Identity and Access roles and permissions

Role	Permission	Description
Identity and Access Essentials Reader Can read all Identity and Access Essentials Command Blocks.	command.category.read	Can read all corresponding Command Block categories
	command.identityaccessessentials.read	Can read all Identity and Access Essentials Command Blocks and jobs
	command.jobs.read	Can read related Command Block jobs
	command.read	Can read all related Command Blocks
	command.schedules.read	Can read all schedules Command Blocks and jobs
	organization.readbasic	Can read all basic organization properties (list)
	report.accesstoken.read	Can read Power BI report access token (list)
	report.read	Can read Power BI reports (list)
	user.read	Can read all properties of a user (details)
	user.readbasic	Can read all basic user properties (list)
Identity and Access Essentials Writer Can read and execute all Identity and Access Command Blocks.	command.category.read	Can read all corresponding Command Block categories
	command.identityaccessessentials.read	Can read all Identity and Access Essentials Command Blocks and jobs
	command.identityaccessessentials.write	Can execute all Identity and Access Essentials jobs
	command.jobs.read	Can read related Command Block jobs
	command.read	Can read all related Command Blocks
	command.schedules.read	Can read all schedules Command Blocks and jobs
	command.schedules.write	Can write all schedules Command Blocks and jobs
	organization.readbasic	Can read all basic organization properties (list)
	report.accesstoken.read	Can read Power BI report access token (list)
	report.read	Can read Power BI reports (list)
	user.read	Can read all properties of a user (details)
	user.readbasic	Can read all basic user properties (list)
Identity Protection Reader Can read all Identity and Access Command Blocks.	command.category.read	Can read all corresponding Command Block categories
	command.identityaccess.read	Can read all identity access Command Blocks and jobs
	command.jobs.read	Can read related Command Block jobs
	command.read	Can read all related Command Blocks
	command.schedules.read	Can read all schedules Command Blocks and jobs
	organization.readbasic	Can read all basic organization properties (list)
	report.accesstoken.read	Can read Power BI report access token (list)
	report.read	Can read Power BI reports (list)
	user.read	Can read all properties of a user (details)
	user.readbasic	Can read all basic user properties (list)
Identity Protection Writer Can read and execute all Identity and Access Command Blocks.	command.category.read	Can read all corresponding Command Block categories
	command.identityaccess.read	Can read all identity access Command Blocks and jobs
	command.identityaccess.write	Can execute all identity access Command Blocks and jobs
	command.jobs.read	Can read related Command Block jobs
	command.read	Can read all related Command Blocks
	command.schedules.read	Can read all schedules Command Blocks and jobs
	command.schedules.write	Can write all schedules Command Blocks and jobs
	organization.readbasic	Can read all basic organization properties (list)
	report.accesstoken.read	Can read Power BI report access token (list)
	report.read	Can read Power BI reports (list)
	user.read	Can read all properties of a user (details)
	user.readbasic	Can read all basic user properties (list)
Microsoft Entra ID Authentication Methods Reader Can read all Identity and Access Command Blocks.	command.category.read	Can read all corresponding Command Block categories
	command.identityaccess.authenticationmethods.read	Can read all Microsoft Entra ID authentication methods Command Blocks and jobs
	command.jobs.read	Can read related Command Block jobs
	command.read	Can read all related Command Blocks
	command.schedules.read	Can read all schedules Command Blocks and jobs
	organization.readbasic	Can read all basic organization properties (list)
	report.accesstoken.read	Can read Power BI report access token (list)
	report.read	Can read Power BI reports (list)
	user.read	Can read all properties of a user (details)
	user.readbasic	Can read all basic user properties (list)
Microsoft Entra ID Authentication Methods Writer Can read and execute all Identity and Access Command Blocks.	command.category.read	Can read all corresponding Command Block categories
	command.identityaccess.authenticationmethods.read	Can read all Microsoft Entra ID authentication methods Command Blocks and jobs
