Microsoft Entra ID · Remaining Built-in Roles
Entra Backup Reader
Read-only access to Microsoft Entra Backup including listing preview jobs, recovery jobs, and backup snapshots. Can create preview jobs to assess recovery scope.
Scope: Read-only access to Entra Backup data and ability to create preview jobs
Permissions
- List all preview jobs and their status
- List all recovery jobs and their status
- View backup snapshots and details
- Create preview jobs to assess recovery scope
- Read backup configuration and settings
Common use cases
- Auditing backup coverage and compliance
- Assessing recovery scope before requesting a restore
- Monitoring backup job health and status
- Reporting on backup and recovery activities
Best practices
- Use for auditors and compliance teams
- Assign to identity team members who need visibility without restore capability
- Use preview jobs to validate backup completeness
Security considerations
- Can view backup data which may contain sensitive directory information
- Preview jobs show what would be restored without executing
- Lower risk than Backup Administrator — no restore capability
Common questions
When should I assign the Entra Backup Reader role?
Assign Entra Backup Reader when you need to: Auditing backup coverage and compliance; Assessing recovery scope before requesting a restore; Monitoring backup job health and status; and Reporting on backup and recovery activities. It is part of Microsoft Entra ID and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the Entra Backup Reader role do?
The Entra Backup Reader role grants permissions including: List all preview jobs and their status; List all recovery jobs and their status; View backup snapshots and details; Create preview jobs to assess recovery scope; and Read backup configuration and settings. See the Permissions section above for the full list.
What are the security risks of the Entra Backup Reader role?
Key considerations when assigning Entra Backup Reader: Can view backup data which may contain sensitive directory information; Preview jobs show what would be restored without executing; and Lower risk than Backup Administrator — no restore capability. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.