Entra ID Roles

The question it answers: Which directory roles are activated in the tenant, and how many active direct members does each have?

Note

Lists the directory roles activated in the tenant; Members counts their active direct members, not eligible (PIM) assignments. The Global Administrators tile counts distinct users holding the role - direct, through a role-assignable group, active or eligible.

At a glance

Where in the app	Entra ID › Roles › All Roles
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	No extra licence needed.
Report id (API and MCP)	entra.directory-roles.all

Columns

Column	Key	Type
Display Name	DisplayName	Text
Description	Description	Text
Members	Members.Count	Text

What it needs

Licence: No extra licence needed.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
RoleManagement.Read.Directory	Microsoft Graph	Read all directory RBAC settings

Data sources it reads

• GET /v1.0/directoryRoles?$expand=members

Through the API and MCP

GET /ir-api/v1/reports/entra.directory-roles.all?size=100

An AI assistant reads it with the MCP tool get_report and the id entra.directory-roles.all. The client needs the Read grant for Entra ID. See Using the API.