	command.identityaccessessentials.writer	Can execute all Identity and Access Essentials jobs
	command.jobs.read	Can read related Command Block jobs
	command.read	Can read all related Command Blocks
	command.schedules.read	Can read all schedules Command Blocks and jobs
	command.schedules.write	Can write all schedules Command Blocks and jobs
	organization.readbasic	Can read all basic organization properties (list)
	report.accesstoken.read	Can read Power BI report access token (list)
	report.read	Can read Power BI reports (list)
	user.read	Can read all properties of a user (details)
	user.readbasic	Can read all basic user properties (list)
Microsoft Entra ID Domains Reader Can read all Identity and Access Command Blocks.	command.category.read	Can read all corresponding Command Block categories
	command.identityaccess.domains.read	Can read all identity access domain Command Blocks and jobs
	command.jobs.read	Can read related Command Block jobs
	command.read	Can read all related Command Blocks
	command.schedules.read	Can read all schedules Command Blocks and jobs
	organization.readbasic	Can read all basic organization properties (list)
	report.accesstoken.read	Can read Power BI report access token (list)
	report.read	Can read Power BI reports (list)
	user.read	Can read all properties of a user (details)
	user.readbasic	Can read all basic user properties (list)
Microsoft Entra ID Domains Writer Can read and execute all Identity and Access Command Blocks.	command.category.read	Can read all corresponding Command Block categories
	command.identityaccess.domains.read	Can read all identity access domain Command Blocks and jobs
	command.identityaccessessentials.write	Can execute all identity access domain Command Block jobs
	command.jobs.read	Can read related Command Block jobs
	command.read	Can read all related Command Blocks
	command.schedules.read	Can read all schedules Command Blocks and jobs
	command.schedules.write	Can write all schedules Command Blocks and jobs
	organization.readbasic	Can read all basic organization properties (list)
	report.accesstoken.read	Can read Power BI report access token (list)
	report.read	Can read Power BI reports (list)
	user.read	Can read all properties of a user (details)
	user.readbasic	Can read all basic user properties (list)
Microsoft Entra ID Group Reader Can read all Identity and Access Essentials Command Blocks.	command.category.read	Can read all corresponding Command Block categories
	command.identityaccess.read	Can read all identity access Command Blocks and jobs
	command.jobs.read	Can read related Command Block jobs
	command.read	Can read all related Command Blocks
	command.schedules.read	Can read all schedules Command Blocks and jobs
	organization.readbasic	Can read all basic organization properties (list)
	report.accesstoken.read	Can read Power BI report access token (list)
	report.read	Can read Power BI reports (list)
	user.read	Can read all properties of a user (details)
	user.readbasic	Can read all basic user properties (list)
Microsoft Entra ID Group Writer Can read and execute all Identity and Access Essentials Command Blocks.	command.category.read	Can read all corresponding Command Block categories
	command.identityaccess.read	Can read all identity access Command Blocks and jobs
	command.identityaccess.write	Can execute all identity access Command Blocks and jobs
	command.jobs.read	Can read related Command Block jobs
	command.read	Can read all related Command Blocks
	command.schedules.read	Can read all schedules Command Blocks and jobs
	command.schedules.write	Can write all schedules Command Blocks and jobs
	organization.readbasic	Can read all basic organization properties (list)
	report.accesstoken.read	Can read Power BI report access token (list)
	report.read	Can read Power BI reports (list)
	user.read	Can read all properties of a user (details)
	user.readbasic	Can read all basic user properties (list)
Microsoft Entra ID Organization Reader Can read all Identity and Access Command Blocks.	command.category.read	Can read all corresponding Command Block categories
	command.identityaccess.organizations.read	Can read all Microsoft Identity Access Organization Command Blocks and jobs
	command.jobs.read	Can read related Command Block jobs
	command.read	Can read all related Command Blocks
	command.schedules.read	Can read all schedules Command Blocks and jobs
	organization.readbasic	Can read all basic organization properties (list)
	report.accesstoken.read	Can read Power BI report access token (list)
