Role-assignable Group Membership & Changes

The question it answers: Which role-assignable groups grant directory roles, who is in them and who owns them, and what in them needs review?

A role-assignable group hands its directory roles to every member. Adding someone to the group is the same as making them an administrator - and every owner of the group can do that. This report lists each such group, the roles it grants, who is in it, who owns it, and recent membership changes.

Note

Change history comes from the directory audit log behind the Directory Changes report - 30 days at most, and less if Entra retains less.

At a glance

Where in the app	Entra ID › Security › Role-assignable Groups
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Entra ID P1 to create role-assignable groups; P2 for the eligible (PIM) assignments.
Report id (API and MCP)	entra.security.role-assignable-groups

Columns

Column	Key	Type
Group	DisplayName	Link
Status	Severity	Status
Findings	FindingsString	Text
Roles granted	RolesGrantedString	Text
Members	MemberCount	Text
Member names	MembersString	Text
Owners	OwnersString	Text
Changes	ChangesLast30Days	Text
Last change	LastChange	DateTime

What it needs

Licence: Microsoft Entra ID P1 to create role-assignable groups; P2 for the eligible (PIM) assignments.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Group.Read.All	Microsoft Graph	Read all groups
RoleManagement.Read.Directory	Microsoft Graph	Read all directory RBAC settings
AuditLog.Read.All	Microsoft Graph	Read all audit log data

Data sources it reads

• GET /v1.0/groups?$filter=isAssignableToRole eq true
• GET /v1.0/groups/{id}/members, /owners
• GET /v1.0/roleManagement/directory/roleAssignments
• GET /v1.0/auditLogs/directoryAudits

Through the API and MCP

GET /ir-api/v1/reports/entra.security.role-assignable-groups?size=100

An AI assistant reads it with the MCP tool get_report and the id entra.security.role-assignable-groups. The client needs the Read grant for Entra ID. See Using the API.

Related reports

• Role-assignable Group Changes - What changed in role-assignable groups in the audit window, and who changed it?