Entra Directory Roles — Tier Mapping¶
Part of Privileged Access, PIM, and What Belongs in CI — see that page for the EAM/NIST/CAF/security-levels model this mapping applies.
Assigning or managing PIM eligibility for any directory role requires the same tenant-wide Graph permission (RoleManagement.ReadWrite.Directory) regardless of how sensitive the specific role looks. Per EAM, PIM/PAM administration is itself Control plane — so the mechanism used to configure eligibility is Control-plane-critical even when the role being configured (e.g., Global Reader) is not.
| Role | Tier | EAM plane | Project | Apply method | Role engineer needs on CLI |
|---|---|---|---|---|---|
| Global Administrator | 0 | Control | azure-priv-tier-0 |
CLI, human apply | PIM-activate Global Administrator |
| Privileged Role Administrator | 0 | Control | azure-priv-tier-0 |
CLI, human apply | PIM-activate Global Administrator (PRA can assign any role, including GA) |
| Security / Identity Governance / Groups / Application / User Administrator | 0 (mechanism) | Control (mechanism), bounded (capability) | azure-priv-tier-0 |
CLI, human apply | PIM-activate Privileged Role Administrator |
| Global Reader — read-only across almost all Entra/admin-center data | 0 (mechanism) / 2 (capability) | Control (mechanism) | azure-priv-tier-0 |
CLI, human apply | PIM-activate Privileged Role Administrator |
| Security Reader — read-only over Defender/Sentinel/Identity Protection data | 0 (mechanism) / 2 (capability) | Control (mechanism) | azure-priv-tier-0 |
CLI, human apply | PIM-activate Privileged Role Administrator |
Don't be fooled by read-only roles
Global Reader and Security Reader look harmless because the role is read-only. The mechanism used to grant them is not — it's the same Graph permission that can grant Global Administrator. Per EAM, that mechanism is Control plane; treat their eligibility management accordingly even though day-to-day use of the role itself is low-risk.
Privileged Role Administrator is a second path to Global Admin
Privileged Role Administrator can assign any directory role, including Global Administrator. Any control applied to Global Admin eligibility must apply equally to Privileged Role Administrator, or it's a bypass — this is why provisioning PRA itself requires GA, not PRA.
Machine identity creation & service principal permissions
Vending service principals that require directory roles or Microsoft Graph application consents follows the same Control-plane security boundary. See Service Principal Vending for the Lane A operating model and tripartite operator requirements governing azure-service-principals.