Urgent: Restrict Non-Admin Users from Viewing All Users in Azure

Question

Dear Team,

I need to modify the Azure profile for users who are not admins. Currently, students with an A3 license can view all users in the Office 365 admin panel without editing on it , which should not be the case.

Please assist in restricting their access as soon as possible. This is an urgent request.

Regards,

Answer 1

Hi @26652748

By default, Microsoft Entra ID (Azure AD) allows any user to access and read data about other users, which can potentially expose sensitive information.

In Entra ID, you can restrict access to the default user settings that allow reading all user attributes. To do this, you need to set the "Read other users" permission to false. This setting is available only in Microsoft Graph and PowerShell.

Setting this flag to $false prevents all non-admin users from reading user information from the directory. However, this flag does not prevent users from accessing information in other Microsoft services like Exchange Online. Additionally, Microsoft does not recommend setting this flag to $false.

Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization"
$BodyParams = @{
    defaultUserRolePermissions = @{
        allowedToReadOtherUsers = $false
    }
}
Invoke-MgGraphRequest -Uri "https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy" -Method PATCH -Body $BodyParams 

Once applied, non-admin users will see restricted access in the Entra Admin Center as shown below.

Hope this helps. Do let us know if you any further queries.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.