Recorded 22 Oct 2026 at 18:59 UTC. This is what ChangeIntel recorded, including the title, summary, facts and links. It is not a statement of the source's current position. See the latest record.

Microsoft Entra roleMicrosoft Learn

Global Reader

Can read everything that a Global Administrator can, but not update anything.

Cite this recorded revision

What it said

Permission coverage: Documented resource actions
Action: microsoft.agentRegistry/allEntities/allProperties/read: Read all properties of Agent Registry in Microsoft Entra ID
Action: microsoft.azure.serviceHealth/allEntities/allTasks: Read and configure Azure Service Health
Action: microsoft.backup/allEntities/allProperties/read: Read all aspects of Microsoft 365 Backup
Action: microsoft.cloudPC/allEntities/allProperties/read: Read all aspects of Windows 365
Action: microsoft.commerce.billing/allEntities/allProperties/read: Read all resources of Office 365 billing
Action: microsoft.commerce.billing/purchases/standard/read: Read purchase services in Microsoft 365 admin center.
Action: microsoft.directory/accessReviews/allProperties/read: Read all properties of access reviews
Action: microsoft.directory/accessReviews/definitions/allProperties/read: Read all properties of access reviews of all reviewable resources in Microsoft Entra ID
Action: microsoft.directory/adminConsentRequestPolicy/allProperties/read: Read all properties of admin consent request policies in Microsoft Entra ID
Action: microsoft.directory/administrativeUnits/allProperties/read: Read all properties of administrative units, including members
Action: microsoft.directory/appConsent/appConsentRequests/allProperties/read: Read all properties of consent requests for applications registered with Microsoft Entra ID
Action: microsoft.directory/applications/allProperties/read: Read all properties (including privileged properties) on all types of applications
Action: microsoft.directory/applications/synchronization/standard/read: Read provisioning settings associated with the application object
Action: microsoft.directory/auditLogs/allProperties/read: Read all properties on audit logs, excluding custom security attributes audit logs
Action: microsoft.directory/authorizationPolicy/standard/read: Read standard properties of authorization policy
Action: microsoft.directory/bitlockerKeys/key/read: Read bitlocker metadata and key on devices
Action: microsoft.directory/cloudAppSecurity/allProperties/read: Read all properties for Cloud app security
Action: microsoft.directory/conditionalAccessPolicies/allProperties/read: Read all properties of Conditional Access policies
Action: microsoft.directory/connectorGroups/allProperties/read: Read all properties of application proxy connector groups
Action: microsoft.directory/connectors/allProperties/read: Read all properties of application proxy connectors
Action: microsoft.directory/contacts/allProperties/read: Read all properties for contacts
Action: microsoft.directory/crossTenantAccessPolicy/default/standard/read: Read basic properties of the default cross-tenant access policy
Action: microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/standard/read: Read basic properties of cross-tenant sync policy
Action: microsoft.directory/crossTenantAccessPolicy/partners/standard/read: Read basic properties of cross-tenant access policy for partners
Action: microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/standard/read: Read basic properties of cross tenant sync policy templates for multi-tenant organization
Action: microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/standard/read: Read basic properties of cross tenant access policy templates for multi-tenant organization
Action: microsoft.directory/crossTenantAccessPolicy/standard/read: Read basic properties of cross-tenant access policy
Action: microsoft.directory/customAuthenticationExtensions/allProperties/read: Read custom authentication extensions
Action: microsoft.directory/deviceLocalCredentials/standard/read: Read all properties of the backed up local administrator account credentials for Microsoft Entra joined devices, except the password
Action: microsoft.directory/deviceManagementPolicies/standard/read: Read standard properties on mobile device management and mobile app management policies
Action: microsoft.directory/deviceRegistrationPolicy/standard/read: Read standard properties on device registration policies
Action: microsoft.directory/devices/allProperties/read: Read all properties of devices
Action: microsoft.directory/directoryRoleTemplates/allProperties/read: Read all properties of directory role templates
Action: microsoft.directory/directoryRoles/allProperties/read: Read all properties of directory roles
Action: microsoft.directory/domains/allProperties/read: Read all properties of domains
Action: microsoft.directory/domains/federationConfiguration/standard/read: Read standard properties of federation configuration for domains
Action: microsoft.directory/entitlementManagement/allProperties/read: Read all properties in Microsoft Entra entitlement management
Action: microsoft.directory/externalUserProfiles/standard/read: Read standard properties of external user profiles in the extended directory for Teams
Action: microsoft.directory/groupSettingTemplates/allProperties/read: Read all properties of group setting templates
Action: microsoft.directory/groupSettings/allProperties/read: Read all properties of group settings
Action: microsoft.directory/groups/allProperties/read: Read all properties (including privileged properties) on Security groups and Microsoft 365 groups, including role-assignable groups
Action: microsoft.directory/identityProtection/allProperties/read: Read all resources in Microsoft Entra ID Protection
Action: microsoft.directory/lifecycleWorkflows/workflows/allProperties/read: Read all properties of lifecycle workflows and tasks in Microsoft Entra ID
Action: microsoft.directory/loginOrganizationBranding/allProperties/read: Read all properties for your organization's branded sign-in page
Action: microsoft.directory/multiTenantOrganization/joinRequest/standard/read: Read properties of a multi-tenant organization join request
Action: microsoft.directory/multiTenantOrganization/standard/read: Read basic properties of a multi-tenant organization
Action: microsoft.directory/multiTenantOrganization/tenants/organizationDetails/read: Read organization details of a tenant participating in a multi-tenant organization
