties/readnull
microsoft.commerce.billing/allEntities/allProperties/readnull
microsoft.commerce.billing/purchases/standard/readnull
microsoft.directory/accessReviews/allProperties/readnull
microsoft.directory/accessReviews/definitions/allProperties/readnull
microsoft.directory/adminConsentRequestPolicy/allProperties/readnull
microsoft.directory/administrativeUnits/allProperties/readnull
microsoft.directory/agentIdentities/allProperties/readnull
microsoft.directory/agentIdentityBlueprintPrincipals/allProperties/readnull
microsoft.directory/agentIdentityBlueprints/allProperties/readnull
microsoft.directory/appConsent/appConsentRequests/allProperties/readnull
microsoft.directory/applications/allProperties/readnull
microsoft.directory/applications/synchronization/standard/readnull
microsoft.directory/auditLogs/allProperties/readnull
microsoft.directory/authorizationPolicy/standard/readnull
microsoft.directory/bitlockerKeys/key/readnull
microsoft.directory/bulkJobs/standard/readnull
microsoft.directory/cloudAppSecurity/allProperties/readnull
microsoft.directory/conditionalAccessPolicies/allProperties/readnull
microsoft.directory/connectorGroups/allProperties/readnull
microsoft.directory/connectors/allProperties/readnull
microsoft.directory/contacts/allProperties/readnull
microsoft.directory/crossTenantAccessPolicy/default/standard/readnull
microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/standard/readnull
microsoft.directory/crossTenantAccessPolicy/partners/standard/readnull
microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/standard/readnull
microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/standard/readnull
microsoft.directory/crossTenantAccessPolicy/standard/readnull
microsoft.directory/customAuthenticationExtensions/allProperties/readnull
microsoft.directory/deviceLocalCredentials/standard/readnull
microsoft.directory/deviceManagementPolicies/standard/readnull
microsoft.directory/deviceRegistrationPolicy/standard/readnull
microsoft.directory/devices/allProperties/readnull
microsoft.directory/directoryRoles/allProperties/readnull
microsoft.directory/directoryRoleTemplates/allProperties/readnull
microsoft.directory/domains/allProperties/readnull
microsoft.directory/domains/federationConfiguration/standard/readnull
microsoft.directory/entitlementManagement/allProperties/readnull
microsoft.directory/externalUserProfiles/standard/readnull
microsoft.directory/groups/allProperties/readnull
microsoft.directory/groupSettings/allProperties/readnull
microsoft.directory/groupSettingTemplates/allProperties/readnull
microsoft.directory/identityProtection/allProperties/readnull
microsoft.directory/lifecycleWorkflows/workflows/allProperties/readnull
microsoft.directory/loginOrganizationBranding/allProperties/readnull
microsoft.directory/multiTenantOrganization/joinRequest/standard/readnull
microsoft.directory/multiTenantOrganization/standard/readnull
microsoft.directory/multiTenantOrganization/tenants/organizationDetails/readnull
microsoft.directory/multiTenantOrganization/tenants/standard/readnull
microsoft.directory/namedLocations/standard/readnull
microsoft.directory/oAuth2PermissionGrants/allProperties/readnull
microsoft.directory/onPremisesSynchronization/standard/readnull
microsoft.directory/organization/allProperties/readnull
microsoft.directory/pendingExternalUserProfiles/standard/readnull
microsoft.directory/permissionGrantPolicies/standard/readnull
microsoft.directory/policies/allProperties/readnull
microsoft.directory/privilegedIdentityManagement/allProperties/readnull
microsoft.directory/provisioningLogs/allProperties/readnull
microsoft.directory/roleAssignments/allProperties/readnull
