Understanding Permissions
In Microsoft Entra ID, permissions define what operations a user can perform. They can apply to viewing, modifying, or managing directory objects.
Permissions are generally derived from:
Member vs. Guest User Permissions
| Permission Example | Member Users | Guest Users |
|---|---|---|
| Enumerate list of users | Yes | No |
| Invite guest users | Yes | Yes |
| Create Security and M365 groups | Yes | No |
| Register new applications | Yes | Limited (Read-only on apps) |
| Read directory data | Broad access | Restricted to own info |
Example: If Contoso invites an external consultant from Fabrikam, that guest can log in, view their own profile, and access assigned apps — but cannot browse all Contoso users.
Controlling and Restricting Permissions
Administrators manage user permissions primarily via:
Always apply the principle of least privilege, granting only what’s needed.
Exploring Role Permissions
Each built-in or custom role has an explicit list of permissions. You can view these by navigating to:
Example: Viewing the User Administrator role reveals permissions like microsoft.directory/users/read and microsoft.directory/groups/update.
Key Takeaways