Global Reader

Privilegiada

Control PlaneEntraOps · EAMIdentity

Dado verificado em 30/06/2026 · Fonte

Role Actions

100

Control Plane

Management Plane

User Access

Template ID

f2ef992c-3afb-46b9-b7cf-a126ee74c451

Categoria

Identity

EAM Tier

Control Plane (Tier 0)

Enterprise Access Model: Control Plane

Controle total do tenant. Comprometimento leva a takeover completo. Isole de planos inferiores.

Esta role é classificada como Control Plane porque 1 de 100 ações (1%) são desse tier — o tier da role acompanha sempre a ação de maior privilégio, não o conjunto.

1 Control Plane95 Management Plane4 User Access

Ação responsável:

microsoft.directory/bitlockerKeys/key/read

Descrição

Can read everything that a Global Administrator can, but not update anything.

Role Definition (JSON)

{
  "@odata.type": "#microsoft.graph.unifiedRoleDefinition",
  "id": "f2ef992c-3afb-46b9-b7cf-a126ee74c451",
  "displayName": "Global Reader",
  "description": "Can read everything that a Global Administrator can, but not update anything.",
  "isBuiltIn": true,
  "isEnabled": true,
  "isPrivileged": true,
  "rolePermissions": [
    {
      "allowedResourceActions": [
        "microsoft.directory/bitlockerKeys/key/read",

Permissões completas

Todas as 100 role actions desta role, classificadas por tier do EAM.