microsoft.directory/roleDefinitions/allProperties/readnull
microsoft.directory/scopedRoleMemberships/allProperties/readnull
microsoft.directory/serviceAction/getAvailableExtentionPropertiesnull
microsoft.directory/servicePrincipalCreationPolicies/standard/readnull
microsoft.directory/servicePrincipals/allProperties/readnull
microsoft.directory/servicePrincipals/synchronization/standard/readnull
microsoft.directory/signInReports/allProperties/readnull
microsoft.directory/subscribedSkus/allProperties/readnull
microsoft.directory/users/allProperties/readnull
microsoft.directory/users/authenticationMethods/standard/restrictedReadnull
microsoft.directory/verifiableCredentials/configuration/allProperties/readnull
microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/readnull
microsoft.directory/verifiableCredentials/configuration/contracts/cards/allProperties/readnull
microsoft.edge/allEntities/allProperties/readnull
microsoft.graph.dataConnect/allEntities/allProperties/readnull
microsoft.hardware.support/shippingAddress/allProperties/readnull
microsoft.hardware.support/shippingStatus/allProperties/readnull
microsoft.hardware.support/warrantyClaims/allProperties/readnull
microsoft.healthPlatform/allEntities/allProperties/readnull
microsoft.insights/allEntities/allProperties/readnull
microsoft.microsoft365.organizationalData/allEntities/allProperties/readnull
microsoft.networkAccess/allEntities/allProperties/readnull
microsoft.office365.copilot/allEntities/allProperties/readnull
microsoft.office365.fileStorageContainers/allEntities/allProperties/readnull
microsoft.office365.messageCenter/messages/readnull
microsoft.office365.messageCenter/securityMessages/readnull
microsoft.office365.network/performance/allProperties/readnull
microsoft.office365.organizationalMessages/allEntities/allProperties/readnull
microsoft.office365.protectionCenter/allEntities/allProperties/readnull
microsoft.office365.securityComplianceCenter/allEntities/readnull
microsoft.office365.serviceHealth/allEntities/allTasksnull
microsoft.office365.usageReports/allEntities/allProperties/readnull
microsoft.office365.webPortal/allEntities/standard/readnull
microsoft.office365.yammer/allEntities/allProperties/readnull
microsoft.permissionsManagement/allEntities/allProperties/readnull
microsoft.teams/allEntities/allProperties/readnull
microsoft.virtualVisits/allEntities/allProperties/readnull
microsoft.viva.glint/allEntities/allProperties/readnull
microsoft.viva.goals/allEntities/allProperties/readnull
microsoft.viva.pulse/allEntities/allProperties/readnull
microsoft.windows.updatesDeployments/allEntities/allProperties/readnull

Graph API Permissions141

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

  • AccessReview.Read.All
  • AdministrativeUnit.Read.All
  • AgentCard.Read.All
  • AgentCardManifest.Read.All
  • AgentCollection.Read.All
  • AgentIdentity.Read.All
  • AgentIdentityBlueprint.Read.All
  • AgentIdentityBlueprintPrincipal.Read.All
  • AgentInstance.Read.All
  • AgentRegistration.Read.All
  • Application.Read.All
  • AttackSimulation.Read.All
  • AuditLog.Read.All
  • AuditLogsQuery-Entra.Read.All
  • AuditLogsQuery.Read.All
  • BackupRestore-Monitor.Read.All
  • BackupRestore-Restore.Read.All
  • BitlockerKey.ReadBasic.All
  • Bookings.Read.All
  • ChangeManagement.Read.All
  • Channel.ReadBasic.All
  • ChannelMember.Read.All
  • ChannelMessage.Read.All
  • ChannelSettings.Read.All
  • CloudApp-Discovery.Read.All
  • CloudPC.Read.All
  • ConsentRequest.Read.All
  • ContentActivity.Read
  • CrossTenantInformation.ReadBasic.All
  • CustomAuthenticationExtension.Read.All
  • CustomDetection.Read.All
