Forum Discussion
Global Reader role - Not working to access Sharepoint Admin Portal
This is what I got back from ChatGPT. Note that even though Global Reader seems like it has read access across Microsoft 365, there is a lot it still doesn't have visibility on.
Also note that even SharePoint Administrator alone won't give you access to view the policies as they are part of the Compliance Portal within Purview.
The Global Reader role in Azure AD is a directory-level read-only role—it lets you view Azure AD settings and administrative information across Microsoft 365, but it does not grant any Azure Resource Manager (ARM) permissions on your Purview account. In practice:
- Global Reader cannot view or enumerate your Purview data policies. Purview’s policy UI is guarded by ARM-level actions under Microsoft.Purview/policies/*, which Global Reader simply doesn’t include. (welkasworld.com)
- At a minimum you need an ARM scope-level role (like the built-in Policy Author on a collection) to see policy definitions in the Purview portal—and even that role allows editing and deletion. (learn.microsoft.com)
If you want strictly view-only access to policies, you’ll need to:
- Assign the Azure built-in Reader role at the Purview account or resource-group scope (this gives you ARM-level read on all Purview resources), and
- Create a custom role that grants only the Microsoft.Purview/policies/read permission so that users can see policy configurations in the governance UI without any edit rights.
That combination ensures pure read-only visibility of Purview policies without over-privileging.