Microsoft Entra built-in rolePublic reference
AI Reader
Read all aspects of Microsoft Copilot and AI-related enterprise services in Microsoft 365.
Compare this role or its retained definitions
Documented resource actions
45 documented actionsThese are Microsoft's documented resource actions, separate from Graph OAuth permissions and tenant assignments. Descriptions are shown as supplied in the reference.
| Action | Description |
|---|---|
| microsoft.azure.serviceHealth/allEntities/allTasks | Read and configure Azure Service Health |
| microsoft.directory/adminConsentRequestPolicy/allProperties/read | Read all properties of admin consent request policies in Microsoft Entra ID |
| microsoft.directory/administrativeUnits/members/read | Read members of administrative units |
| microsoft.directory/administrativeUnits/standard/read | Read basic properties on administrative units |
| microsoft.directory/agentIdentities/allProperties/read | Read all properties of agent identities |
| microsoft.directory/agentIdentityBlueprintPrincipals/allProperties/read | Read all properties of agent identity blueprint principals |
| microsoft.directory/agentIdentityBlueprints/allProperties/read | Read all properties of agent identity blueprints |
| microsoft.directory/agentUsers/lifeCycleInfo/read | Read lifecycle information of agent users, such as employeeLeaveDateTime |
| microsoft.directory/applicationPolicies/standard/read | Read standard properties of application policies |
| microsoft.directory/applications/owners/read | Read owners of applications |
| microsoft.directory/applications/policies/read | Read policies of applications |
| microsoft.directory/applications/standard/read | Read standard properties of applications |
| microsoft.directory/contacts/memberOf/read | Read the group membership for all contacts in Microsoft Entra ID |
| microsoft.directory/contacts/standard/read | Read basic properties on contacts in Microsoft Entra ID |
| microsoft.directory/contracts/standard/read | Read basic properties on partner contracts |
| microsoft.directory/domains/standard/read | Read basic properties on domains |
| microsoft.directory/entitlementManagement/allProperties/read | Read all properties in Microsoft Entra entitlement management |
| microsoft.directory/groupSettingTemplates/standard/read | Read basic properties on group setting templates |
| microsoft.directory/groupSettings/standard/read | Read basic properties on group settings |
| microsoft.directory/groups/appRoleAssignments/read | Read application role assignments of groups |
| microsoft.directory/groups/memberOf/read | Read the memberOf property on Security groups and Microsoft 365 groups, including role-assignable groups |
| microsoft.directory/groups/members/read | Read members of Security groups and Microsoft 365 groups, including role-assignable groups |
| microsoft.directory/groups/owners/read | Read owners of Security groups and Microsoft 365 groups, including role-assignable groups |
| microsoft.directory/groups/settings/read | Read settings of groups |
| microsoft.directory/groups/standard/read | Read standard properties of Security groups and Microsoft 365 groups, including role-assignable groups |
| microsoft.directory/oAuth2PermissionGrants/standard/read | Read basic properties on OAuth 2.0 permission grants |
| microsoft.directory/organization/standard/read | Read basic properties on an organization |
| microsoft.directory/organization/trustedCAsForPasswordlessAuth/read | Read trusted certificate authorities for passwordless authentication |
| microsoft.directory/roleAssignments/standard/read | Read basic properties on role assignments |
| microsoft.directory/roleDefinitions/standard/read | Read basic properties on role definitions |
| microsoft.directory/servicePrincipals/appRoleAssignedTo/read | Read service principal role assignments |
| microsoft.directory/servicePrincipals/appRoleAssignments/read | Read role assignments assigned to service principals |
| microsoft.directory/servicePrincipals/memberOf/read | Read the group memberships on service principals |
| microsoft.directory/servicePrincipals/oAuth2PermissionGrants/read | Read delegated permission grants on service principals |
| microsoft.directory/servicePrincipals/ownedObjects/read | Read owned objects of service principals |
| microsoft.directory/servicePrincipals/owners/read | Read owners of service principals |
| microsoft.directory/servicePrincipals/policies/read | Read policies of service principals |
| microsoft.directory/servicePrincipals/standard/read | Read basic properties of service principals |
| microsoft.directory/subscribedSkus/standard/read | Read basic properties on subscriptions |
| microsoft.directory/users/allProperties/read | Read all properties of users |
| microsoft.office365.copilot/allEntities/allProperties/read | Read all settings for Microsoft Copilot |
| microsoft.office365.messageCenter/messages/read | Read messages in Message Center in the Microsoft 365 admin center, excluding security messages |
| microsoft.office365.network/performance/allProperties/read | Read all network performance properties in the Microsoft 365 admin center |
| microsoft.office365.serviceHealth/allEntities/allTasks | Read and configure Service Health in the Microsoft 365 admin center |
| microsoft.office365.webPortal/allEntities/standard/read | Read basic properties on all resources in the Microsoft 365 admin center |