Directory role

Also known as: Entra ID directory role, Microsoft Entra role, Entra role

A directory role is a Microsoft Entra admin role, such as Global Administrator or Teams Administrator, that grants a set of permissions across the tenant.

The Entra ID connector scans directory roles into the inventory. For each role, you can see the users who hold it, directly or through a security group.

Admin roles give wide access to your tenant, so the list of holders needs a regular check. Reviews do not cover directory roles, so use a report for that check.

For example, a custom report on the Entra ID object Directory Role with the related objects Role Users and Role Groups lists every role and its holders. A filter on the display name narrows it to roles such as Global Administrator.

Rencore Governance has no built-in action that removes a directory role. To remove one from an automation, add the action Send HTTP request with your own Microsoft Graph call.

Directory roles and Rencore roles

A directory role controls what a person can do in your Microsoft 365 tenant. A Rencore role, such as Owner or Admin, controls what a user can do in a Rencore Governance Workspace. The two are not linked.