Opselith
POWERSHELL / MICROSOFT.GRAPH.IDENTITY.GOVERNANCE
ProAdvancedRead-onlylow

Export Entra admin role assignments

Export current Microsoft Entra admin role assignments with principal, role definition and directory scope information.

Open in PowerShell Builder →Browse all scripts

Pro generation after license validation · Review before running · Opselith does not connect to your tenant

What this PowerShell script does

Exports directory role assignments.

Requirements

  • CSV output path - Example: C:\Temp\report.csv

Environment

  • Module: Microsoft.Graph.Identity.Governance
  • Permissions: RoleManagement.Read.Directory
  • Output: CSV report
  • Context: Microsoft Graph PowerShell
  • Risk: Low
Review before you run The full Pro script is generated by Opselith after license validation. Test outside production first.
NEXT STEP

Ready to generate

Configure Export Entra admin role assignments in the Builder, review the generated PowerShell and run it yourself in your own PowerShell session.

Configure this script →Open Builder
More about this script

Why use this template?

Use this Pro PowerShell script when you need to export directory role assignments. It can be previewed in the Builder; Pro access is required to generate it for your own environment.

The template uses Microsoft.Graph.Identity.Governance and requires RoleManagement.Read.Directory. Output: CSV report. Level: Advanced. Action: Read-only. Risk: Low.

Review before running

The script remains preview-only until Pro access is enabled. Review it before running it, and test it outside production first. “Read-only” describes the script itself; anything you add around it can still change data.

Preview the script

  1. Open the template in the PowerShell Builder.
  2. Review the purpose, requirements, permissions, output and risk.
  3. Activate Pro when you are ready to generate the full script, then test it outside production.

Pro templates remain previewable before purchase or activation. No tenant connection is required. When you generate a Pro script, only the configuration values needed for that template are sent to Opselith after license validation.Preview Export Entra admin role assignments →

How to use this result

Use this report to inventory current directory role assignments and their assignment IDs for privileged-access review.

When this helps

  • Create an admin-role assignment inventory before a privileged-access review.
  • Trace a current role assignment back to its assignment, principal and role-definition identifiers.

How to read the result

  • A role assignment links a principal to a role definition at a directory scope; '/' normally represents tenant-wide directory scope.
  • This report covers current role assignments, not PIM eligibility schedules or historical activation events.

Things to check

  • Role assignments can target users, groups or service principals, so principal type and ownership matter during review.
  • Application-scoped and administrative-unit-scoped assignments need their scope interpreted in context.

What to do next: Review broad or unexpected assignments with the role owner and compare them with PIM eligibility before changing access.

Related tasks

Official references

Before you runModule, permissions, inputs, compatibility and script checks
OPS / SCRIPT DETAILS

Script details

Exports directory role assignments. Review these details before generating or running the script.

securityexportpermissionsentra
Generated here. Run by you.Opselith does not connect to your tenant or run PowerShell. After generating, review the script and run it in your own PowerShell session.

What it works with

Module: Microsoft.Graph.Identity.Governance

Microsoft Graph PowerShell lets the script work with Microsoft Entra and Microsoft 365 data through Microsoft Graph.

Context: Microsoft Graph PowerShell

Compatibility: PowerShell 7 is the supported target for this cloud template.

Permissions and changes

Permissions: RoleManagement.Read.Directory

Risk: Low

Read-only: designed to collect information without intentionally changing the target environment.

Changes: Read-only. The script reads data and does not intentionally change the target environment.

Inputs

  • CSV output path - Example: C:\Temp\report.csv (Required)

What to expect

Output: CSV report

Expect a CSV file at the path you choose. Open it in Excel or another CSV viewer and review the rows.

Example: C:\Temp\report.csv

This template is in the Pro library. Generating the full script requires eligible Pro or tester access. Opselith receives only the values needed to build the script; it does not connect to your tenant, run PowerShell or store the generated script. You review and run the result in your own PowerShell session.

Example use

Exports directory role assignments.

Enter the required values in the Builder, review the generated script and confirm the output before running it.

Before you run: Make sure your account has RoleManagement.Read.Directory. Check that the Microsoft.Graph.Identity.Governance PowerShell module is available and that you are using the supported PowerShell version. Review the generated script and output path, then test outside production first.
Script checksWhat has been verifiedQA reviewed
Static checksPassed
PSScriptAnalyzerPending
Real-world run testNot yet recorded
Last checkedNot yet recorded

Real-world run results are shown only after Opselith reviews and accepts a tester report.

Tester: report a result →
TEST STATUSWhat Opselith has checked

Last reviewed: 10 Sept 2026

PSScriptAnalyzer: Awaiting a release PSScriptAnalyzer gate that includes this script. No analyzer pass is claimed yet.

Pending or Not yet recorded means there is no accepted result on file yet. A passed analyzer check does not mean the script has been run in a real tenant.

PRACTICAL GUIDE

How to use this result

Use this export to review current Microsoft Entra directory role assignments, the assigned principal and the directory scope of each assignment.

When this helps

  • Build a privileged-access inventory for periodic access review.
  • Find principals holding high-impact directory roles.
  • Identify scoped assignments by reviewing DirectoryScopeId instead of assuming every assignment is tenant-wide.

How to read the result

  • RoleDefinitionDisplayName describes the assigned directory role; Principal fields identify the resolved assignee when available.
  • DirectoryScopeId matters when interpreting whether an assignment applies tenant-wide or to a narrower directory scope.

Things to check

  • This script inventories directory role assignments; use the dedicated PIM export when you need eligible and time-bound PIM schedule data.
  • A role assignment can be legitimate even when highly privileged, so review ownership and business need before remediation.
What to do next: Group the CSV by role, review the most privileged roles first, and compare each assignment with your approved admin-access model.
NEXT IN THE LIBRARY

Scripts for similar admin tasks and Microsoft services.

Browse Microsoft Entra PowerShell scripts →
POWERSHELLExport Entra directory role assignmentssecurity · export · permissionsPOWERSHELLExport Conditional Access policiessecurity · export · permissionsPOWERSHELLExport enterprise application API permissions and consent grantsentra · security · enterprise-apps