Security Reader
View security information and reports without changing security configuration.
Least-privilege guidance: Use for analysts who need broad security visibility but no response authority.
Assignment playbook
Grant the role without creating standing risk
Choose the narrowest role, scope, duration, and activation model that still completes the task.
Decision checks
- Confirm the operator needs to perform one of the listed tasks, not a broader adjacent task.
- Cannot remediate alerts or change security policy.
- Check whether a workload-specific role or administrative-unit scope can narrow access further.
Recommended assignment
- Use for analysts who need broad security visibility but no response authority.
- Prefer an eligible PIM assignment for occasional administration; use a time-bound active assignment only when the workflow requires it.
- Scope the assignment to an administrative unit or application when the role supports that scope.
- Require MFA, justification, approval, and a short activation duration for privileged roles where practical.
Verify
- Confirm the assignment appears at the expected scope and as eligible or active as designed.
- Activate the role if required, then test the smallest intended task and one nearby task that should remain denied.
- Review Entra audit logs for the assignment/activation and record the ticket or business justification.
Escalate when
- The role documentation lists the action but the activated, correctly scoped assignment still cannot perform it.
- The task succeeds only with a broader role; verify whether an additional Graph permission, workload RBAC role, ownership, or license is required.
- You can provide the principal, role, assignment scope/type, activation time, target resource, correlation ID, and sanitized audit event.
Role assignment evidence template
Role: Security Reader
Principal object ID: <guid>
Assignment scope: <tenant | administrative unit | application>
Assignment type: <eligible | active>
UTC activation/test time: <yyyy-mm-dd hh:mm:ssZ>
Correlation ID: <guid>Template only. Record object IDs in a private ticket; never include credentials or tokens.
Read role assignment schedule instances
GET https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignmentScheduleInstances?$filter=principalId eq '<object-id>'Read-only Microsoft Graph request. Requires an appropriately permissioned administrative session.
Advertisement
Common tasks
- Read security alerts
- Review security reports
- Investigate security posture
What it cannot do
Cannot remediate alerts or change security policy.