Provide a user with read only access to Entra ID Connect / Azure AD Connect configuration

Question

I have a requirement to provide a user account with ongoing read only access to the configuration of Entra ID Connect.

Is this possible and if so, what permissions/roles are required to only view the configuration of Entra ID Connect?

Answer 1

Hi there,

There's no built-in role for this, and I am not aware of a custom role you could create for this either (source: https://www.azadvertizer.net/azentraidroleactions/microsoft.directory_directorysync_allproperties_alltasks.html).

The only specific custom role related to Entra Connect allows write actions so this is not a solution.

By default everyone can 'read' Entra, unless you've changed that then the built-in RBAC role 'Directory Readers' will allow the user to view 'Entra Connect' configuration as read-only, but also all of Microsoft Entra.

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference?directory-readers

Hope this answers your question. If it does, please mark as accepted.