Restricted Guest User | MS Admin Roles

← All Roles

Versionv1

Date Added2026-06-21

Categoryidentity

Assignment ModesystemAssigned

Built-inYes

Template ID2af84b1e-32c8-42b7-82bc-daa82404023b

Description

Restricted role for guest users. Can read a limited set of directory information.

Directory Actions38

Action	Condition
`microsoft.directory/applications/owners/limitedRead`	`null`
`microsoft.directory/applications/policies/limitedRead`	`null`
`microsoft.directory/applications/standard/limitedRead`	`null`
`microsoft.directory/directoryRoleTemplates/allProperties/read`	`null`
`microsoft.directory/domains/standard/read`	`null`
`microsoft.directory/organization/basicProfile/read`	`null`
`microsoft.directory/servicePrincipals/appRoleAssignedTo/limitedRead`	`null`
`microsoft.directory/servicePrincipals/appRoleAssignments/limitedRead`	`null`
`microsoft.directory/servicePrincipals/memberOf/limitedRead`	`null`
`microsoft.directory/servicePrincipals/oAuth2PermissionGrants/limitedRead`	`null`
`microsoft.directory/servicePrincipals/ownedObjects/limitedRead`	`null`
`microsoft.directory/servicePrincipals/owners/limitedRead`	`null`
`microsoft.directory/servicePrincipals/policies/limitedRead`	`null`
`microsoft.directory/servicePrincipals/standard/limitedRead`	`null`
`microsoft.directory/users/appRoleAssignments/read`	`$ResourceIsSelf`
`microsoft.directory/users/authenticationMethods/basic/update`	`$ResourceIsSelf`
`microsoft.directory/users/authenticationMethods/create`	`$ResourceIsSelf`
`microsoft.directory/users/authenticationMethods/delete`	`$ResourceIsSelf`
`microsoft.directory/users/authenticationMethods/standard/read`	`$ResourceIsSelf`
`microsoft.directory/users/authenticationMethods/standard/restrictedRead`	`$ResourceIsSelf`
`microsoft.directory/users/deviceForResourceAccount/read`	`$ResourceIsSelf`
`microsoft.directory/users/directReports/read`	`$ResourceIsSelf`
`microsoft.directory/users/eligibleMemberOf/read`	`$ResourceIsSelf`
`microsoft.directory/users/invitedBy/read`	`$ResourceIsSelf`
`microsoft.directory/users/licenseDetails/read`	`$ResourceIsSelf`
`microsoft.directory/users/manager/read`	`$ResourceIsSelf`
`microsoft.directory/users/memberOf/read`	`$ResourceIsSelf`
`microsoft.directory/users/oAuth2PermissionGrants/read`	`$ResourceIsSelf`
`microsoft.directory/users/ownedDevices/read`	`$ResourceIsSelf`
`microsoft.directory/users/ownedObjects/read`	`$ResourceIsSelf`
`microsoft.directory/users/password/update`	`$ResourceIsSelf`
`microsoft.directory/users/pendingMemberOf/read`	`$ResourceIsSelf`
`microsoft.directory/users/photo/read`	`$ResourceIsSelf`
`microsoft.directory/users/registeredDevices/read`	`$ResourceIsSelf`
`microsoft.directory/users/scopedRoleMemberOf/read`	`$ResourceIsSelf`
`microsoft.directory/users/sponsorOf/read`	`$ResourceIsSelf`
`microsoft.directory/users/sponsors/read`	`$ResourceIsSelf`
`microsoft.directory/users/standard/read`	`$ResourceIsSelf`

Graph API Permissions31

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

Application.Read.All
Directory.Read.All
Domain.Read.All
LicenseAssignment.Read.All
LicenseAssignment.ReadWrite.All
Organization.Read.All
RoleManagement.Read.Directory
ServicePrincipalEndpoint.Read.All
SignInIdentifier.Read.All
SignInIdentifier.ReadWrite.All
User-ConvertToInternal.ReadWrite.All
User-LifeCycleInfo.Read.All
User-LifeCycleInfo.ReadWrite.All
User-Mail.ReadWrite.All
User-OnPremisesSyncBehavior.ReadWrite.All
User-PasswordProfile.ReadWrite.All
User.Create
User.DeleteRestore.All
User.EnableDisableAccount.All
User.Export.All
User.Invite.All
User.ManageIdentities.All
User.Read.All
User.ReadBasic.All
User.ReadWrite.All
User.RevokeSessions.All
UserAuthenticationMethod.Read.All
UserAuthenticationMethod.ReadWrite.All
UserAuthMethod-External.ReadWrite.All
UserAuthMethod-HardwareOATH.ReadWrite.All
UserAuthMethod-TAP.ReadWrite.All

ShareLinkedIn X Reddit Facebook WhatsApp