05Access
Recommended roles
AccessLens uses delegated permissions, so it can only access data the signed-in user is already authorised to see. That user needs a role granting read access to Conditional Access policies.
Role comparison
Security Reader
5d6b6bb7-de71-4623-b4af-96380a352509Advantages
- Can read Conditional Access policies
- Can read security-related reports and audit logs
- Commonly assigned to SOC analysts and security teams
Considerations
- Broader than needed: includes access to security alerts, Defender, and identity protection reports
Global Reader
f2ef992c-3afb-46b9-b7cf-a126ee74c451Advantages
- Can read Conditional Access policies
- Read access across all admin centers
- Useful for consultants who need broad read-only visibility
Considerations
- Very broad: includes read access to everything a Global Admin can see
- May expose more information than necessary for CA policy review
Why not a custom role?
Microsoft Entra custom roles do not currently support the microsoft.directory/conditionalAccessPolicies/standard/read permission for delegated API access. This means custom roles cannot grant the access AccessLens needs through the Graph API.
Conditional Access Administrator
While the Conditional Access Administrator role works with AccessLens, we do not recommend it because it includes write permissions. Since AccessLens only reads policies, assigning a role with write capability violates least-privilege principles.