Entra ID Roles - Privileged Role Members

The question it answers: Who holds an active or eligible assignment of a role Microsoft marks as privileged?

Note

Lists active and eligible (PIM) assignments of every role Microsoft marks as privileged, all pages. Users, service principals and role-assignable groups are resolved (for a group the UPN column shows its mail address); a principal that is none of these shows ‘Unknown’ with its object id. Members of an assigned group are not expanded.

At a glance

Where in the app	Entra ID › Roles › Privileged Role Members
Workload	Entra ID
Kind	Table
Data	Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report.
Licence	None for active assignments; Microsoft Entra ID P2 for eligible (PIM) assignments.
Report id (API and MCP)	entra.directory-roles.privileged-role-members

Columns

Column	Key	Type
Role Name	RoleName	Text
Display Name	DisplayName	Text
UPN	UPN	Text
Entity Type	EntityType	Text
Assignment Type	AssignmentType	Text

What it needs

Licence: None for active assignments; Microsoft Entra ID P2 for eligible (PIM) assignments.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
RoleManagement.Read.Directory	Microsoft Graph	Read all directory RBAC settings
Application.Read.All	Microsoft Graph	Read all applications
User.Read.All	Microsoft Graph	Read all users’ full profiles
Group.Read.All	Microsoft Graph	Read all groups

Data sources it reads

• PowerShell: Get-MgBetaRoleManagementDirectoryRoleDefinition -Filter "isPrivileged eq true" (GET /beta/roleManagement/directory/roleDefinitions)
• PowerShell: Get-MgRoleManagementDirectoryRoleAssignment -All (GET /v1.0/roleManagement/directory/roleAssignments, per role)
• PowerShell: Get-MgRoleManagementDirectoryRoleEligibilityScheduleInstance -All (GET /v1.0/roleManagement/directory/roleEligibilityScheduleInstances, per role)
• PowerShell: Get-MgServicePrincipal -All (GET /v1.0/servicePrincipals)
• PowerShell: Get-MgUser -All (GET /v1.0/users)
• PowerShell: Get-MgGroup -All -Filter 'isAssignableToRole eq true' (GET /v1.0/groups)

Through the API and MCP

GET /ir-api/v1/reports/entra.directory-roles.privileged-role-members?size=100

An AI assistant reads it with the MCP tool get_report and the id entra.directory-roles.privileged-role-members. The client needs the Read grant for Entra ID. See Using the API.