Custom Roles & Administrative Units

The question it answers: Which custom roles carry sensitive permissions, and which administrative units have no scoped admins?

Custom roles and administrative units are where delegated admin rights hide from the usual ‘who is Global Admin’ checks. A custom role that can reset passwords or change credentials is a privileged role, whatever its name; an administrative unit without scoped admins does nothing.

At a glance

Where in the app	Entra ID › Identity Hygiene › Custom Roles & Admin Units
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Entra ID P1 (custom roles, administrative units).
Report id (API and MCP)	entra.directory-roles.scoped-administration

Columns

Column	Key	Type
Name	DisplayName	Text
Kind	Category	Text
Finding	Finding	Status
Assignments	Value	Text
Permissions / roles	Detail	Text
State	Secondary	Text

What it needs

Licence: Microsoft Entra ID P1 (custom roles, administrative units).

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
RoleManagement.Read.Directory	Microsoft Graph	Read all directory RBAC settings
AdministrativeUnit.Read.All	Microsoft Graph	Read all administrative units

Data sources it reads

• GET /v1.0/roleManagement/directory/roleDefinitions?$filter=isBuiltIn eq false
• GET /v1.0/directory/administrativeUnits
• GET /v1.0/roleManagement/directory/roleAssignments

Through the API and MCP

GET /ir-api/v1/reports/entra.directory-roles.scoped-administration?size=100

An AI assistant reads it with the MCP tool get_report and the id entra.directory-roles.scoped-administration. The client needs the Read grant for Entra ID. See Using the API.