Global Reader for DFIR: Capabilities and Pitfalls

Concept

The Global Reader role (RoleDefinitionId: f2ef9929-dd9a-42c8-ac0d-03b1e3532454) was introduced by Microsoft to provide a read-only counterpart to the all-powerful Global Administrator.

In administrative theory, it allows an auditor to view all configuration settings and administrative features across the Microsoft Entra admin center and Microsoft 365 admin center without the ability to alter state.

In forensic practice (DFIR), however, Microsoft 365’s decoupled architectural model means that workload authorization planes (Exchange, SharePoint, Purview Compliance) enforce their own RBAC models. Global Reader inherits read privileges across directory configurations, but is intentionally blocked from compliance auditing, legal discovery, and content examination.

+---------------------------------------------------------------------------------------------------+
|                              GLOBAL READER: FORENSIC REACH VS BLINDSPOTS                          |
|                                                                                                   |
|   +-------------------------------------------------------------------------------------------+   |
|   |                       FULL VISIBILITY (MICROSOFT ENTRA ID CORE)                           |   |
|   |   [x] Users, Groups, Devices, Directory Schema                                            |   |
|   |   [x] Conditional Access Policies & Named Locations                                       |   |
|   |   [x] Entra Sign-in Logs (Interactive, Non-Interactive, Service Principals)               |   |
|   |   [x] Entra Directory Audit Logs & PIM Assignments                                        |   |
|   +---------------------------------------------+---------------------------------------------+   |
|                                                 |                                                 |
|                      +--------------------------+--------------------------+                      |
|                      |                                                     |                      |
|                      v                                                     v                      |
|   +-------------------------------------+               +-------------------------------------+   |
|   |    CRITICAL BLINDSPOT: PURVIEW      |               |     CRITICAL BLINDSPOT: CONTENT     |   |
|   |    Unified Audit Log (UAL) Search   |               |     Mailbox Message Body Access     |   |
|   |   [!] BLOCKED without:              |               |    [!] BLOCKED (Requires eDiscovery |   |
|   |       - View-Only Audit Logs        |               |        Manager or Application         |   |
|   |       - Audit Reader                |               |        Mail.Read permissions)         |   |
|   +-------------------------------------+               +-------------------------------------+   |
|                      |                                                     |                      |
|                      +--------------------------+--------------------------+                      |
|                                                 |                                                 |
|                                                 v                                                 |
|   +-------------------------------------------------------------------------------------------+   |
|   |                           PARTIAL / ELEVATION REQUIRED ZONES                              |   |
|   |   Exchange Online: Needs 'View-Only Recipients' for granular mailbox metadata & rules    |   |
|   |   Defender XDR: Needs 'Security Reader' for Advanced Hunting KQL & raw endpoint alerts    |   |
|   +-------------------------------------------------------------------------------------------+   |
+---------------------------------------------------------------------------------------------------+

Why It Matters in DFIR

The assumption that “The client gave us Global Reader, so we have everything” is the single most common cause of delayed incident scoping:

The UAL Search Failure: An analyst logs in with Global Reader, opens PowerShell, runs Search-UnifiedAuditLog, and receives an authorization error: The term 'Search-UnifiedAuditLog' is not recognized or Access Denied. The cmdlet is not even loaded into the session because the role lacks Exchange Compliance RBAC.
eDiscovery Paralysis: When investigating whether an attacker exfiltrated financial spreadsheets or sent malicious emails, Global Reader provides zero access to search or export message contents.
Advanced Hunting Restrictions: In Microsoft Defender XDR (security.microsoft.com), Global Reader provides broad dashboard visibility but restricts deep KQL queries and raw device timeline inspections without the complementary Security Reader role.

How It Works: Service-by-Service Breakdown

1. Microsoft Entra ID: Full Visibility

Global Reader performs exceptionally well in the Entra ID identity plane:

Full read access to all users, security groups, M365 groups, and device inventories.
Full read access to Entra ID Sign-In Logs (interactive, non-interactive, service principals, managed identities).
Full read access to Entra ID Audit Logs and identity governance policies.
Full read access to all Conditional Access policies, trusted locations, and diagnostic settings.

2. Microsoft Purview (Compliance): Severe Blindspot

The Purview compliance portal operates an independent role group model:

Unified Audit Log (UAL): Global Reader cannot search or export the UAL via the Purview portal or PowerShell.
- Required Supplement: The user must be assigned the Audit Reader or View-Only Audit Logs role in Purview (Fiche 13: Unified Audit Log).
Content Search & eDiscovery: Global Reader cannot create search queries or export email/file items.
- Required Supplement: Must be added to the eDiscovery Manager or eDiscovery Administrator role group.

3. Exchange Online: Configuration Only

Global Reader can view global mail flow settings and accepted domains in the Exchange Admin Center (EAC).
Global Reader cannot run deep mailbox-level diagnostic cmdlets (e.g., Get-MailboxPermission, Get-InboxRule, or deep Get-MessageTrace) unless the View-Only Recipients or Compliance Management Exchange role is assigned (Fiche 33: Exchange Investigation).

4. SharePoint Online & OneDrive for Business: Quota Only

Global Reader can view tenant-wide storage usage, sharing policies, and site collections in the SharePoint Admin Center.
Global Reader has zero access to browse document libraries or download files from user OneDrive repositories or private SharePoint team sites (Fiche 34: SharePoint).

