How to list admin role assignments in Microsoft Entra ID

Before you start

Use an account that can read role assignments: Global Reader or Privileged Role Administrator covers both PowerShell examples. They request RoleManagement.Read.Directory and RoleEligibilitySchedule.Read.Directory, and your organisation may require administrator consent. Eligible assignments need Microsoft Entra ID P2.

The list shows active assignments, and a role held through a group lists the group. The scope shows how far an assignment reaches: / is the whole tenant. The examples read and export; they do not change any role.

Option 1

List admin role assignments with PowerShell

Install the modules once, then export every active assignment with its role, holder and scope. The script reads the role names first, then each assignment with its holder. Global Administrator sorts to the top.

# Install once, if the modules are not already installed.
$modules = 'Microsoft.Graph.Authentication', 'Microsoft.Graph.Identity.Governance'
Install-Module $modules -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'RoleManagement.Read.Directory' -NoWelcome
try {
    $roles = @{}
    Get-MgRoleManagementDirectoryRoleDefinition -All |
        ForEach-Object { $roles[$_.Id] = $_.DisplayName }
    $assignments = Get-MgRoleManagementDirectoryRoleAssignment -All -ExpandProperty principal
    $report = @($assignments | ForEach-Object {
        $who = $_.Principal.AdditionalProperties
        [pscustomobject]@{
            Role              = $roles[$_.RoleDefinitionId]
            Principal         = $who['displayName']
            UserPrincipalName = $who['userPrincipalName']
            PrincipalType     = $who['@odata.type'] -replace '^#microsoft\.graph\.', ''
            DirectoryScopeId  = $_.DirectoryScopeId
        }
    } | Sort-Object @{ Expression = { $_.Role -ne 'Global Administrator' } }, Role, Principal)
    if ($report.Count -eq 0) {
        Write-Output 'No active directory role assignments were found.'
    } else {
        $report | Export-Csv -Path './admin-role-assignments.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) active role assignments exported."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

PrincipalType says whether the holder is a user, a group or a service principal. To look at 1 holder, add -Filter "principalId eq 'object-id'" to the Get-MgRoleManagementDirectoryRoleAssignment line.

Add eligible assignments

These have their own cmdlet and permission. Run this on its own.

$ErrorActionPreference = 'Stop'
$scopes = 'RoleEligibilitySchedule.Read.Directory', 'RoleManagement.Read.Directory'
Connect-MgGraph -Scopes $scopes -NoWelcome
try {
    $roles = @{}
    Get-MgRoleManagementDirectoryRoleDefinition -All |
        ForEach-Object { $roles[$_.Id] = $_.DisplayName }
    $schedules = Get-MgRoleManagementDirectoryRoleEligibilitySchedule -All `
        -ExpandProperty principal
    $report = @($schedules | ForEach-Object {
        $who = $_.Principal.AdditionalProperties
        [pscustomobject]@{
            Role              = $roles[$_.RoleDefinitionId]
            Principal         = $who['displayName']
            UserPrincipalName = $who['userPrincipalName']
            MemberType        = $_.MemberType
            DirectoryScopeId  = $_.DirectoryScopeId
        }
    } | Sort-Object Role, Principal)
    if ($report.Count -eq 0) {
        Write-Output 'No eligible role assignments were found.'
    } else {
        $report | Export-Csv -Path './eligible-assignments.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) eligible role assignments exported."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

MemberType says whether the eligibility is Direct, held through a Group or Inherited.

Option 2

List admin role assignments in the admin centre

1. Sign in to the Microsoft Entra admin centre for the correct tenant.
2. Go to Entra ID > Roles & admins.
3. To download everything, select All roles, then Download assignments, enter a file name and select Start bulk operation. The CSV lists active assignments at all scopes.
4. To look at 1 role, select its name, then Assignments. The Scope column shows Directory for tenant-wide assignments.
5. To look at 1 person, go to Entra ID > Users, select the name, then Assigned roles. It shows whether each role is held directly or through a group.

This suits a one-off download or a look at 1 role or person. The download is a bulk operation that runs for up to 1 hour, has limits in large tenants and lists a group, not its members. For a repeatable list with eligible assignments, use PowerShell or Altivane.

Common questions

Why does the list show a group instead of people?

A role-assignable group can hold a role, so the group is the holder and the people are its members. A person's Assigned roles page shows whether a role is direct or through a group, and Altivane's Privileged People table lists people once groups are expanded.

Why are some assignments missing?

The standard list holds active assignments. Eligible ones need Microsoft Entra ID P2: use the eligible example, or open a role in the admin centre.

Do my administrators have MFA?

A role list does not say. Altivane's Privileged People table has an MFA Registered column; for the whole tenant, see how to find users without MFA, which puts administrators first.