RoleManagement.Read.Directory
— application permission, granted to the app registration with admin consent.
Licence: Microsoft Entra ID P2 (or Entra ID Governance) for the PIM view. Without it the report falls back to plain role assignments, which are all standing access.
Endpoints:
GET /v1.0/roleManagement/directory/roleAssignmentScheduleInstances · GET /v1.0/roleManagement/directory/roleEligibilityScheduleInstances · GET /v1.0/roleManagement/directory/roleAssignments · GET /v1.0/roleManagement/directory/roleDefinitions
Break-glass accounts are expected to hold Global Administrator permanently - see the Break-glass Account Health report.
If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.
Standing vs Just-in-time Admin Access
Who holds admin rights all the time that could instead be activated on demand through Privileged Identity Management. Every permanent privileged assignment is an account that can do damage the moment its credentials are stolen.
Without PIM every assignment below is standing access. If you do have Entra ID P2, check the permission and the error below.
Permanent privileged assignments
0
Candidates for converting to eligible
Global Administrators (active)
0
Microsoft recommends fewer than five
Eligible assignments
0
Just-in-time, activated on demand
Apps with privileged roles
0
Service principals cannot use PIM - review each
Privileged assignments by type
No privileged role assignments.
Permanent privileged assignments by role
No permanent privileged assignments.
Privileged roles only
Standing access only (permanent or time-bound)
No role assignments match these filters.