| microsoft.agentRegistry/allEntities/allProperties/read | Read all properties of Agent Registry in Microsoft Entra ID |
| microsoft.azure.serviceHealth/allEntities/allTasks | Read and configure Azure Service Health |
| microsoft.backup/allEntities/allProperties/read | Read all aspects of Microsoft 365 Backup |
| microsoft.cloudPC/allEntities/allProperties/read | Read all aspects of Windows 365 |
| microsoft.commerce.billing/allEntities/allProperties/read | Read all resources of Office 365 billing |
| microsoft.commerce.billing/purchases/standard/read | Read purchase services in Microsoft 365 admin center. |
| microsoft.directory/accessReviews/allProperties/read | Read all properties of access reviews |
| microsoft.directory/accessReviews/definitions/allProperties/read | Read all properties of access reviews of all reviewable resources in Microsoft Entra ID |
| microsoft.directory/adminConsentRequestPolicy/allProperties/read | Read all properties of admin consent request policies in Microsoft Entra ID |
| microsoft.directory/administrativeUnits/allProperties/read | Read all properties of administrative units, including members |
| microsoft.directory/appConsent/appConsentRequests/allProperties/read | Read all properties of consent requests for applications registered with Microsoft Entra ID |
| microsoft.directory/applications/allProperties/read | Read all properties (including privileged properties) on all types of applications |
| microsoft.directory/applications/synchronization/standard/read | Read provisioning settings associated with the application object |
| microsoft.directory/auditLogs/allProperties/read | Read all properties on audit logs, excluding custom security attributes audit logs |
| microsoft.directory/authorizationPolicy/standard/read | Read standard properties of authorization policy |
| microsoft.directory/bitlockerKeys/key/read | Read bitlocker metadata and key on devices |
| microsoft.directory/cloudAppSecurity/allProperties/read | Read all properties for Cloud app security |
| microsoft.directory/conditionalAccessPolicies/allProperties/read | Read all properties of Conditional Access policies |
| microsoft.directory/connectorGroups/allProperties/read | Read all properties of application proxy connector groups |
| microsoft.directory/connectors/allProperties/read | Read all properties of application proxy connectors |
| microsoft.directory/contacts/allProperties/read | Read all properties for contacts |
| microsoft.directory/crossTenantAccessPolicy/default/standard/read | Read basic properties of the default cross-tenant access policy |
| microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/standard/read | Read basic properties of cross-tenant sync policy |
| microsoft.directory/crossTenantAccessPolicy/partners/standard/read | Read basic properties of cross-tenant access policy for partners |
| microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/standard/read | Read basic properties of cross tenant sync policy templates for multi-tenant organization |
| microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/standard/read | Read basic properties of cross tenant access policy templates for multi-tenant organization |
| microsoft.directory/crossTenantAccessPolicy/standard/read | Read basic properties of cross-tenant access policy |
| microsoft.directory/customAuthenticationExtensions/allProperties/read | Read custom authentication extensions |
| microsoft.directory/deviceLocalCredentials/standard/read | Read all properties of the backed up local administrator account credentials for Microsoft Entra joined devices, except the password |
| microsoft.directory/deviceManagementPolicies/standard/read | Read standard properties on mobile device management and mobile app management policies |
| microsoft.directory/deviceRegistrationPolicy/standard/read | Read standard properties on device registration policies |
| microsoft.directory/devices/allProperties/read | Read all properties of devices |
| microsoft.directory/directoryRoleTemplates/allProperties/read | Read all properties of directory role templates |
| microsoft.directory/directoryRoles/allProperties/read | Read all properties of directory roles |
| microsoft.directory/domains/allProperties/read | Read all properties of domains |
| microsoft.directory/domains/federationConfiguration/standard/read | Read standard properties of federation configuration for domains |
| microsoft.directory/entitlementManagement/allProperties/read | Read all properties in Microsoft Entra entitlement management |
| microsoft.directory/externalUserProfiles/standard/read | Read standard properties of external user profiles in the extended directory for Teams |
| microsoft.directory/groupSettingTemplates/allProperties/read | Read all properties of group setting templates |
| microsoft.directory/groupSettings/allProperties/read | Read all properties of group settings |
| microsoft.directory/groups/allProperties/read | Read all properties (including privileged properties) on Security groups and Microsoft 365 groups, including role-assignable groups |
| microsoft.directory/identityProtection/allProperties/read | Read all resources in Microsoft Entra ID Protection |
| microsoft.directory/lifecycleWorkflows/workflows/allProperties/read | Read all properties of lifecycle workflows and tasks in Microsoft Entra ID |
| microsoft.directory/loginOrganizationBranding/allProperties/read | Read all properties for your organization's branded sign-in page |
| microsoft.directory/multiTenantOrganization/joinRequest/standard/read | Read properties of a multi-tenant organization join request |
| microsoft.directory/multiTenantOrganization/standard/read | Read basic properties of a multi-tenant organization |
| microsoft.directory/multiTenantOrganization/tenants/organizationDetails/read | Read organization details of a tenant participating in a multi-tenant organization |
| microsoft.directory/multiTenantOrganization/tenants/standard/read | Read basic properties of a tenant participating in a multi-tenant organization |
