Restricted Guest User

Description

Restricted role for guest users. Can read a limited set of directory information.

Directory Actions38

• microsoft.directory/applications/owners/limitedRead
• microsoft.directory/applications/policies/limitedRead
• microsoft.directory/applications/standard/limitedRead
• microsoft.directory/directoryRoleTemplates/allProperties/read
• microsoft.directory/domains/standard/read
• microsoft.directory/organization/basicProfile/read
• microsoft.directory/servicePrincipals/appRoleAssignedTo/limitedRead
• microsoft.directory/servicePrincipals/appRoleAssignments/limitedRead
• microsoft.directory/servicePrincipals/memberOf/limitedRead
• microsoft.directory/servicePrincipals/oAuth2PermissionGrants/limitedRead
• microsoft.directory/servicePrincipals/ownedObjects/limitedRead
• microsoft.directory/servicePrincipals/owners/limitedRead
• microsoft.directory/servicePrincipals/policies/limitedRead
• microsoft.directory/servicePrincipals/standard/limitedRead
• microsoft.directory/users/appRoleAssignments/read
• microsoft.directory/users/authenticationMethods/basic/update
• microsoft.directory/users/authenticationMethods/create
• microsoft.directory/users/authenticationMethods/delete
• microsoft.directory/users/authenticationMethods/standard/read
• microsoft.directory/users/authenticationMethods/standard/restrictedRead
• microsoft.directory/users/deviceForResourceAccount/read
• microsoft.directory/users/directReports/read
• microsoft.directory/users/eligibleMemberOf/read
• microsoft.directory/users/invitedBy/read
• microsoft.directory/users/licenseDetails/read
• microsoft.directory/users/manager/read
• microsoft.directory/users/memberOf/read
• microsoft.directory/users/oAuth2PermissionGrants/read
• microsoft.directory/users/ownedDevices/read
• microsoft.directory/users/ownedObjects/read
• microsoft.directory/users/password/update
• microsoft.directory/users/pendingMemberOf/read
• microsoft.directory/users/photo/read
• microsoft.directory/users/registeredDevices/read
• microsoft.directory/users/scopedRoleMemberOf/read
• microsoft.directory/users/sponsorOf/read
• microsoft.directory/users/sponsors/read
• microsoft.directory/users/standard/read

Graph API Permissions31

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

• Application.Read.All
• Directory.Read.All
• Domain.Read.All
• LicenseAssignment.Read.All
• LicenseAssignment.ReadWrite.All
• Organization.Read.All
• RoleManagement.Read.Directory
• ServicePrincipalEndpoint.Read.All
• SignInIdentifier.Read.All
• SignInIdentifier.ReadWrite.All
• User-ConvertToInternal.ReadWrite.All
• User-LifeCycleInfo.Read.All
• User-LifeCycleInfo.ReadWrite.All
• User-Mail.ReadWrite.All
• User-OnPremisesSyncBehavior.ReadWrite.All
• User-PasswordProfile.ReadWrite.All
• User.Create
• User.DeleteRestore.All
• User.EnableDisableAccount.All
• User.Export.All
• User.Invite.All
• User.ManageIdentities.All
• User.Read.All
• User.ReadBasic.All
• User.ReadWrite.All
• User.RevokeSessions.All
• UserAuthenticationMethod.Read.All
• UserAuthenticationMethod.ReadWrite.All
• UserAuthMethod-External.ReadWrite.All
• UserAuthMethod-HardwareOATH.ReadWrite.All
• UserAuthMethod-TAP.ReadWrite.All