Ho to grant a user (intern) read only access to all apps

Question

Hello,

I need to find a way to give a new intern read only access to all of our applications. I'm finding it challenging to locate any information on this. We want them to be able to see all app content without the ability to make changes. I was hoping I could do this at the group level. Anyone know how to achieve this?

Answer 1

Hello @Mary,

If the interns accounts are member users of your Entra tenant, then all member users in the organization can read application related information by default. This is one of the default user permissions. They can read all the details except for few like sign-in logs, audit logs or provisioning logs which are security related.

However, if the interns have guest account, they would not have the read permission by default. Then custom roles can be defined by adding the correct permissions.

Please follow below document to know how to create a custom role: Create custom role
To get the list of read permission required for application, please refer the below documents, they list all the permissions that can be assigned, you may choose as per your requirement.
https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/custom-available-permissions#read
https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/custom-enterprise-app-permissions
https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/custom-consent-permissions

Once you've created the custom role, you can assign it to any group or by creating a role assignable group. In role assignable group the custom role can be selected while creating the group or later as well. You can add member users as well as guests to this group.
To create role assignable group please refer document: Role assignable groups

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".