| microsoft.directory/namedLocations/standard/read | Read basic properties of custom rules that define network locations |
| microsoft.directory/oAuth2PermissionGrants/allProperties/read | Read all properties of OAuth 2.0 permission grants |
| microsoft.directory/onPremisesSynchronization/standard/read | Read standard on-premises directory synchronization information |
| microsoft.directory/organization/allProperties/read | Read all properties for an organization |
| microsoft.directory/pendingExternalUserProfiles/standard/read | Read standard properties of external user profiles in the extended directory for Teams |
| microsoft.directory/permissionGrantPolicies/standard/read | Read standard properties of permission grant policies |
| microsoft.directory/policies/allProperties/read | Read all properties of policies |
| microsoft.directory/privilegedIdentityManagement/allProperties/read | Read all resources in Privileged Identity Management |
| microsoft.directory/provisioningLogs/allProperties/read | Read all properties of provisioning logs |
| microsoft.directory/roleAssignments/allProperties/read | Read all properties of role assignments |
| microsoft.directory/roleDefinitions/allProperties/read | Read all properties of role definitions |
| microsoft.directory/scopedRoleMemberships/allProperties/read | View members in administrative units |
| microsoft.directory/serviceAction/getAvailableExtentionProperties | Can perform the getAvailableExtentionProperties service action |
| microsoft.directory/servicePrincipalCreationPolicies/standard/read | Read standard properties of service principal creation policies |
| microsoft.directory/servicePrincipals/allProperties/read | Read all properties (including privileged properties) on servicePrincipals |
| microsoft.directory/servicePrincipals/synchronization/standard/read | Read provisioning settings associated with your service principal |
| microsoft.directory/signInReports/allProperties/read | Read all properties on sign-in reports, including privileged properties |
| microsoft.directory/subscribedSkus/allProperties/read | Read all properties of product subscriptions |
| microsoft.directory/users/allProperties/read | Read all properties of users |
| microsoft.directory/users/authenticationMethods/standard/restrictedRead | Read standard properties of authentication methods that do not include personally identifiable information for users |
| microsoft.directory/verifiableCredentials/configuration/allProperties/read | Read configuration required to create and manage verifiable credentials |
| microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/read | Read a verifiable credential contract |
| microsoft.directory/verifiableCredentials/configuration/contracts/cards/allProperties/read | Read a verifiable credential card |
| microsoft.edge/allEntities/allProperties/read | Read all aspects of Microsoft Edge |
| microsoft.graph.dataConnect/allEntities/allProperties/read | Read aspects of Microsoft Graph Data Connect |
| microsoft.hardware.support/shippingAddress/allProperties/read | Read shipping addresses for Microsoft hardware warranty claims, including existing shipping addresses created by others |
| microsoft.hardware.support/shippingStatus/allProperties/read | Read shipping status for open Microsoft hardware warranty claims |
| microsoft.hardware.support/warrantyClaims/allProperties/read | Read Microsoft hardware warranty claims |
| microsoft.healthPlatform/allEntities/allProperties/read | Read all aspects of Microsoft Dragon admin center |
| microsoft.insights/allEntities/allProperties/read | Read all aspects of Viva Insights |
| microsoft.microsoft365.organizationalData/allEntities/allProperties/read | Read all aspects of organizational data in Microsoft 365 |
| microsoft.networkAccess/allEntities/allProperties/read | Read all aspects of Microsoft Entra Network Access |
| microsoft.office365.copilot/allEntities/allProperties/read | Read all settings for Microsoft Copilot |
| microsoft.office365.fileStorageContainers/allEntities/allProperties/read | Read entities and permissions of SharePoint Embedded containers |
| microsoft.office365.messageCenter/messages/read | Read messages in Message Center in the Microsoft 365 admin center, excluding security messages |
| microsoft.office365.messageCenter/securityMessages/read | Read security messages in Message Center in the Microsoft 365 admin center |
| microsoft.office365.network/performance/allProperties/read | Read all network performance properties in the Microsoft 365 admin center |
| microsoft.office365.organizationalMessages/allEntities/allProperties/read | Read all aspects of Microsoft 365 Organizational Messages |
| microsoft.office365.protectionCenter/allEntities/allProperties/read | Read all properties in the Security and Compliance centers |
| microsoft.office365.securityComplianceCenter/allEntities/read | Read standard properties in Microsoft 365 Security and Compliance Center |
| microsoft.office365.serviceHealth/allEntities/allTasks | Read and configure Service Health in the Microsoft 365 admin center |
| microsoft.office365.usageReports/allEntities/allProperties/read | Read Office 365 usage reports |
| microsoft.office365.webPortal/allEntities/standard/read | Read basic properties on all resources in the Microsoft 365 admin center |
| microsoft.office365.yammer/allEntities/allProperties/read | Read all aspects of Yammer |
| microsoft.permissionsManagement/allEntities/allProperties/read | Read all aspects of Microsoft Entra Permissions Management |
| microsoft.teams/allEntities/allProperties/read | Read all properties of Microsoft Teams |
| microsoft.virtualVisits/allEntities/allProperties/read | Read all aspects of Virtual Visits |
| microsoft.viva.glint/allEntities/allProperties/read | Read all Microsoft Viva Glint settings in the Microsoft 365 admin center |
| microsoft.viva.goals/allEntities/allProperties/read | Read all aspects of Microsoft Viva Goals |
| microsoft.viva.pulse/allEntities/allProperties/read | Read all aspects of Microsoft Viva Pulse |
| microsoft.windows.updatesDeployments/allEntities/allProperties/read | Read all aspects of Windows Update Service |