How to Give External Guests Read-Only Access to Microsoft 365 Admin Portals
Question details
The user needs to allow an auditor from another company to review Microsoft 365, Azure, and Intune administration settings without granting full administrative control.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Providing secure, read-only system visibility for an external auditor across multiple Microsoft administrative portals.
- Observed behavior
- The user requires a global read-only administrator role for a guest account, but Microsoft restricts this, demanding that access be evaluated and assigned separately per service.
Ensure you are signed in with Global Administrator credentials in your Microsoft 365 tenant, as this is required to manage roles and invite external guests.
Assign Separate Read-Only Roles in Applicable Microsoft Services
Because Microsoft does not support a single global read-only role for external guests across all environments, you must manually assign specific read-only permissions within Microsoft 365, Azure, and Intune.
Microsoft's security architecture mandates that guest access be handled on a per-service basis. To achieve cross-platform read-only visibility for an auditor, you will need to configure roles individually in the Microsoft 365 Admin Center, Azure Portal, and Intune Admin Center.
Go to the Microsoft Entra ID (formerly Azure Active Directory) portal, navigate to 'Users', click 'New guest user', and send an invitation to the auditor's email address.
Log into the Microsoft 365 Admin Center, locate the guest user under 'Active users', click 'Manage roles', and assign the 'Global Reader' role.
Open the Azure Portal, navigate to the specific Subscription or Resource Group the auditor needs to review, go to 'Access control (IAM)', click 'Add role assignment', and assign the 'Reader' role to the guest user.
Access the Microsoft Intune Admin Center, navigate to 'Tenant administration' > 'Roles', and assign the guest user to the 'Read Only Operator' role.
Streamline Your Document Workflows with WPS Office
While configuring complex administrative portals in Microsoft 365 requires intricate permission management, handling your daily document tasks shouldn't be complicated. WPS Office provides a free, lightweight, and highly compatible alternative to Microsoft Office for creating, editing, and sharing documents securely without the heavy administrative overhead.
- 1. Download WPS Office: Visit the official WPS Office website to download the free installation package for your operating system.
- 2. Install and Launch: Run the installer, complete the quick setup, and launch the WPS Office application.
- 3. Open and Edit Microsoft Formats: Drag and drop your existing .docx, .xlsx, or .pptx files directly into WPS Office to start editing with full formatting compatibility.
Frequently Asked Questions
Can I create a custom role in Microsoft 365 for external auditors?
Yes, you can create custom admin roles in the Microsoft 365 admin center. However, assigning broad cross-platform access (spanning Azure, Intune, and M365) to an external guest still requires configuring permissions in each respective service environment individually.
Does the Global Reader role in Microsoft 365 cover Intune and Azure?
The Global Reader role provides read-only access to Microsoft 365 admin center settings, but it does not automatically grant read access to Azure resources or deep Intune configurations. Azure and Intune access must be assigned separately in their own portals.
How do I remove guest access once the audit is complete?
To revoke access, go to the Microsoft Entra ID portal, locate the guest user in the 'Users' list, and either remove their assigned roles from the 'Assigned roles' tab or delete the guest account entirely to ensure security.
