AI Reader

Privilegiada

Control PlaneEntraOps · EAMMicrosoft 365

Dado verificado em 30/06/2026 · Fonte

Role Actions

Control Plane

Management Plane

User Access

Template ID

1fe13547-53f6-408d-ac04-7f8eed167b38

Categoria

M365

EAM Tier

Control Plane (Tier 0)

Enterprise Access Model: Control Plane

Controle total do tenant. Comprometimento leva a takeover completo. Isole de planos inferiores.

Esta role é classificada como Control Plane porque 1 de 42 ações (2%) são desse tier — o tier da role acompanha sempre a ação de maior privilégio, não o conjunto.

1 Control Plane13 Management Plane28 User Access

Ação responsável:

microsoft.directory/agentUsers/lifeCycleInfo/read

Descrição

Read all aspects of Microsoft 365 Copilot and AI-related enterprise services in Microsoft 365.

Role Definition (JSON)

{
  "@odata.type": "#microsoft.graph.unifiedRoleDefinition",
  "id": "1fe13547-53f6-408d-ac04-7f8eed167b38",
  "displayName": "AI Reader",
  "description": "Read all aspects of Microsoft 365 Copilot and AI-related enterprise services in Microsoft 365.",
  "isBuiltIn": true,
  "isEnabled": true,
  "isPrivileged": true,
  "rolePermissions": [
    {
      "allowedResourceActions": [
        "microsoft.directory/agentUsers/lifeCycleInfo/read",

Permissões completas

Todas as 42 role actions desta role, classificadas por tier do EAM.

Role Action	Categoria	Tier
`microsoft.directory/agentUsers/lifeCycleInfo/read`	Global Agent User Management	Tier 0
`microsoft.azure.serviceHealth/allEntities/allTasks`	Support and Service Health	Tier 1
`microsoft.directory/entitlementManagement/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/groupSettingTemplates/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/groupSettings/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/groups/settings/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/organization/trustedCAsForPasswordlessAuth/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/users/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.office365.copilot/allEntities/allProperties/read`	Microsoft 365 Platform Operations	Tier 1
`microsoft.office365.messageCenter/messages/read`	Microsoft 365 Support Operations	Tier 1
`microsoft.office365.network/performance/allProperties/read`	Microsoft 365 Support Operations	Tier 1
`microsoft.office365.serviceHealth/allEntities/allTasks`	Microsoft 365 Support Operations	Tier 1
`microsoft.office365.usageReports/allEntities/allProperties/read`	Microsoft 365 Support Operations	Tier 1
`microsoft.office365.webPortal/allEntities/standard/read`	Microsoft 365 Support Operations	Tier 1
`microsoft.directory/administrativeUnits/members/read`	Default member	Tier 2
`microsoft.directory/administrativeUnits/standard/read`	Default member	Tier 2
`microsoft.directory/applicationPolicies/standard/read`	Default member	Tier 2
`microsoft.directory/applications/owners/read`	Default member	Tier 2
`microsoft.directory/applications/policies/read`	Default member	Tier 2
`microsoft.directory/applications/standard/read`	Default member	Tier 2
`microsoft.directory/contacts/memberOf/read`	Default member	Tier 2
`microsoft.directory/contacts/standard/read`	Default member	Tier 2
`microsoft.directory/contracts/standard/read`	Default member	Tier 2
`microsoft.directory/domains/standard/read`	Default member, Guest user	Tier 2
`microsoft.directory/groups/appRoleAssignments/read`	Default member	Tier 2
`microsoft.directory/groups/memberOf/read`	Default member	Tier 2
`microsoft.directory/groups/members/read`	Default member	Tier 2
`microsoft.directory/groups/owners/read`	Default member	Tier 2
`microsoft.directory/groups/standard/read`	Default member	Tier 2
`microsoft.directory/oAuth2PermissionGrants/standard/read`	Default member	Tier 2
`microsoft.directory/organization/standard/read`	Default member	Tier 2
`microsoft.directory/roleAssignments/standard/read`	Default member	Tier 2
`microsoft.directory/roleDefinitions/standard/read`	Default member	Tier 2
`microsoft.directory/servicePrincipals/appRoleAssignedTo/read`	Default member	Tier 2
`microsoft.directory/servicePrincipals/appRoleAssignments/read`	Default member	Tier 2
`microsoft.directory/servicePrincipals/memberOf/read`	Default member	Tier 2
`microsoft.directory/servicePrincipals/oAuth2PermissionGrants/read`	Default member	Tier 2
`microsoft.directory/servicePrincipals/ownedObjects/read`	Default member	Tier 2
`microsoft.directory/servicePrincipals/owners/read`	Default member	Tier 2
`microsoft.directory/servicePrincipals/policies/read`	Default member	Tier 2
`microsoft.directory/servicePrincipals/standard/read`	Default member	Tier 2
`microsoft.directory/subscribedSkus/standard/read`	Default member	Tier 2

42 de 42 role actions

PowerShell

Get-MgRoleManagementDirectoryRoleDefinition `
  -UnifiedRoleDefinitionId "1fe13547-53f6-408d-ac04-7f8eed167b38"

Microsoft Graph

GET https://graph.microsoft.com/v1.0/
  roleManagement/directory/
  roleDefinitions/1fe13547-53f6-408d-ac04-7f8eed167b38

Ver a documentação oficial na Microsoft Learn

Roles relacionadas

AI Administrator

Tier 0Microsoft 365

Knowledge Administrator

Tier 0Microsoft 365

Knowledge Manager

Tier 0Microsoft 365

Windows 365 Administrator

Tier 0Microsoft 365

Windows Update Deployment Administrator

Tier 0Microsoft 365