Policy.Read.All
RoleManagement.Read.Directory
— application permissions, granted to the app registration with admin consent.
Licence: Microsoft Entra ID P1 (Conditional Access, authentication strengths).
Endpoints:
GET /v1.0/identity/conditionalAccess/policies · GET /v1.0/roleManagement/directory/roleAssignments
A role counts as covered when an enforced policy targets the role (or all users), all cloud apps, and uses an authentication strength whose name contains 'phishing'. Report-only policies do not count.
If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.
Phishing-resistant MFA for Admins
Push and SMS MFA can be phished with adversary-in-the-middle kits; passkeys, FIDO2 keys, Windows Hello and certificates cannot. Microsoft recommends requiring the built-in 'Phishing-resistant MFA' authentication strength for every privileged role. One row per privileged role that has members.
No privileged role has members.