Restricted Guest User

User AccessEntraOps · EAMIdentity

Dado verificado em 30/06/2026 · Fonte

Role Actions

Control Plane

Management Plane

User Access

Template ID

2af84b1e-32c8-42b7-82bc-daa82404023b

Categoria

Identity

EAM Tier

User Access (Tier 2)

Enterprise Access Model: User Access

Acesso de usuario e leitura basica. Menor impacto de seguranca.

Esta role é classificada como User Access porque todas as suas 14 ações são desse tier.

14 User Access

Descrição

Most restrictive guest user type in Microsoft Entra ID. Cannot browse the directory, can only access resources they have been explicitly invited to.

Role Definition (JSON)

{
  "@odata.type": "#microsoft.graph.unifiedRoleDefinition",
  "id": "2af84b1e-32c8-42b7-82bc-daa82404023b",
  "displayName": "Restricted Guest User",
  "description": "Most restrictive guest user type in Microsoft Entra ID. Cannot browse the directory, can only access resources they have been explicitly invited to.",
  "isBuiltIn": true,
  "isEnabled": true,
  "isPrivileged": false,
  "rolePermissions": [
    {
      "allowedResourceActions": [
        "microsoft.directory/applications/owners/limitedRead",

Permissões completas

Todas as 14 role actions desta role, classificadas por tier do EAM.

Role Action	Categoria	Tier
`microsoft.directory/applications/owners/limitedRead`	Guest user	Tier 2
`microsoft.directory/applications/policies/limitedRead`	Guest user	Tier 2
`microsoft.directory/applications/standard/limitedRead`	Guest user	Tier 2
`microsoft.directory/directoryRoleTemplates/allProperties/read`	Default member	Tier 2
`microsoft.directory/domains/standard/read`	Default member, Guest user	Tier 2
`microsoft.directory/organization/basicProfile/read`	Guest user	Tier 2
`microsoft.directory/servicePrincipals/appRoleAssignedTo/limitedRead`	Guest user	Tier 2
`microsoft.directory/servicePrincipals/appRoleAssignments/limitedRead`	Guest user	Tier 2
`microsoft.directory/servicePrincipals/memberOf/limitedRead`	Guest user	Tier 2
`microsoft.directory/servicePrincipals/oAuth2PermissionGrants/limitedRead`	Guest user	Tier 2
`microsoft.directory/servicePrincipals/ownedObjects/limitedRead`	Guest user	Tier 2
`microsoft.directory/servicePrincipals/owners/limitedRead`	Guest user	Tier 2
`microsoft.directory/servicePrincipals/policies/limitedRead`	Guest user	Tier 2
`microsoft.directory/servicePrincipals/standard/limitedRead`	Guest user	Tier 2

14 de 14 role actions

PowerShell

Get-MgRoleManagementDirectoryRoleDefinition `
  -UnifiedRoleDefinitionId "2af84b1e-32c8-42b7-82bc-daa82404023b"

Microsoft Graph

GET https://graph.microsoft.com/v1.0/
  roleManagement/directory/
  roleDefinitions/2af84b1e-32c8-42b7-82bc-daa82404023b

Ver a documentação oficial na Microsoft Learn

Roles relacionadas

Agent ID Administrator

Tier 0Identity