Identity and Access roles and permissions

Role Permission Description
Identity and Access Essentials Reader

Can read all Identity and Access Essentials Command Blocks.

command.category.read Can read all corresponding Command Block categories
command.identityaccessessentials.read Can read all Identity and Access Essentials Command Blocks and jobs
command.jobs.read Can read related Command Block jobs
command.read Can read all related Command Blocks
command.schedules.read Can read all schedules Command Blocks and jobs
organization.readbasic Can read all basic organization properties (list)
report.accesstoken.read Can read Power BI report access token (list)
report.read Can read Power BI reports (list)
user.read Can read all properties of a user (details)
user.readbasic Can read all basic user properties (list)
Identity and Access Essentials Writer

Can read and execute all Identity and Access Command Blocks.

command.category.read Can read all corresponding Command Block categories
command.identityaccessessentials.read Can read all Identity and Access Essentials Command Blocks and jobs
command.identityaccessessentials.write Can execute all Identity and Access Essentials jobs
command.jobs.read Can read related Command Block jobs
command.read Can read all related Command Blocks
command.schedules.read Can read all schedules Command Blocks and jobs
command.schedules.write Can write all schedules Command Blocks and jobs
organization.readbasic Can read all basic organization properties (list)
report.accesstoken.read Can read Power BI report access token (list)
report.read Can read Power BI reports (list)
user.read Can read all properties of a user (details)
user.readbasic Can read all basic user properties (list)
Identity Protection Reader

Can read all Identity and Access Command Blocks.

command.category.read Can read all corresponding Command Block categories
command.identityaccess.read Can read all identity access Command Blocks and jobs
command.jobs.read Can read related Command Block jobs
command.read Can read all related Command Blocks
command.schedules.read Can read all schedules Command Blocks and jobs
organization.readbasic Can read all basic organization properties (list)
report.accesstoken.read Can read Power BI report access token (list)
report.read Can read Power BI reports (list)
user.read Can read all properties of a user (details)
user.readbasic Can read all basic user properties (list)
Identity Protection Writer

Can read and execute all Identity and Access Command Blocks.

command.category.read Can read all corresponding Command Block categories
command.identityaccess.read Can read all identity access Command Blocks and jobs
command.identityaccess.write Can execute all identity access Command Blocks and jobs
command.jobs.read Can read related Command Block jobs
command.read Can read all related Command Blocks
command.schedules.read Can read all schedules Command Blocks and jobs
command.schedules.write Can write all schedules Command Blocks and jobs
organization.readbasic Can read all basic organization properties (list)
report.accesstoken.read Can read Power BI report access token (list)
report.read Can read Power BI reports (list)
user.read Can read all properties of a user (details)
user.readbasic Can read all basic user properties (list)
Microsoft Entra ID Authentication Methods Reader

Can read all Identity and Access Command Blocks.

command.category.read Can read all corresponding Command Block categories
command.identityaccess.authenticationmethods.read Can read all Microsoft Entra ID authentication methods Command Blocks and jobs
command.jobs.read Can read related Command Block jobs
command.read Can read all related Command Blocks
command.schedules.read Can read all schedules Command Blocks and jobs
organization.readbasic Can read all basic organization properties (list)
report.accesstoken.read Can read Power BI report access token (list)
report.read Can read Power BI reports (list)
user.read Can read all properties of a user (details)
user.readbasic Can read all basic user properties (list)
Microsoft Entra ID Authentication Methods Writer

Can read and execute all Identity and Access Command Blocks.

command.category.read Can read all corresponding Command Block categories
command.identityaccess.authenticationmethods.read Can read all Microsoft Entra ID authentication methods Command Blocks and jobs
command.identityaccessessentials.writer Can execute all Identity and Access Essentials jobs
command.jobs.read Can read related Command Block jobs
command.read Can read all related Command Blocks
command.schedules.read Can read all schedules Command Blocks and jobs
command.schedules.write Can write all schedules Command Blocks and jobs
organization.readbasic Can read all basic organization properties (list)
report.accesstoken.read Can read Power BI report access token (list)
report.read Can read Power BI reports (list)
user.read Can read all properties of a user (details)
user.readbasic Can read all basic user properties (list)
Microsoft Entra ID Domains Reader

Can read all Identity and Access Command Blocks.

command.category.read Can read all corresponding Command Block categories
command.identityaccess.domains.read Can read all identity access domain Command Blocks and jobs
command.jobs.read Can read related Command Block jobs
command.read Can read all related Command Blocks
command.schedules.read Can read all schedules Command Blocks and jobs
organization.readbasic Can read all basic organization properties (list)
report.accesstoken.read Can read Power BI report access token (list)
report.read Can read Power BI reports (list)
user.read Can read all properties of a user (details)
user.readbasic Can read all basic user properties (list)
Microsoft Entra ID Domains Writer

Can read and execute all Identity and Access Command Blocks.

command.category.read Can read all corresponding Command Block categories
command.identityaccess.domains.read Can read all identity access domain Command Blocks and jobs
command.identityaccessessentials.write Can execute all identity access domain Command Block jobs
command.jobs.read Can read related Command Block jobs
command.read Can read all related Command Blocks
command.schedules.read Can read all schedules Command Blocks and jobs
command.schedules.write Can write all schedules Command Blocks and jobs
organization.readbasic Can read all basic organization properties (list)
report.accesstoken.read Can read Power BI report access token (list)
report.read Can read Power BI reports (list)
user.read Can read all properties of a user (details)
user.readbasic Can read all basic user properties (list)
Microsoft Entra ID Group Reader

