See who holds admin roles
AI summary
Use reports to see which Entra ID directory roles are assigned and to whom. Create policies to identify role holders that break your rules, such as admins without multifactor authentication or external users with admin access. To remove a role assignment, you will need to call the Microsoft Graph API directly.
See who holds which Entra ID directory roleDirectory roleA directory role is a Microsoft Entra admin role, such as Global Administrator or Teams Administrator, that grants a set of permissions across the tenant.Read more, and find the role holders who should not have one.
Before you begin
- Your Rencore role needs the permissions to create reports and policies. See Rencore roles.
- Entra IDMicrosoft Entra IDMicrosoft Entra ID, formerly Azure Active Directory, is the Microsoft identity service behind every Microsoft 365 tenant.Read more and Microsoft 365Microsoft 365Microsoft 365 is the Microsoft cloud suite of Teams, SharePoint, OneDrive, Exchange and the Office apps.Read more are connected and scanned. Directory roles are part of the Entra ID inventory. See the Entra ID inventory reference.
Steps
List the role holders
To report on directory roles, you will need to:
- Go to Reports > Add Report.
- Click Create Custom ReportReportA report is a saved query over the inventory that Rencore Governance shows as a chart, list, table or KPI, for example unused SharePoint site collections larger than 1 GB.Read more. See Create a Custom Report.
- On the “Logic” screen, select the Entra ID object “Directory Role”.
- Add the related objectRelationA relation links one inventory object to another, such as a Team to its owners, members and channels.Read more “Role Users” to the logic, so each row shows the role and its holder. Add “Role Groups” as well for roles that are assigned to a group. Both include assignments made directly and through a security groupSecurity groupA security group is a Microsoft Entra group that gives a set of users access to resources.Read more.
- To report on a few roles only, add a filter on “Display Name”, for example “Global AdministratorGlobal administratorGlobal Administrator is the Microsoft Entra admin role with access to every administrative feature in the tenant, including giving admin consent to apps for the whole organization.Read more”.
- On the “Visualization” screen, choose a table, then save the report.
Flag holders that break your rule
- Go to Policies > Policy Options ([…]) > Create Policy.
- Start from one of these templates:
- Global administrators without MFA
- Administrators without MFA
- Admin accounts with an Office 365 E3 license assigned. In the logic, change the prefix or suffix of the admin accounts to the one your company uses.
- For your own rule, Create a Policy from a Report and add the condition, for example role holders who are external or disabled.
- Save the policy. See Create a Policy from a Template or Create a Policy from a Report, depending on where you started.
Remove a role
Rencore Governance has no built-in actionBuilt-in actionA built-in action is a ready-made operation you run directly on inventory objects without building an automation, for example adding a user to a Team.Read more that removes a directory role. To remove one from an automation, add the action “Send HTTP requestWebhookA webhook is a URL another system listens on, so that a call to it starts something there.Read more” with your own call to the Microsoft Graph APIMicrosoft GraphMicrosoft Graph is the Microsoft API that gives access to the data of the Microsoft 365 services.Read more. See Create a Custom Automation.
What you see
The report shows each role with its holders. The policies list each holder that breaks a rule. After a role is removed in Entra ID, the holder leaves the policy on the next scan.
Limits
- There is no review for directory roles. Use the report as your regular check, or share it with the people who sign off on admin access.
- Removing a role needs your own Microsoft Graph call.
Frequently asked questions
How do I report on who holds each Entra ID directory role?
How do I report on who holds each Entra ID directory role?Go to Reports > Add Report and click Create Custom Report. On the Logic screen, select the Entra ID object Directory Role and add the related object Role Users. Add Role Groups for roles assigned to a group, then choose a table and save.
Does the directory role report include assignments made through a security group?
Yes. Role Users and Role Groups both include assignments made directly and through a security group. Add Role Groups to cover roles that are assigned to a group.
Which policy templates flag admin accounts that break a rule?
Start from the templates Global administrators without MFA, Administrators without MFA, or Admin accounts with an Office 365 E3 license assigned. In the logic, change the prefix or suffix of the admin accounts to the one your company uses.
Can Rencore Governance remove a directory role from a user?
No. Rencore Governance has no built-in action that removes a directory role. In a custom automation, add the action Send HTTP request with your own call to the Microsoft Graph API.
When does a holder leave the policy after I remove their role in Entra ID?
When does a holder leave the policy after I remove their role in Entra ID?The holder leaves the policy on the next scan after the role is removed in Entra ID.
Was this page helpful?
Thanks for the feedback.
Thanks. What was wrong?