Action: microsoft.directory/multiTenantOrganization/tenants/standard/read: Read basic properties of a tenant participating in a multi-tenant organization
Action: microsoft.directory/namedLocations/standard/read: Read basic properties of custom rules that define network locations
Action: microsoft.directory/oAuth2PermissionGrants/allProperties/read: Read all properties of OAuth 2.0 permission grants
Action: microsoft.directory/onPremisesSynchronization/standard/read: Read standard on-premises directory synchronization information
Action: microsoft.directory/organization/allProperties/read: Read all properties for an organization
Action: microsoft.directory/pendingExternalUserProfiles/standard/read: Read standard properties of external user profiles in the extended directory for Teams
Action: microsoft.directory/permissionGrantPolicies/standard/read: Read standard properties of permission grant policies
Action: microsoft.directory/policies/allProperties/read: Read all properties of policies
Action: microsoft.directory/privilegedIdentityManagement/allProperties/read: Read all resources in Privileged Identity Management
Action: microsoft.directory/provisioningLogs/allProperties/read: Read all properties of provisioning logs
Action: microsoft.directory/roleAssignments/allProperties/read: Read all properties of role assignments
Action: microsoft.directory/roleDefinitions/allProperties/read: Read all properties of role definitions
Action: microsoft.directory/scopedRoleMemberships/allProperties/read: View members in administrative units
Action: microsoft.directory/serviceAction/getAvailableExtentionProperties: Can perform the getAvailableExtentionProperties service action
Action: microsoft.directory/servicePrincipalCreationPolicies/standard/read: Read standard properties of service principal creation policies
Action: microsoft.directory/servicePrincipals/allProperties/read: Read all properties (including privileged properties) on servicePrincipals
Action: microsoft.directory/servicePrincipals/synchronization/standard/read: Read provisioning settings associated with your service principal
Action: microsoft.directory/signInReports/allProperties/read: Read all properties on sign-in reports, including privileged properties
Action: microsoft.directory/subscribedSkus/allProperties/read: Read all properties of product subscriptions
Action: microsoft.directory/users/allProperties/read: Read all properties of users
Action: microsoft.directory/users/authenticationMethods/standard/restrictedRead: Read standard properties of authentication methods that do not include personally identifiable information for users
Action: microsoft.directory/verifiableCredentials/configuration/allProperties/read: Read configuration required to create and manage verifiable credentials
Action: microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/read: Read a verifiable credential contract
Action: microsoft.directory/verifiableCredentials/configuration/contracts/cards/allProperties/read: Read a verifiable credential card
Action: microsoft.edge/allEntities/allProperties/read: Read all aspects of Microsoft Edge
Action: microsoft.graph.dataConnect/allEntities/allProperties/read: Read aspects of Microsoft Graph Data Connect
Action: microsoft.hardware.support/shippingAddress/allProperties/read: Read shipping addresses for Microsoft hardware warranty claims, including existing shipping addresses created by others
Action: microsoft.hardware.support/shippingStatus/allProperties/read: Read shipping status for open Microsoft hardware warranty claims
Action: microsoft.hardware.support/warrantyClaims/allProperties/read: Read Microsoft hardware warranty claims
Action: microsoft.healthPlatform/allEntities/allProperties/read: Read all aspects of Microsoft Dragon admin center
Action: microsoft.insights/allEntities/allProperties/read: Read all aspects of Viva Insights
Action: microsoft.microsoft365.organizationalData/allEntities/allProperties/read: Read all aspects of organizational data in Microsoft 365
Action: microsoft.networkAccess/allEntities/allProperties/read: Read all aspects of Microsoft Entra Network Access
Action: microsoft.office365.copilot/allEntities/allProperties/read: Read all settings for Microsoft Copilot
Action: microsoft.office365.fileStorageContainers/allEntities/allProperties/read: Read entities and permissions of SharePoint Embedded containers
Action: microsoft.office365.messageCenter/messages/read: Read messages in Message Center in the Microsoft 365 admin center, excluding security messages
Action: microsoft.office365.messageCenter/securityMessages/read: Read security messages in Message Center in the Microsoft 365 admin center
Action: microsoft.office365.network/performance/allProperties/read: Read all network performance properties in the Microsoft 365 admin center
Action: microsoft.office365.organizationalMessages/allEntities/allProperties/read: Read all aspects of Microsoft 365 Organizational Messages
Action: microsoft.office365.protectionCenter/allEntities/allProperties/read: Read all properties in the Security and Compliance centers
Action: microsoft.office365.securityComplianceCenter/allEntities/read: Read standard properties in Microsoft 365 Security and Compliance Center
Action: microsoft.office365.serviceHealth/allEntities/allTasks: Read and configure Service Health in the Microsoft 365 admin center
Action: microsoft.office365.usageReports/allEntities/allProperties/read: Read Office 365 usage reports
Action: microsoft.office365.webPortal/allEntities/standard/read: Read basic properties on all resources in the Microsoft 365 admin center
Action: microsoft.office365.yammer/allEntities/allProperties/read: Read all aspects of Yammer
Action: microsoft.permissionsManagement/allEntities/allProperties/read: Read all aspects of Microsoft Entra Permissions Management
Action: microsoft.teams/allEntities/allProperties/read: Read all properties of Microsoft Teams
Action: microsoft.virtualVisits/allEntities/allProperties/read: Read all aspects of Virtual Visits
Action: microsoft.viva.glint/allEntities/allProperties/read: Read all Microsoft Viva Glint settings in the Microsoft 365 admin center
Action: microsoft.viva.goals/allEntities/allProperties/read: Read all aspects of Microsoft Viva Goals
Action: microsoft.viva.pulse/allEntities/allProperties/read: Read all aspects of Microsoft Viva Pulse
Action: microsoft.windows.updatesDeployments/allEntities/allProperties/read: Read all aspects of Windows Update Service