How do we check if the logged in user is an admin

Question

We are wanting to check if the logged in user is an admin within the tenant so that we can ensure certain features are Admin only and need a reliable way to check this. We are hoping to do this without requiring the Directory.Read.All scope that I believe is necessary when checking the me/memberOf endpoint for the roles.

Answer 1

Hi Pawlu Muscat,

Thanks for reaching out to Microsoft!

To check if a logged-in user is an admin within the tenant, you can use the Get directoryRoleTemplate or the unified RBAC API. The unified RBAC API provides more functionality and flexibility with the Get unifiedRoleDefinition endpoint.

You can find more information on these APIs in the following links:

https://learn.microsoft.com/en-us/graph/api/directoryroletemplate-get?view=graph-rest-1.0&tabs=http

https://learn.microsoft.com/en-us/graph/api/unifiedroledefinition-get?view=graph-rest-1.0&tabs=http

Hope this helps.

If the answer is helpful, please click Accept Answer and kindly upvote. If you have any further questions about this answer, please click Comment.

Answer 2

Calling the /me/memberOf/microsoft.graph.directoryRole endpoint is your best option. Alternatively, you can decode the access token and parse the wids claim therein, which contains the set of roles the user is currently assigned to.