	report.read	Can read Power BI reports (list)
	user.read	Can read all properties of a user (details)
	user.readbasic	Can read all basic user properties (list)
Microsoft Entra ID Organization Writer Can read and execute all Identity and Access Command Blocks.	command.category.read	Can read all corresponding Command Block categories
	command.identityaccess.organizations.read	Can read all Microsoft Identity Access Organization Command Blocks and jobs
	command.identityaccess.organizations.write	Can write all Microsoft Identity Access Organization Command Blocks and jobs
	command.jobs.read	Can read related Command Block jobs
	command.read	Can read all related Command Blocks
	command.schedules.read	Can read all schedules Command Blocks and jobs
	command.schedules.write	Can write all schedules Command Blocks and jobs
	organization.readbasic	Can read all basic organization properties (list)
	report.accesstoken.read	Can read Power BI report access token (list)
	report.read	Can read Power BI reports (list)
	user.read	Can read all properties of a user (details)
	user.readbasic	Can read all basic user properties (list)
Microsoft Entra Reader Can read all Identity and Access Command Blocks.	command.category.read	Can read all corresponding Command Block categories
	command.identityaccess.read	Can read all identity access Command Blocks and jobs
	command.jobs.read	Can read related Command Block jobs
	command.read	Can read all related Command Blocks
	command.schedules.read	Can read all schedules Command Blocks and jobs
	organization.readbasic	Can read all basic organization properties (list)
	report.accesstoken.read	Can read Power BI report access token (list)
	report.read	Can read Power BI reports (list)
	user.read	Can read all properties of a user (details)
	user.readbasic	Can read all basic user properties (list)
Microsoft Entra Writer Can read and execute all Identity and Access Command Blocks.	command.category.read	Can read all corresponding Command Block categories
	command.identityaccess.read	Can read all identity access Command Blocks and jobs
	command.identityaccess.write	Can execute all identity access Command Blocks and jobs
	command.jobs.read	Can read related Command Block jobs
	command.read	Can read all related Command Blocks
	command.schedules.read	Can read all schedules Command Blocks and jobs
	command.schedules.write	Can write all schedules Command Blocks and jobs
	organization.readbasic	Can write all basic organization properties (list)
	report.accesstoken.read	Can read Power BI report access token (list)
	report.read	Can read Power BI reports (list)
	user.read	Can read all properties of a user (details)
	user.readbasic	Can read all basic user properties (list)
Microsoft Entra Role Reader Can read all Identity and Access Command Blocks.	command.category.read	Can read all corresponding Command Block categories
	command.identityaccess.roles.read	Can read all identity access roles Command Blocks and jobs
	command.jobs.read	Can read related Command Block jobs
	command.read	Can read all related Command Blocks
	command.schedules.read	Can read all schedules Command Blocks and jobs
	organization.readbasic	Can read all basic organization properties (list)
	report.accesstoken.read	Can read Power BI report access token (list)
	report.read	Can read Power BI reports (list)
	user.read	Can read all properties of a user (details)
	user.readbasic	Can read all basic user properties (list)
Microsoft Entra Role Writer Can read and execute all Identity and Access Command Blocks.	command.category.read	Can read all corresponding Command Block categories
	command.identityaccess.roles.read	Can read all identity access roles Command Blocks and jobs
	command.identityaccess.roles.write	Can execute all identity access roles Command Blocks and jobs
	command.jobs.read	Can read related Command Block jobs
	command.read	Can read all related Command Blocks
	command.schedules.read	Can read all schedules Command Blocks and jobs
	command.scheduleswrite	Can write all schedules Command Blocks and jobs
	organization.readbasic	Can read all basic organization properties (list)
	report.accesstoken.read	Can read Power BI report access token (list)
	report.read	Can read Power BI reports (list)
	user.read	Can read all properties of a user (details)
	user.readbasic	Can read all basic user properties (list)

Platform roles dictionary

Updated: Nov 13, 2024

Identity and Access roles and permissions

Related articles