Directory Readers

Management PlaneEntraOps · EAMIdentity

Dado verificado em 30/06/2026 · Fonte

Role Actions

Control Plane

Management Plane

User Access

Template ID

88d8e3e3-8f55-4a1e-953a-9b9898b8876b

Categoria

Identity

EAM Tier

Management Plane (Tier 1)

Enterprise Access Model: Management Plane

Funcoes de gestao de TI enterprise-wide. Alto impacto, mas sem controle total do tenant.

Esta role é classificada como Management Plane porque 4 de 55 ações (7%) são desse tier — o tier da role acompanha sempre a ação de maior privilégio, não o conjunto.

4 Management Plane51 User Access

Descrição

Can read basic directory information. Commonly used to grant directory read access to applications and guests.

Role Definition (JSON)

{
  "@odata.type": "#microsoft.graph.unifiedRoleDefinition",
  "id": "88d8e3e3-8f55-4a1e-953a-9b9898b8876b",
  "displayName": "Directory Readers",
  "description": "Can read basic directory information. Commonly used to grant directory read access to applications and guests.",
  "isBuiltIn": true,
  "isEnabled": true,
  "isPrivileged": false,
  "rolePermissions": [
    {
      "allowedResourceActions": [
        "microsoft.directory/groupSettingTemplates/standard/read",

Permissões completas

Todas as 55 role actions desta role, classificadas por tier do EAM.

Role Action	Categoria	Tier
`microsoft.directory/groupSettingTemplates/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/groupSettings/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/groups/settings/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/organization/trustedCAsForPasswordlessAuth/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/administrativeUnits/members/read`	Default member	Tier 2
`microsoft.directory/administrativeUnits/standard/read`	Default member	Tier 2
`microsoft.directory/applicationPolicies/standard/read`	Default member	Tier 2
`microsoft.directory/applications/owners/read`	Default member	Tier 2
`microsoft.directory/applications/policies/read`	Default member	Tier 2
`microsoft.directory/applications/standard/read`	Default member	Tier 2
`microsoft.directory/contacts/memberOf/read`	Default member	Tier 2
`microsoft.directory/contacts/standard/read`	Default member	Tier 2
`microsoft.directory/contracts/standard/read`	Default member	Tier 2
`microsoft.directory/devices/memberOf/read`	Default member	Tier 2
`microsoft.directory/devices/registeredOwners/read`	Default member	Tier 2
`microsoft.directory/devices/registeredUsers/read`	Default member	Tier 2
`microsoft.directory/devices/standard/read`	Default member	Tier 2
`microsoft.directory/directoryRoles/eligibleMembers/read`	Default member	Tier 2
`microsoft.directory/directoryRoles/members/read`	Default member	Tier 2
`microsoft.directory/directoryRoles/standard/read`	Default member	Tier 2
`microsoft.directory/domains/standard/read`	Default member, Guest user	Tier 2
`microsoft.directory/groups/appRoleAssignments/read`	Default member	Tier 2
`microsoft.directory/groups/memberOf/read`	Default member	Tier 2
`microsoft.directory/groups/members/read`	Default member	Tier 2
`microsoft.directory/groups/owners/read`	Default member	Tier 2
`microsoft.directory/groups/standard/read`	Default member	Tier 2
`microsoft.directory/oAuth2PermissionGrants/standard/read`	Default member	Tier 2
`microsoft.directory/organization/standard/read`	Default member	Tier 2
`microsoft.directory/roleAssignments/standard/read`	Default member	Tier 2
`microsoft.directory/roleDefinitions/standard/read`	Default member	Tier 2
`microsoft.directory/servicePrincipals/appRoleAssignedTo/read`	Default member	Tier 2
`microsoft.directory/servicePrincipals/appRoleAssignments/read`	Default member	Tier 2
`microsoft.directory/servicePrincipals/memberOf/read`	Default member	Tier 2
`microsoft.directory/servicePrincipals/oAuth2PermissionGrants/read`	Default member	Tier 2
`microsoft.directory/servicePrincipals/ownedObjects/read`	Default member	Tier 2
`microsoft.directory/servicePrincipals/owners/read`	Default member	Tier 2
`microsoft.directory/servicePrincipals/policies/read`	Default member	Tier 2
`microsoft.directory/servicePrincipals/standard/read`	Default member	Tier 2
`microsoft.directory/subscribedSkus/standard/read`	Default member	Tier 2
`microsoft.directory/users/appRoleAssignments/read`	Default member	Tier 2
`microsoft.directory/users/deviceForResourceAccount/read`	Default member	Tier 2
`microsoft.directory/users/directReports/read`	Default member	Tier 2
`microsoft.directory/users/invitedBy/read`	Default member	Tier 2
`microsoft.directory/users/licenseDetails/read`	Default member	Tier 2
`microsoft.directory/users/manager/read`	Default member	Tier 2
`microsoft.directory/users/memberOf/read`	Default member	Tier 2
`microsoft.directory/users/oAuth2PermissionGrants/read`	Default member	Tier 2
`microsoft.directory/users/ownedDevices/read`	Default member	Tier 2
`microsoft.directory/users/ownedObjects/read`	Default member	Tier 2
`microsoft.directory/users/photo/read`	Default member	Tier 2
`microsoft.directory/users/registeredDevices/read`	Default member	Tier 2
`microsoft.directory/users/scopedRoleMemberOf/read`	Default member	Tier 2
`microsoft.directory/users/sponsorOf/read`	Default member	Tier 2
`microsoft.directory/users/sponsors/read`	Default member	Tier 2
`microsoft.directory/users/standard/read`	Default member	Tier 2

55 de 55 role actions

PowerShell

Get-MgRoleManagementDirectoryRoleDefinition `
  -UnifiedRoleDefinitionId "88d8e3e3-8f55-4a1e-953a-9b9898b8876b"

Microsoft Graph

GET https://graph.microsoft.com/v1.0/
  roleManagement/directory/
  roleDefinitions/88d8e3e3-8f55-4a1e-953a-9b9898b8876b

Ver a documentação oficial na Microsoft Learn

Roles relacionadas

Extended Directory User Administrator

Tier 1Identity

Global Secure Access Log Reader

Tier 1Identity

People Administrator

Tier 1Identity

Agent ID Administrator

Tier 0Identity

Agent ID Developer

Tier 0Identity