Custom Roles in Azure don't meet my requirements

Question

Hi!

I have a scenario where I want to add a few users to an Administrative Unit and make one user amongst them a 'Security Admin'. This user needs to be able to read sign-in logs of only the users in that Administrative Unit.

I tried creating a Custom Role and added microsoft.directory/signInReports/allProperties/read permission along with other Group-related permissions and scoped it to that Administrative Unit. It didn't work.

So far, no matter what I try, I'm either able to read the sign-in logs of all the users in the Directory, or, not able to read the logs of any user at all.

My question is, is it possible to make microsoft.directory/signInReports/allProperties/read permission scoped to the Administrative Unit? If not, is there a workaround to solve this problem and achieve the same goal?

Thanks!

Answer 1

You cannot scope this permission to specific AUs only. If you don't want to expose the full set of logs in your app, you'll have to filter them based on the AU membership yourself.