-
Book Overview & Buying
-
Table Of Contents
-
Feedback & Rating

Microsoft Identity and Access Administrator SC-300 Exam Guide
By :

When it comes to managing permissions and roles in Entra ID, it’s important to understand that Entra role assignments are based on an additive model. This means that your effective permissions are the sum of all your role assignments.
You can explore the output of all role assignments (including privileged assignment escalations) in the Entra admin center (https://entra.microsoft.com) by expanding Identity, selecting Roles & admins, and then clicking Download assignments.
Figure 1.24: Downloading role assignment data
You can also explore the Entra admin center on a per-role basis and look for groups with memberships. The Assignments column only shows active roles, so it’s recommended to periodically review them.
Further reading
The Microsoft 365 admin center and Entra admin center don’t provide a great interface to be able to see all role assignments at a glance. To get this information, you’ll have to resort to either PowerShell or the Microsoft Graph API. To make this task a little easier, you can use a tool such as Vasil Michev’s role reporting script: https://github.com/michevnew/PowerShell/blob/master/AADRolesInventory-Graph.ps1.
Next, we’ll shift gears to configuring a tenant to support custom (sometimes called vanity) domains.