List Microsoft Entra role definitions

Article
01/24/2025

This article describes how to list the Microsoft Entra built-in and custom role definitions and their permissions using the Microsoft Entra admin center or Microsoft Graph PowerShell.

A role definition is a collection of permissions that can be performed, such as read, write, and delete. It's typically referred to as a role. Microsoft Entra ID has over 100 built-in roles or you can create your own custom roles. If you ever wondered "What do these roles really do?", you can access a detailed list of permissions for each of the roles.

Prerequisites

Microsoft Graph PowerShell module when using PowerShell

For more information, see Prerequisites to use PowerShell.

List Microsoft Entra role definitions

Admin center
PowerShell

Tip

Steps in this article might vary slightly based on the portal you start from.

Sign in to the Microsoft Entra admin center.
Browse to Identity > Roles & admins > Roles & admins.
Select a role name to open the role. Don't add a check mark next to the role.
Select Description to see the summary and list of permissions for the role.

The page includes links to relevant documentation to help guide you through managing roles.

Follow these steps to list Microsoft Entra roles with PowerShell.

Open a PowerShell window. If necessary, use Install-Module to install Microsoft Graph PowerShell. For more information, see Prerequisites to use PowerShell.
```
Install-Module Microsoft.Graph -Scope CurrentUser
```

In a PowerShell window, use Connect-MgGraph to sign in to your tenant.

Connect-MgGraph -Environment China -ClientId 'YOUR_CLIENT_ID' -TenantId 'YOUR_TENANT_ID' -Scopes "RoleManagement.Read.All"

Use Get-MgRoleManagementDirectoryRoleDefinition to get roles.

# Get all role definitions
Get-MgRoleManagementDirectoryRoleDefinition

# Get single role definition by ID
Get-MgRoleManagementDirectoryRoleDefinition -UnifiedRoleDefinitionId 00000000-0000-0000-0000-000000000000

# Get single role definition by templateId
Get-MgRoleManagementDirectoryRoleDefinition -Filter "TemplateId eq 'c4e39bd9-1100-46d3-8c65-fb160da0071f'"

# Get role definition by displayName
Get-MgRoleManagementDirectoryRoleDefinition -Filter "displayName eq 'Helpdesk Administrator'"

To view the list of permissions of a role, use the following cmdlet.

# Do this avoid truncation of the list of permissions
$FormatEnumerationLimit = -1

(Get-MgRoleManagementDirectoryRoleDefinition -Filter "displayName eq 'Conditional Access Administrator'").RolePermissions | Format-list

Next steps