AzEntraIdRolesAdvertizer

last sync: 2025-May-16 17:01:23 Etc/UTC

Attribute Log Administrator - 5b784334-f94b-471a-a387-e7219fc49ca2
Entra Id Role definition

Display name Attribute Log Administrator
Id 5b784334-f94b-471a-a387-e7219fc49ca2
Description Read audit logs and configure diagnostic settings for events related to custom security attributes.
Detailed description Assign the Attribute Log Reader role to users who need to do the following tasks:
* Read audit logs for attribute set changes
* Read audit logs for custom security attribute definition changes
* Read audit logs for custom security attribute assignment changes
* Configure diagnostic settings for custom security attributes
Users with this role *cannot* read audit logs for other events.
By default, Global Administrator and other administrator roles do not have permissions to read audit logs for custom security attributes. To read audit logs for custom security attributes, you must be assigned this role or the Attribute Log Reader role.
Categories identity
isPrivileged False
EntraOps Tier Level ControlPlane
#Resource Actions unique 56
#Resource Actions Operations unique 56
#Resource Actions privileged 0
#Resource Actions direct 2
Resource Actions inherited True
#Resource Actions inherited 54
Resource Actions inherited from Directory Readers (88d8e3e3-8f55-4a1e-953a-9b9898b8876b)
#Resource Actions overlap direct&inherited 0
Resource Actions overlap direct&inherited
#Resource Actions inherited to 0 other Entra Id Roles
Resource Actions inherited to n/a
#Resource Actions conditioned 0
#Resource Actions unconditioned 56
#NameSpaces 2
NameSpaces microsoft.azure.customSecurityAttributeDiagnosticSettings: 1
microsoft.directory: 55
Actions allTasks: 1
read: 55
Operations actionVerbs GET: 55
n/a: 1
Resource Actions where Consent Policy applies 0
Resource Actions / Consent Policy n/a
JSON enriched 
{29 items}
JSON raw (v1.0 endpoint)
GET /roleManagement/directory/roleDefinitions/{id} 
{12 items
  • @odata.context: "https://graph.microsoft.com/v1.0/$metadata#roleManagement/directory/roleDefinitions/$entity",
  • id: "5b784334-f94b-471a-a387-e7219fc49ca2",
  • description: "Read audit logs and configure diagnostic settings for events related to custom security attributes.",
  • displayName: "Attribute Log Administrator",
  • isBuiltIn: true,
  • isEnabled: true,
  • resourceScopes: [1 item
    • "/"
    ],
  • templateId: "5b784334-f94b-471a-a387-e7219fc49ca2",
  • version: "1",
  • rolePermissions: [1 item
    • {2 items
      • allowedResourceActions: [2 items
        • "microsoft.azure.customSecurityAttributeDiagnosticSettings/allEntities/allProperties/allTasks",
        • "microsoft.directory/customSecurityAttributeAuditLogs/allProperties/read"
        ],
      • condition: null
      }
    ],
  • inheritsPermissionsFrom@odata.context: "https://graph.microsoft.com/v1.0/$metadata#roleManagement/directory/roleDefinitions('5b784334-f94b-471a-a387-e7219fc49ca2')/inheritsPermissionsFrom",
  • inheritsPermissionsFrom: [1 item
    • {1 item
      • id: "88d8e3e3-8f55-4a1e-953a-9b9898b8876b"
      }
    ]
}
JSON raw (beta endpoint)
GET /roleManagement/directory/roleDefinitions/{id} 
{16 items
  • @odata.context: "https://graph.microsoft.com/beta/$metadata#roleManagement/directory/roleDefinitions/$entity",
  • id: "5b784334-f94b-471a-a387-e7219fc49ca2",
  • assignmentMode: "allowed",
  • categories: "identity",
  • description: "Read audit logs and configure diagnostic settings for events related to custom security attributes.",
  • displayName: "Attribute Log Administrator",
  • isBuiltIn: true,
  • isEnabled: true,
  • isPrivileged: false,
  • resourceScopes: [1 item
    • "/"
    ],
  • richDescription: "Assign the Attribute Log Reader role to users who need to do the following tasks:
* Read audit logs for attribute set changes
* Read audit logs for custom security attribute definition changes
* Read audit logs for custom security attribute assignment changes
* Configure diagnostic settings for custom security attributes
Users with this role *cannot* read audit logs for other events.
By default, Global Administrator and other administrator roles do not have permissions to read audit logs for custom security attributes. To read audit logs for custom security attributes, you must be assigned this role or the Attribute Log Reader role.",
  • templateId: "5b784334-f94b-471a-a387-e7219fc49ca2",
  • version: "1",
  • rolePermissions: [1 item
    • {2 items
      • allowedResourceActions: [2 items
        • "microsoft.azure.customSecurityAttributeDiagnosticSettings/allEntities/allProperties/allTasks",
        • "microsoft.directory/customSecurityAttributeAuditLogs/allProperties/read"
        ],
      • condition: null
      }
    ],
  • inheritsPermissionsFrom@odata.context: "https://graph.microsoft.com/beta/$metadata#roleManagement/directory/roleDefinitions('5b784334-f94b-471a-a387-e7219fc49ca2')/inheritsPermissionsFrom",
  • inheritsPermissionsFrom: [1 item
    • {1 item
      • id: "88d8e3e3-8f55-4a1e-953a-9b9898b8876b"
      }
    ]
}