← All Roles

Guest User

Enabled
Versionv1
Date Added2026-06-21
Categoryidentity
Assignment ModesystemAssigned
Built-inYes
Template ID10dae51f-b6af-4016-8d66-8c2a99b929b3

Description

Default role for guest users. Can read a limited set of directory information.

Directory Actions48

  • microsoft.directory/applications/owners/limitedRead
  • microsoft.directory/applications/policies/limitedRead
  • microsoft.directory/applications/standard/limitedRead
  • microsoft.directory/directoryRoleTemplates/allProperties/read
  • microsoft.directory/domains/standard/read
  • microsoft.directory/groups/appRoleAssignments/limitedRead
  • microsoft.directory/groups/memberOf/limitedRead
  • microsoft.directory/groups/members/limitedRead
  • microsoft.directory/groups/owners/limitedRead
  • microsoft.directory/groups/settings/limitedRead
  • microsoft.directory/groups/standard/limitedRead
  • microsoft.directory/multiTenantOrganization/standard/read
  • microsoft.directory/multiTenantOrganization/tenants/standard/read
  • microsoft.directory/organization/basicProfile/read
  • microsoft.directory/servicePrincipals/appRoleAssignedTo/limitedRead
  • microsoft.directory/servicePrincipals/appRoleAssignments/limitedRead
  • microsoft.directory/servicePrincipals/memberOf/limitedRead
  • microsoft.directory/servicePrincipals/oAuth2PermissionGrants/limitedRead
  • microsoft.directory/servicePrincipals/ownedObjects/limitedRead
  • microsoft.directory/servicePrincipals/owners/limitedRead
  • microsoft.directory/servicePrincipals/policies/limitedRead
  • microsoft.directory/servicePrincipals/standard/limitedRead
  • microsoft.directory/users/guestBasicProfile/limitedRead
  • microsoft.directory/users/inviteGuest
  • microsoft.directory/users/appRoleAssignments/read
  • microsoft.directory/users/authenticationMethods/basic/update
  • microsoft.directory/users/authenticationMethods/create
  • microsoft.directory/users/authenticationMethods/delete
  • microsoft.directory/users/authenticationMethods/standard/read
  • microsoft.directory/users/authenticationMethods/standard/restrictedRead
  • microsoft.directory/users/deviceForResourceAccount/read
  • microsoft.directory/users/directReports/read
  • microsoft.directory/users/eligibleMemberOf/read
  • microsoft.directory/users/invitedBy/read
  • microsoft.directory/users/licenseDetails/read
  • microsoft.directory/users/manager/read
  • microsoft.directory/users/memberOf/read
  • microsoft.directory/users/oAuth2PermissionGrants/read
  • microsoft.directory/users/ownedDevices/read
  • microsoft.directory/users/ownedObjects/read
  • microsoft.directory/users/password/update
  • microsoft.directory/users/pendingMemberOf/read
  • microsoft.directory/users/photo/read
  • microsoft.directory/users/registeredDevices/read
  • microsoft.directory/users/scopedRoleMemberOf/read
  • microsoft.directory/users/sponsorOf/read
  • microsoft.directory/users/sponsors/read
  • microsoft.directory/users/standard/read

Graph API Permissions36

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

  • Application.Read.All
  • Directory.Read.All
  • Domain.Read.All
  • Group.Read.All
  • GroupMember.Read.All
  • GroupSettings.Read.All
  • LicenseAssignment.Read.All
  • LicenseAssignment.ReadWrite.All
  • MultiTenantOrganization.Read.All
  • MultiTenantOrganization.ReadBasic.All
  • Organization.Read.All
  • RoleManagement.Read.Directory
  • ServicePrincipalEndpoint.Read.All
  • SignInIdentifier.Read.All
  • SignInIdentifier.ReadWrite.All
  • User-ConvertToInternal.ReadWrite.All
  • User-LifeCycleInfo.Read.All
  • User-LifeCycleInfo.ReadWrite.All
  • User-Mail.ReadWrite.All
  • User-OnPremisesSyncBehavior.ReadWrite.All
  • User-PasswordProfile.ReadWrite.All
  • User.Create
  • User.DeleteRestore.All
  • User.EnableDisableAccount.All
  • User.Export.All
  • User.Invite.All
  • User.ManageIdentities.All
  • User.Read.All
  • User.ReadBasic.All
  • User.ReadWrite.All
  • User.RevokeSessions.All
  • UserAuthenticationMethod.Read.All
  • UserAuthenticationMethod.ReadWrite.All
  • UserAuthMethod-External.ReadWrite.All
  • UserAuthMethod-HardwareOATH.ReadWrite.All
  • UserAuthMethod-TAP.ReadWrite.All