How to assign the Security Reader role

Security Reader is the role we recommend for AlertControl. With this role you see everything in AlertControl, but you cannot change anything in Microsoft 365. A Global Administrator or Privileged Role Administrator assigns the role in a few minutes in the Microsoft Entra admin center.

Updated 31 October 2026

Step by step

  1. Sign in to the Microsoft Entra admin center

    Go to entra.microsoft.com and sign in with an account that may assign roles: Global Administrator or Privileged Role Administrator.

  2. Open Roles & admins

    In the menu on the left, choose Entra ID › Roles & admins. In an older menu you find it under Identity › Roles & admins.

  3. Find the Security Reader role

    Type Security Reader in the search box and click the role.

  4. Assign the role

    Click Add assignments, select the user and confirm with Add. Using PIM (Entra ID P2)? Then choose whether the assignment is Eligible or Active, and for how long.

  5. Sign in to AlertControl again

    Microsoft includes the role when you sign in. So the user signs out of AlertControl and signs in again. With PIM, the user first activates the role and then signs in.

  6. Check the dashboard

    The dashboard now shows all tables, the timeline and the AI advice. Still seeing No access? Check that the role is active and sign in again. If the role is removed later or a PIM activation expires, access stops by itself within fifteen minutes.

Role What you see in AlertControl
Security Reader (recommended) Everything: all tables, the timeline, the Secure Score recommendations and the AI advice. Read only.
Global Reader Everything. Can also read all tenant settings, but change nothing.
Global Administrator Everything, and can grant the one-time consent for AlertControl. Not recommended for daily use.
Security Administrator or Security Operator Everything. Can also change security settings in Microsoft 365.
Reports Reader Only sign-ins, the Audit Log and Users & MFA.
Compliance Administrator Only Events and DLP.
Other roles, such as Exchange, SharePoint or Teams Administrator No access.

Why Security Reader?

A security overview is only safe if the people viewing it have no more rights than they need. Security Reader can read security data, but cannot change users, settings or policies. If the account is ever misused, an attacker cannot change anything with it. This is the principle of least privilege.

Prefer the Microsoft 365 admin center?

You can. In admin.microsoft.com, go to Users › Active users and click the user. Under Roles, choose Manage roles, then Admin center access, tick Security Reader and click Save changes. Here too, the user then signs in to AlertControl again.

Using PIM?

With Privileged Identity Management (Entra ID P2), assign Security Reader as Eligible. The user activates the role when needed, for example for a few hours, and then signs in to AlertControl. When the activation expires, access to AlertControl stops by itself within fifteen minutes.

Frequently asked questions

No. Security Reader only has read access to security data. Changing users, settings or policies is not possible.

A Global Administrator or a Privileged Role Administrator.

Sign out of AlertControl and sign in again: Microsoft includes the role when you sign in. Using PIM? Activate the role first. Still not working? Contact us on Teams.

No, assigning an admin role costs nothing extra. Only PIM requires Entra ID P2. For the logs themselves, your tenant does need at least one user with Microsoft Entra ID P1.

Yes. Everyone with the role sees the same data of your tenant in AlertControl.

See for yourself what is happening in your Microsoft 365?

Try AlertControl free for 30 days. You sign in with your Microsoft account and grant read-only consent once.

Try free with Microsoft View pricing