Security Reader

Privilegiada

Control PlaneEntraOps · EAMSecurity

Dado verificado em 30/06/2026 · Fonte

Role Actions

Control Plane

Management Plane

User Access

Template ID

5d6b6bb7-de71-4623-b4af-96380a352509

Categoria

Security

EAM Tier

Control Plane (Tier 0)

Enterprise Access Model: Control Plane

Controle total do tenant. Comprometimento leva a takeover completo. Isole de planos inferiores.

Esta role é classificada como Control Plane porque 1 de 34 ações (3%) são desse tier — o tier da role acompanha sempre a ação de maior privilégio, não o conjunto.

1 Control Plane27 Management Plane6 User Access

Ação responsável:

microsoft.directory/bitlockerKeys/key/read

Descrição

Can read security information and reports in Microsoft Entra ID and Office 365.

Role Definition (JSON)

{
  "@odata.type": "#microsoft.graph.unifiedRoleDefinition",
  "id": "5d6b6bb7-de71-4623-b4af-96380a352509",
  "displayName": "Security Reader",
  "description": "Can read security information and reports in Microsoft Entra ID and Office 365.",
  "isBuiltIn": true,
  "isEnabled": true,
  "isPrivileged": true,
  "rolePermissions": [
    {
      "allowedResourceActions": [
        "microsoft.directory/bitlockerKeys/key/read",

Permissões completas

Todas as 34 role actions desta role, classificadas por tier do EAM.

Role Action	Categoria	Tier
`microsoft.directory/bitlockerKeys/key/read`	Global Endpoint Bitlocker Recovery	Tier 0
`microsoft.agentRegistry/allEntities/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.azure.serviceHealth/allEntities/allTasks`	Support and Service Health	Tier 1
`microsoft.directory/accessReviews/definitions/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/auditLogs/allProperties/read`	Security and Compliance	Tier 1
`microsoft.directory/bulkJobs/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/conditionalAccessPolicies/owners/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/conditionalAccessPolicies/policyAppliedTo/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/conditionalAccessPolicies/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/deviceLocalCredentials/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/domains/federationConfiguration/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/entitlementManagement/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/identityProtection/allProperties/read`	Security and Compliance	Tier 1
`microsoft.directory/multiTenantOrganization/joinRequest/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/multiTenantOrganization/tenants/organizationDetails/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/namedLocations/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/privilegedIdentityManagement/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/provisioningLogs/allProperties/read`	Security and Compliance	Tier 1
`microsoft.directory/signInReports/allProperties/read`	Security and Compliance	Tier 1
`microsoft.networkAccess/allEntities/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.office365.protectionCenter/allEntities/standard/read`	Security and Compliance	Tier 1
`microsoft.office365.protectionCenter/attackSimulator/payload/allProperties/read`	Security and Compliance	Tier 1
`microsoft.office365.protectionCenter/attackSimulator/reports/allProperties/read`	Security and Compliance	Tier 1
`microsoft.office365.protectionCenter/attackSimulator/simulation/allProperties/read`	Security and Compliance	Tier 1
`microsoft.office365.serviceHealth/allEntities/allTasks`	Microsoft 365 Support Operations	Tier 1
`microsoft.office365.webPortal/allEntities/standard/read`	Microsoft 365 Support Operations	Tier 1
`microsoft.directory/authorizationPolicy/standard/read`	Default member	Tier 2
`microsoft.directory/multiTenantOrganization/standard/read`	Default member, Guest user	Tier 2
`microsoft.directory/multiTenantOrganization/tenants/standard/read`	Default member, Guest user	Tier 2
`microsoft.directory/policies/owners/read`	Default member	Tier 2
`microsoft.directory/policies/policyAppliedTo/read`	Default member	Tier 2
`microsoft.directory/policies/standard/read`	Default member	Tier 2

34 de 34 role actions

PowerShell

Get-MgRoleManagementDirectoryRoleDefinition `
  -UnifiedRoleDefinitionId "5d6b6bb7-de71-4623-b4af-96380a352509"

Microsoft Graph

GET https://graph.microsoft.com/v1.0/
  roleManagement/directory/
  roleDefinitions/5d6b6bb7-de71-4623-b4af-96380a352509

Ver a documentação oficial na Microsoft Learn

Roles relacionadas

Authentication Administrator

Tier 0Security

Authentication Extensibility Administrator

Tier 0Security

Authentication Extensibility Password Administrator

Tier 0Security

Authentication Policy Administrator

Tier 0Security

B2C IEF Keyset Administrator

Tier 0Security