Can read all Identity and Access Essentials Command Blocks.

command.category.read Can read all corresponding Command Block categories
command.identityaccess.read Can read all identity access Command Blocks and jobs
command.jobs.read Can read related Command Block jobs
command.read Can read all related Command Blocks
command.schedules.read Can read all schedules Command Blocks and jobs
organization.readbasic Can read all basic organization properties (list)
report.accesstoken.read Can read Power BI report access token (list)
report.read Can read Power BI reports (list)
user.read Can read all properties of a user (details)
user.readbasic Can read all basic user properties (list)
Microsoft Entra ID Group Writer

Can read and execute all Identity and Access Essentials Command Blocks.

command.category.read Can read all corresponding Command Block categories
command.identityaccess.read Can read all identity access Command Blocks and jobs
command.identityaccess.write Can execute all identity access Command Blocks and jobs
command.jobs.read Can read related Command Block jobs
command.read Can read all related Command Blocks
command.schedules.read Can read all schedules Command Blocks and jobs
command.schedules.write Can write all schedules Command Blocks and jobs
organization.readbasic Can read all basic organization properties (list)
report.accesstoken.read Can read Power BI report access token (list)
report.read Can read Power BI reports (list)
user.read Can read all properties of a user (details)
user.readbasic Can read all basic user properties (list)
Microsoft Entra ID Organization Reader

Can read all Identity and Access Command Blocks.

command.category.read Can read all corresponding Command Block categories
command.identityaccess.organizations.read Can read all Microsoft Identity Access Organization Command Blocks and jobs
command.jobs.read Can read related Command Block jobs
command.read Can read all related Command Blocks
command.schedules.read Can read all schedules Command Blocks and jobs
organization.readbasic Can read all basic organization properties (list)
report.accesstoken.read Can read Power BI report access token (list)
report.read Can read Power BI reports (list)
user.read Can read all properties of a user (details)
user.readbasic Can read all basic user properties (list)
Microsoft Entra ID Organization Writer

Can read and execute all Identity and Access Command Blocks.

command.category.read Can read all corresponding Command Block categories
command.identityaccess.organizations.read Can read all Microsoft Identity Access Organization Command Blocks and jobs
command.identityaccess.organizations.write Can write all Microsoft Identity Access Organization Command Blocks and jobs
command.jobs.read Can read related Command Block jobs
command.read Can read all related Command Blocks
command.schedules.read Can read all schedules Command Blocks and jobs
command.schedules.write Can write all schedules Command Blocks and jobs
organization.readbasic Can read all basic organization properties (list)
report.accesstoken.read Can read Power BI report access token (list)
report.read Can read Power BI reports (list)
user.read Can read all properties of a user (details)
user.readbasic Can read all basic user properties (list)
Microsoft Entra Reader

Can read all Identity and Access Command Blocks.

command.category.read Can read all corresponding Command Block categories
command.identityaccess.read Can read all identity access Command Blocks and jobs
command.jobs.read Can read related Command Block jobs
command.read Can read all related Command Blocks
command.schedules.read Can read all schedules Command Blocks and jobs
organization.readbasic Can read all basic organization properties (list)
report.accesstoken.read Can read Power BI report access token (list)
report.read Can read Power BI reports (list)
user.read Can read all properties of a user (details)
user.readbasic Can read all basic user properties (list)
Microsoft Entra Writer

Can read and execute all Identity and Access Command Blocks.

command.category.read Can read all corresponding Command Block categories
command.identityaccess.read Can read all identity access Command Blocks and jobs
command.identityaccess.write Can execute all identity access Command Blocks and jobs
command.jobs.read Can read related Command Block jobs
command.read Can read all related Command Blocks
command.schedules.read Can read all schedules Command Blocks and jobs
command.schedules.write Can write all schedules Command Blocks and jobs
organization.readbasic Can write all basic organization properties (list)
report.accesstoken.read Can read Power BI report access token (list)
report.read Can read Power BI reports (list)
user.read Can read all properties of a user (details)
user.readbasic Can read all basic user properties (list)
Microsoft Entra Role Reader

Can read all Identity and Access Command Blocks.

command.category.read Can read all corresponding Command Block categories
command.identityaccess.roles.read Can read all identity access roles Command Blocks and jobs
command.jobs.read Can read related Command Block jobs
command.read Can read all related Command Blocks
command.schedules.read Can read all schedules Command Blocks and jobs
organization.readbasic Can read all basic organization properties (list)
report.accesstoken.read Can read Power BI report access token (list)
report.read Can read Power BI reports (list)
user.read Can read all properties of a user (details)
user.readbasic Can read all basic user properties (list)
Microsoft Entra Role Writer

Can read and execute all Identity and Access Command Blocks.

command.category.read Can read all corresponding Command Block categories
command.identityaccess.roles.read Can read all identity access roles Command Blocks and jobs
command.identityaccess.roles.write Can execute all identity access roles Command Blocks and jobs
command.jobs.read Can read related Command Block jobs
command.read Can read all related Command Blocks
command.schedules.read Can read all schedules Command Blocks and jobs
command.scheduleswrite Can write all schedules Command Blocks and jobs
organization.readbasic Can read all basic organization properties (list)
report.accesstoken.read Can read Power BI report access token (list)
report.read Can read Power BI reports (list)
user.read Can read all properties of a user (details)
user.readbasic Can read all basic user properties (list)

Related articles

Updated: Jun 03, 2024