How to check default user permissions in Microsoft Entra ID

Before you start

Use an account in the Global Reader role, which can read everything a Global Administrator can and change nothing. The PowerShell example requests Policy.Read.All; your organisation may require administrator consent. No extra licence is needed.

Know what the settings cover. They say whether users can register applications, create security groups, create tenants, read other users and read the BitLocker keys of devices they own, and which policy, if any, lets them consent to apps. Who can create Microsoft 365 groups is a separate group setting, and guests have their own access level. The examples read and export; they change nothing.

Option 1

Check default user permissions with PowerShell

Install the modules once, then connect, read the policy and save the default permissions to a CSV.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Identity.SignIns -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'Policy.Read.All' -NoWelcome
try {
    $defaults = (Get-MgPolicyAuthorizationPolicy).DefaultUserRolePermissions
    # An empty list means users can't consent to apps.
    $consent = @($defaults.PermissionGrantPoliciesAssigned) -join '; '
    if (-not $consent) { $consent = 'None (user consent is off)' }
    $report = [pscustomobject]@{
        RegisterApplications  = $defaults.AllowedToCreateApps
        CreateSecurityGroups  = $defaults.AllowedToCreateSecurityGroups
        CreateTenants         = $defaults.AllowedToCreateTenants
        ReadOtherUsers        = $defaults.AllowedToReadOtherUsers
        ReadOwnBitLockerKeys  = $defaults.AllowedToReadBitlockerKeysForOwnedDevice
        ConsentPolicies       = $consent
    }
    $report | Export-Csv -Path './default-user-permissions.csv' -NoTypeInformation -Encoding utf8
    $report | Format-List
} finally {
    Disconnect-MgGraph | Out-Null
}

True means users without an admin role can do it. CreateTenants set to False still lets people in the Tenant Creator role create tenants. ConsentPolicies lists entries in the form managePermissionGrantsForSelf.{id}, where the ID names the app consent policy that governs what users may consent to. ReadOtherUsers is the one setting that exists only in Microsoft Graph and PowerShell; Microsoft says not to set it to false, because it can stop people reading user information in services such as Microsoft Teams.

Option 2

Check default user permissions in the admin centre

1. Sign in to the Microsoft Entra admin centre for the correct tenant.
2. Go to Entra ID > Users > User settings.
3. Under Default user role permissions, read Users can register applications, Restrict non-admin users from creating tenants and Users can create security groups. Note that Yes on the tenant setting means users can't create tenants.
4. For user consent, go to Entra ID > Enterprise apps > Consent and permissions and read which option is selected.
5. Leave each page without saving.

This suits a look at 1 tenant. The BitLocker setting is under device settings, and the read other users setting isn't on these pages at all. For a record you can compare month to month, use PowerShell or a report.

Common questions

Does turning off security group creation stop everyone?

No. People in at least the User Administrator role can still create security groups, and who can create Microsoft 365 groups is set separately, in the group settings.

What's the safest setting for app registrations?

Set Users can register applications to No, then give the Application Developer role to the people who build apps. That role also lets them consent for themselves when user consent is off.

How do I see the apps users have already consented to?

These settings say what users may do next, not what they have done. To list the grants users have already made, with the user who consented, see how to find apps users have consented to.