Role Action	Categoria	Tier
`microsoft.directory/bitlockerKeys/key/read`	Global Endpoint Bitlocker Recovery	Tier 0
`microsoft.agentRegistry/allEntities/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.azure.serviceHealth/allEntities/allTasks`	Support and Service Health	Tier 1
`microsoft.backup/allEntities/allProperties/read`	Microsoft 365 Backup	Tier 1
`microsoft.cloudPC/allEntities/allProperties/read`	User Virtual Endpoint Management	Tier 1
`microsoft.commerce.billing/allEntities/allProperties/read`	Microsoft 365 Billing Management	Tier 1
`microsoft.commerce.billing/purchases/standard/read`	Microsoft 365 Billing Management	Tier 1
`microsoft.directory/accessReviews/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/accessReviews/definitions/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/adminConsentRequestPolicy/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/administrativeUnits/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/appConsent/appConsentRequests/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/applications/allProperties/read`	Application and Workload Identity	Tier 1
`microsoft.directory/applications/synchronization/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/auditLogs/allProperties/read`	Security and Compliance	Tier 1
`microsoft.directory/bulkJobs/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/cloudAppSecurity/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/conditionalAccessPolicies/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/connectorGroups/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/connectors/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/contacts/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/crossTenantAccessPolicy/default/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/crossTenantAccessPolicy/partners/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/crossTenantAccessPolicy/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/customAuthenticationExtensions/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/deviceLocalCredentials/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/deviceManagementPolicies/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/deviceRegistrationPolicy/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/devices/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/directoryRoles/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/domains/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/domains/federationConfiguration/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/entitlementManagement/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/externalUserProfiles/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/groupSettingTemplates/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/groupSettings/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/groups/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/identityProtection/allProperties/read`	Security and Compliance	Tier 1
`microsoft.directory/lifecycleWorkflows/workflows/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/loginOrganizationBranding/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/multiTenantOrganization/joinRequest/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/multiTenantOrganization/tenants/organizationDetails/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/namedLocations/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/oAuth2PermissionGrants/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/onPremisesSynchronization/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/organization/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/pendingExternalUserProfiles/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/permissionGrantPolicies/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/policies/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/privilegedIdentityManagement/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/provisioningLogs/allProperties/read`	Security and Compliance	Tier 1
`microsoft.directory/roleAssignments/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/roleDefinitions/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/scopedRoleMemberships/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/serviceAction/getAvailableExtentionProperties`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/servicePrincipalCreationPolicies/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/servicePrincipals/allProperties/read`	Application and Workload Identity	Tier 1
`microsoft.directory/servicePrincipals/synchronization/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/signInReports/allProperties/read`	Security and Compliance	Tier 1
`microsoft.directory/subscribedSkus/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/users/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/users/authenticationMethods/standard/restrictedRead`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/verifiableCredentials/configuration/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/verifiableCredentials/configuration/contracts/cards/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.edge/allEntities/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.graph.dataConnect/allEntities/allProperties/read`	Microsoft 365 Platform Operations	Tier 1
`microsoft.hardware.support/shippingAddress/allProperties/read`	User Hardware Management	Tier 1
`microsoft.hardware.support/shippingStatus/allProperties/read`	User Hardware Management	Tier 1
`microsoft.hardware.support/warrantyClaims/allProperties/read`	User Hardware Management	Tier 1
`microsoft.healthPlatform/allEntities/allProperties/read`	Microsoft Dragon	Tier 1
`microsoft.insights/allEntities/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.microsoft365.organizationalData/allEntities/allProperties/read`	Microsoft 365 Platform Operations	Tier 1
`microsoft.networkAccess/allEntities/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.office365.copilot/allEntities/allProperties/read`	Microsoft 365 Platform Operations	Tier 1
`microsoft.office365.fileStorageContainers/allEntities/allProperties/read`	Microsoft SharePoint	Tier 1
`microsoft.office365.messageCenter/messages/read`	Microsoft 365 Support Operations	Tier 1
`microsoft.office365.messageCenter/securityMessages/read`	Support and Service Health	Tier 1
`microsoft.office365.network/performance/allProperties/read`	Microsoft 365 Support Operations	Tier 1
`microsoft.office365.organizationalMessages/allEntities/allProperties/read`	Microsoft 365 Platform Operations	Tier 1
`microsoft.office365.protectionCenter/allEntities/allProperties/read`	Security and Compliance	Tier 1
`microsoft.office365.securityComplianceCenter/allEntities/read`	Security and Compliance	Tier 1
`microsoft.office365.serviceHealth/allEntities/allTasks`	Microsoft 365 Support Operations	Tier 1
`microsoft.office365.usageReports/allEntities/allProperties/read`	Microsoft 365 Support Operations	Tier 1
`microsoft.office365.webPortal/allEntities/standard/read`	Microsoft 365 Support Operations	Tier 1
`microsoft.office365.yammer/allEntities/allProperties/read`	Yammer	Tier 1
`microsoft.permissionsManagement/allEntities/allProperties/read`	Cloud Infrastructure Entitlement Management	Tier 1
`microsoft.teams/allEntities/allProperties/read`	Teams	Tier 1
`microsoft.virtualVisits/allEntities/allProperties/read`	Virtual Visits	Tier 1
`microsoft.viva.glint/allEntities/allProperties/read`	Microsoft Viva	Tier 1
`microsoft.viva.goals/allEntities/allProperties/read`	Microsoft Viva	Tier 1
`microsoft.viva.pulse/allEntities/allProperties/read`	Microsoft Viva	Tier 1
`microsoft.windows.updatesDeployments/allEntities/allProperties/read`	Security and Compliance	Tier 1
`microsoft.directory/authorizationPolicy/standard/read`	Default member	Tier 2
`microsoft.directory/directoryRoleTemplates/allProperties/read`	Default member	Tier 2
`microsoft.directory/multiTenantOrganization/standard/read`	Default member, Guest user	Tier 2
`microsoft.directory/multiTenantOrganization/tenants/standard/read`	Default member, Guest user	Tier 2

100 de 100 role actions

PowerShell

Get-MgRoleManagementDirectoryRoleDefinition `
  -UnifiedRoleDefinitionId "f2ef992c-3afb-46b9-b7cf-a126ee74c451"

Microsoft Graph

GET https://graph.microsoft.com/v1.0/
  roleManagement/directory/
  roleDefinitions/f2ef992c-3afb-46b9-b7cf-a126ee74c451

Ver a documentação oficial na Microsoft Learn

Roles relacionadas

Agent ID Administrator

Tier 0Identity

Agent ID Developer

Tier 0Identity

Agent Registry Administrator

Tier 0Identity

Directory Synchronization Accounts

Tier 0Identity

Directory Writers

Tier 0Identity