Recorded 22 Oct 2026 at 18:59 UTC. This is what ChangeIntel recorded, including the title, summary, facts and links. It is not a statement of the source's current position. See the latest record.

Microsoft Entra roleMicrosoft Learn

Directory Readers

Can read basic directory information. Commonly used to grant directory read access to applications and guests.

Cite this recorded revision

What it said

Permission coverage: Documented resource actions
Action: microsoft.directory/administrativeUnits/members/read: Read members of administrative units
Action: microsoft.directory/administrativeUnits/standard/read: Read basic properties on administrative units
Action: microsoft.directory/applicationPolicies/standard/read: Read standard properties of application policies
Action: microsoft.directory/applications/owners/read: Read owners of applications
Action: microsoft.directory/applications/policies/read: Read policies of applications
Action: microsoft.directory/applications/standard/read: Read standard properties of applications
Action: microsoft.directory/contacts/memberOf/read: Read the group membership for all contacts in Microsoft Entra ID
Action: microsoft.directory/contacts/standard/read: Read basic properties on contacts in Microsoft Entra ID
Action: microsoft.directory/contracts/standard/read: Read basic properties on partner contracts
Action: microsoft.directory/devices/memberOf/read: Read device memberships
Action: microsoft.directory/devices/registeredOwners/read: Read registered owners of devices
Action: microsoft.directory/devices/registeredUsers/read: Read registered users of devices
Action: microsoft.directory/devices/standard/read: Read basic properties on devices
Action: microsoft.directory/directoryRoles/eligibleMembers/read: Read the eligible members of Microsoft Entra roles
Action: microsoft.directory/directoryRoles/members/read: Read all members of Microsoft Entra roles
Action: microsoft.directory/directoryRoles/standard/read: Read basic properties of Microsoft Entra roles
Action: microsoft.directory/domains/standard/read: Read basic properties on domains
Action: microsoft.directory/groupSettingTemplates/standard/read: Read basic properties on group setting templates
Action: microsoft.directory/groupSettings/standard/read: Read basic properties on group settings
Action: microsoft.directory/groups/appRoleAssignments/read: Read application role assignments of groups
Action: microsoft.directory/groups/memberOf/read: Read the memberOf property on Security groups and Microsoft 365 groups, including role-assignable groups
Action: microsoft.directory/groups/members/read: Read members of Security groups and Microsoft 365 groups, including role-assignable groups
Action: microsoft.directory/groups/owners/read: Read owners of Security groups and Microsoft 365 groups, including role-assignable groups
Action: microsoft.directory/groups/settings/read: Read settings of groups
Action: microsoft.directory/groups/standard/read: Read standard properties of Security groups and Microsoft 365 groups, including role-assignable groups
Action: microsoft.directory/oAuth2PermissionGrants/standard/read: Read basic properties on OAuth 2.0 permission grants
Action: microsoft.directory/organization/standard/read: Read basic properties on an organization
Action: microsoft.directory/organization/trustedCAsForPasswordlessAuth/read: Read trusted certificate authorities for passwordless authentication
Action: microsoft.directory/roleAssignments/standard/read: Read basic properties on role assignments
Action: microsoft.directory/roleDefinitions/standard/read: Read basic properties on role definitions
Action: microsoft.directory/servicePrincipals/appRoleAssignedTo/read: Read service principal role assignments
Action: microsoft.directory/servicePrincipals/appRoleAssignments/read: Read role assignments assigned to service principals
Action: microsoft.directory/servicePrincipals/memberOf/read: Read the group memberships on service principals
Action: microsoft.directory/servicePrincipals/oAuth2PermissionGrants/read: Read delegated permission grants on service principals
Action: microsoft.directory/servicePrincipals/ownedObjects/read: Read owned objects of service principals
Action: microsoft.directory/servicePrincipals/owners/read: Read owners of service principals
Action: microsoft.directory/servicePrincipals/policies/read: Read policies of service principals
Action: microsoft.directory/servicePrincipals/standard/read: Read basic properties of service principals
Action: microsoft.directory/subscribedSkus/standard/read: Read basic properties on subscriptions
Action: microsoft.directory/users/appRoleAssignments/read: Read application role assignments for users
Action: microsoft.directory/users/deviceForResourceAccount/read: Read deviceForResourceAccount of users
Action: microsoft.directory/users/directReports/read: Read the direct reports for users
Action: microsoft.directory/users/invitedBy/read: Read the user that invited an external user to a tenant
Action: microsoft.directory/users/licenseDetails/read: Read license details of users
Action: microsoft.directory/users/manager/read: Read manager of users
Action: microsoft.directory/users/memberOf/read: Read the group memberships of users
Action: microsoft.directory/users/oAuth2PermissionGrants/read: Read delegated permission grants on users
Action: microsoft.directory/users/ownedDevices/read: Read owned devices of users
Action: microsoft.directory/users/ownedObjects/read: Read owned objects of users
Action: microsoft.directory/users/photo/read: Read photo of users
Action: microsoft.directory/users/registeredDevices/read: Read registered devices of users
Action: microsoft.directory/users/scopedRoleMemberOf/read: Read user's membership of a Microsoft Entra role, that is scoped to an administrative unit
Action: microsoft.directory/users/sponsorOf/read: Read all the agents or applications the user is sponsor of
Action: microsoft.directory/users/sponsors/read: Read sponsors of users
Action: microsoft.directory/users/standard/read: Read basic properties on users