5. Microsoft Defender XDR: Limited Telemetry

Global Reader can navigate the Defender portal (security.microsoft.com) and view high-level security scores and alerts.
Deep raw device telemetry, automated investigation playbooks, and full KQL Advanced Hunting capabilities require Security Reader.

What Is Possible vs What Is Not Possible

Forensic Objective	Global Reader Alone	Required Role Supplement
Inspect Entra sign-ins (IP, device, MFA, CA)	Possible	None (Native)
Audit user creations, role changes, app registrations	Possible	None (Native)
Read Conditional Access policy logic	Possible	None (Native)
Search the Unified Audit Log (UAL)	NOT Possible	`View-Only Audit Logs` (Purview)
Inspect user Inbox forwarding rules via PowerShell	NOT Possible	`View-Only Recipients` (Exchange)
Search mailbox contents for phishing lures	NOT Possible	`eDiscovery Manager` (Purview)
Run Advanced Hunting KQL in Defender XDR	Restricted	`Security Reader` (Entra/Defender)
Inspect message transit via Message Trace (Interactive)	Possible	None (EAC Basic)
Export historical Message Trace (up to 90 days)	NOT Possible	`Compliance Management` (Exchange)

Prerequisites & Necessary Conditions

When requesting forensic access from a client, never request Global Reader alone. Provide the client with the DFIR Essential Role Bundle:

# DFIR Essential Role Bundle
1. Entra ID Directory Roles:
   - Global Reader
   - Security Reader

2. Microsoft Purview Role Groups:
   - View-Only Organization Management (includes View-Only Audit Logs)
   - eDiscovery Manager (if content search is authorized)

3. Exchange Online Role Groups:
   - Compliance Management
   - View-Only Organization Management

Artifacts and Evidence Sources

When logging in as Global Reader, your session identity is bound to distinct operational scopes:

Interface	Token Audience (`aud`)	Scopes / Roles Present in Token
Microsoft Graph	`https://graph.microsoft.com`	Directory.Read.All, AuditLog.Read.All
Exchange Online PS	`https://outlook.office365.com`	Blocked from `Search-UnifiedAuditLog` unless Purview role present
Purview Compliance	`https://compliance.microsoft.com`	Read-only access to policy definitions; Audit search hidden

Investigation Methodology

Audit Your Own Account’s Effective Roles: Verify which directory roles are currently active on your investigation identity:

Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgUserMemberOf -UserId "sec-dfir-analyst01@client.onmicrosoft.com" | Select-Object Id, AdditionalProperties

Test Purview Audit Log Search Access: Attempt to establish an Exchange Online compliance session and test UAL query rights:
Terminal window
```
Connect-IPPSSession -UserPrincipalName "sec-dfir-analyst01@client.onmicrosoft.com"
# Test query
Search-UnifiedAuditLog -StartDate (Get-Date).AddHours(-1) -EndDate (Get-Date) -ResultSize 1
```
If this cmdlet errors or is missing, your Global Reader role lacks the Purview Audit Reader supplement.
Request Targeted Role Elevation: Instruct the client administrator to run the role assignment script to unblock the investigation (Fiche 04: Preparing Tenant).

Practical Example / Case Walkthrough

Scenario: The 12-Hour Stalling Incident

During a suspected ransomware exfiltration event involving a multinational client, an external incident response firm requested and received Global Reader for five analysts.

The Breakdown:

The analysts spent the first 4 hours attempting to run Search-UnifiedAuditLog via automated scripts to identify mass OneDrive downloads.
All scripts crashed with AuthorizationException: User is not authorized to search the audit log.
The analysts assumed the client’s tenant had disabled auditing, leading them down a false investigative rabbit hole.
At hour 8, a senior investigator realized that Global Reader does not grant access to the UAL in Purview.
It took another 4 hours to obtain client approval to grant View-Only Audit Logs.

The Solution: By utilizing the Hermes Codex DFIR Access Matrix (Fiche 06: Access Matrix), the onboarding team would have requested the combined Global Reader + View-Only Organization Management bundle upfront, preventing a 12-hour investigative delay.

Common Pitfalls and Traps

Pitfall	Reality	Prevention
”Global Reader = Global Administrator read-only”	False. Global Administrator bypasses Purview and Exchange RBAC; Global Reader does not.	Always request explicit Purview role groups.
”I can see the Audit portal, so I can search”	You can see the Purview UI tab, but clicking ‘Search’ returns an error banner.	Test UAL access via PowerShell immediately upon onboarding.
”Global Reader lets me see who owns what file”	You can see site collections, but not file-level permissions or file contents.	Pair with SharePoint audit logs from the UAL.

Key Takeaways

Global Reader is limited to the directory: It provides deep visibility into Entra ID, but stops at the boundary of compliance and content.
The UAL requires explicit Purview permissions: Never begin an engagement without View-Only Audit Logs or Audit Reader.
Always verify effective permissions: Test Search-UnifiedAuditLog in PowerShell immediately upon receiving credentials.
Use the DFIR Access Matrix: Ensure the client assigns directory, Purview, and Exchange roles simultaneously.

Feature State in 2026

Recent Changes

Unified Purview Role Groups: Microsoft has integrated Purview permissions deeper into the modern Microsoft Defender XDR unified RBAC model.
Entra ID Audit Reader: The dedicated Entra ID Audit Reader role can be assigned in conjunction with Global Reader to streamline access across Entra and Purview audit streams.