  • DelegatedPermissionGrant.Read.All
  • Device.Read.All
  • DeviceLocalCredential.ReadBasic.All
  • DeviceManagementConfiguration.Read.All
  • DeviceTemplate.Read.All
  • Directory.Read.All
  • Domain.Read.All
  • eDiscovery.Read.All
  • EntitlementManagement.Read.All
  • EntraBackup.Read.All
  • ExternalUserProfile.Read.All
  • FileStorageContainer.Selected
  • Group.Read.All
  • GroupMember.Read.All
  • GroupSettings.Read.All
  • HealthMonitoringAlert.Read.All
  • HealthMonitoringAlertConfig.Read.All
  • IdentityRiskEvent.Read.All
  • IdentityRiskyAgent.Read.All
  • IdentityRiskyServicePrincipal.Read.All
  • IdentityRiskyUser.Read.All
  • IndustryData-DataConnector.Read.All
  • IndustryData-InboundFlow.Read.All
  • IndustryData-OutboundFlow.Read.All
  • IndustryData-ReferenceDefinition.Read.All
  • IndustryData-SourceSystem.Read.All
  • IndustryData.ReadBasic.All
  • LicenseAssignment.Read.All
  • LifecycleWorkflows-CustomExt.Read.All
  • LifecycleWorkflows-Reports.Read.All
  • LifecycleWorkflows-Workflow.Read.All
  • LifecycleWorkflows-Workflow.ReadBasic.All
  • LifecycleWorkflows.Read.All
  • MultiTenantOrganization.Read.All
  • MultiTenantOrganization.ReadBasic.All
  • NetworkAccess-Reports.Read.All
  • NetworkAccess.Read.All
  • NetworkAccessBranch.Read.All
  • NetworkAccessPolicy.Read.All
  • OnlineMeetingArtifact.Read.All
  • OnPremDirectorySynchronization.Read.All
  • Organization.Read.All
  • OrganizationalBranding.Read.All
  • OrgContact.Read.All
  • OrgSettings-Forms.Read.All
  • OrgSettings-Microsoft365Install.Read.All
  • OrgSettings-Todo.Read.All
  • PendingExternalUserProfile.Read.All
  • PeopleSettings.Read.All
  • Policy.Read.All
  • Policy.Read.AuthenticationMethod
  • Policy.Read.B2BManagementPolicy
  • Policy.Read.ConditionalAccess
  • Policy.Read.DeviceConfiguration
  • Policy.Read.IdentityProtection
  • Policy.Read.PermissionGrant
  • PrivilegedAccess-CustomExt.Read.All
  • PrivilegedAccess.Read.AzureAD
  • PrivilegedAccess.Read.AzureADGroup
  • PrivilegedAssignmentSchedule.Read.AzureADGroup
  • PrivilegedAssignmentSchedule.Read.EntraAppRole
  • PrivilegedEligibilitySchedule.Read.AzureADGroup
  • PrivilegedEligibilitySchedule.Read.EntraAppRole
  • ProgramControl.Read.All
  • ProvisioningLog.Read.All
  • RecordsManagement.Read.All
  • Reports.Read.All
  • ReportSettings.Read.All
  • RiskPreventionProviders.Read.All
  • RoleManagement.Read.All
  • RoleManagement.Read.CloudPC
  • RoleManagement.Read.Directory
  • RoleManagementAlert.Read.Directory
  • RoleManagementPolicy.Read.AzureADGroup
  • RoleManagementPolicy.Read.Directory
  • RoleManagementPolicy.Read.EntraAppRole
  • Schedule.Read.All
  • SecurityAlert.Read.All
  • SecurityAnalyzedMessage.Read.All
  • SecurityEvents.Read.All
  • SecurityIncident.Read.All
  • SensitivityLabel.Read
  • SensitivityLabels.Read.All
  • ServiceActivity-Exchange.Read.All
  • ServiceActivity-Microsoft365Web.Read.All
  • ServiceActivity-OneDrive.Read.All
  • ServiceActivity-Teams.Read.All
  • ServiceHealth.Read.All
  • ServiceMessage.Read.All
  • ServiceMessageViewpoint.Write
  • ServicePrincipalEndpoint.Read.All
  • SignInIdentifier.Read.All
  • SubjectRightsRequest.Read.All
  • Team.ReadBasic.All
  • TeamMember.Read.All
  • TeamsActivity.Read
  • TeamSettings.Read.All
  • TeamsResourceAccount.Read.All
  • TeamsTab.Read.All
  • TeamsTelephoneNumber.Read.All
  • TeamsUserConfiguration.Read.All
  • ThreatHunting.Read.All
  • ThreatIntelligence.Read.All
  • ThreatSubmission.Read.All
  • User-LifeCycleInfo.Read.All
  • User.Read.All
  • User.ReadBasic.All
  • UserAuthenticationMethod.Read.All
  • VerifiedId-Profile.Read.All
  • WindowsUpdates.Read.All