Scoping Custom Role With microsoft.directory/auditLogs/allProperties/read Role Permission

Question

Hi Community,

Can you have a custom role with the microsoft.directory/auditLogs/allProperties/read role permission and use Admin Units to scope to devices only? Is this a scope'able permission?

Kind Regards,

Jamie

Answer 1

AUdit Logs are restricted to the users Admin units.

https://learn.microsoft.com/en-us/purview/audit-search?tabs=microsoft-purview-portal#scoping-access-to-audit-logs-using-administrative-units

You could test that out and add devices to the units:

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/admin-units-members-add#add-a-single-user-group-or-device-to-administrative-units

Answer 2

This permission is delegatable - as illustrated by https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference and the corresponding roles (such as Cloud Device Administrator) support Admin Unit-based delegation - so I'd expect this to work for custom roles as well.

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin