How to find users with Microsoft 365 and Entra roles

Admin roles in Microsoft 365 grant access to tenant-wide settings and sensitive operations. Over time, role assignments often expand beyond their original intent, leaving users with privileges they no longer require. Without a clear, centralized view of who holds administrative access, it can become difficult to enforce least-privilege principles.

This article explains how to create a list of Microsoft 365 users who have been assigned Microsoft 365 admin roles using the Microsoft 365 admin center, Microsoft Graph PowerShell, and ManageEngine M365 Manager Plus, a dedicated Microsoft 365 administration tool.

Method 1: How to get Microsoft 365 users with Entra roles using the Microsoft 365 admin center

Prerequisites

You must be assigned at least the Privileged Role Administrator or Global Reader role to view and download Microsoft 365 admin and Entra role assignments.

Steps

1. Sign-in to the Microsoft Entra admin center.
2. Navigate to Entra ID > Roles & admins > All roles.
3. Select Download assignments and click Start bulk operation to export the list of users who are assigned Microsoft 365 admin and Entra roles.

Method 2: How to get users with Microsoft 365 admin and Entra roles using Microsoft Graph PowerShell (Get-MgDirectoryRole)

Prerequisites

Before using Microsoft Graph PowerShell, verify that:

1. The Privileged Role Administrator or Global Reader role is applied to the account you use to sign in to Microsoft Graph PowerShell.
2. You are connected to the Microsoft Graph PowerShell module.
   1. To check if the Microsoft Graph PowerShell module is installed, use this script:
      Copy

      Get-Module Microsoft.Graph -ListAvailable

      If it does not return a value, you will have to install the module.

   2. To install the Microsoft Graph PowerShell module, use this script:
      Copy

      Install-Module Microsoft.Graph -Scope CurrentUser

   3. To connect to Microsoft Graph, use this script:
      Copy

      Connect-MgGraph -Scopes "User.Read.All","RoleManagement.Read.Directory"

Using Get-MgDirectoryRole to list all Microsoft 365 admin role users

Microsoft 365 admin roles are only activated in a tenant when assigned, so you must first fetch the active roles and then list their members. Since roles are distinct objects, your script will have to iterate through each role to find its members. Use the following script to generate a list of users with Microsoft 365 admin roles.

# Get all activated directory roles
$Roles = Get-MgDirectoryRole

$AdminReport = foreach ($Role in $Roles) {
    $Members = Get-MgDirectoryRoleMember -DirectoryRoleId $Role.Id
    foreach ($Member in $Members) {
        # Fetch user details (ignoring service principals)
        $UserDetails = Get-MgUser -UserId $Member.Id -Property "DisplayName,UserPrincipalName" -ErrorAction SilentlyContinue
        if ($UserDetails) {
            [PSCustomObject]@{
                RoleName          = $Role.DisplayName
                DisplayName       = $UserDetails.DisplayName
                UserPrincipalName = $UserDetails.UserPrincipalName
            }
        }
    }
}

# Export the report to CSV
$AdminReport | Export-Csv -Path "C:\Reports\M365_Admins_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation

Supported parameters

The following table contains some parameters that can be used with the Get-MgDirectoryRole cmdlet.

Method 3: How to get users with Microsoft 365 admin and Entra roles using M365 Manager Plus

Steps

1. Log in to M365 Manager Plus, navigate to Reports > Azure Active Directory > User Reports and select the Admin Roles report.
2. You can now view a comprehensive Microsoft 365 users list with the specific Microsoft 365 and Microsoft Entra ID roles assigned to them. You can filter this report for the exact set of admin roles that you want by clicking the <filter> filter icon and typing in the roles that you want to search for.

Monitor your Microsoft Entra ID environment and more

M365 Manager Plus gives you centralized visibility and control over Microsoft Entra ID objects and configurations of your Microsoft 365 users groups, licenses, admin roles, authentication settings, and more. Create, modify, and track identities across your tenant without hopping between multiple admin portal settings.

Important tips

Frequently asked questions

$Role = Get-MgDirectoryRole | Where-Object {$_.DisplayName -eq "Global Administrator"}Get-MgDirectoryRoleMember -DirectoryRoleId $Role.Id