I built a free Microsoft Entra ID tool that finds roles Microsoft hasn't documented yet

Update 17th April 2026: deeper permissions, new roles, smarter search

Since the original post, Entra RoleLens has been updated significantly. Here is what changed and what we found along the way.

New roles surfaced by the Graph API

By expanding the permissions granted to the pipeline's service principal, the tool now surfaces roles that were previously invisible. The most interesting discoveries:

The Entra Backup family — Entra Backup Administrator and Entra Backup Reader — roles for managing directory backup and recovery that Microsoft has deployed but not yet prominently documented.

The Tenant Governance family — four roles covering GDAP relationship management for CSPs and MSPs. If you manage customer tenants as a partner, these are the roles that govern your access model. Most community members know these concepts as GDAP but have never seen the corresponding Entra built-in roles listed anywhere.

The Agent Identity family — Agent ID Administrator, Agent ID Developer, Agent Registry Administrator, AI Administrator, AI Reader. These are the Entra Agent ID roles we first discussed in the tracker. They are now fully searchable in RoleLens with task mappings.

The most interesting technical finding: a new resource namespace

When reading the raw permission strings from the Graph API, one stood out immediately:

microsoft.agentRegistry/allEntities/allProperties/allTasks

This is microsoft.agentRegistry/* — a brand-new resource provider namespace in the Entra permission model that sits alongside the established namespaces like microsoft.directory/* and microsoft.azure.*. It does not appear in any Microsoft documentation. It governs access to the agent registry — the inventory of AI agents in your tenant.

This is the kind of signal the tool was built to surface. The Graph API knows about it before the docs do.

AI Reader is not what its name suggests

AI Reader sounds like a scoped, read-only role for AI governance. It reads 41 distinct resource actions. Most have nothing to do with AI — it can read all users, all service principals, all role assignments, and all role definitions across the tenant. For a role named "Reader" that is a significant privilege surface. Worth reviewing before assigning it broadly.

The tool is now significantly smarter

Search now understands 207 synonyms covering the full Entra vocabulary. Type gdap, nhi, ai agent, bcdr, dap, or bot identity and the tool understands what you mean. Progressive partial matching fires after 3 characters so you see results as you type.

228 task mappings now cover Agent Identity, Backup and Recovery, and Tenant Governance domains in addition to the original Microsoft Learn dataset.

A What's New panel appears on the homepage whenever the nightly pipeline detects a role change — added, removed, or modified. It auto-clears after 30 days. The README data quality section updates automatically every night from the live pipeline data.

The tool is self-sustaining. No manual updates needed.

Try the new searches:

• gdap → Tenant Governance Administrator
• ai agent → Agent ID Administrator
• backup → Entra Backup Administrator
• nhi → Agent Identity

Entra RoleLens: entrarolelens.aboutcloud.io

GitHub: github.com/arusso-aboutcloud/entra-rolelens

The problem every Entra admin knows

Someone asks: "what role do I need to assign so the helpdesk can reset MFA without giving them too much access?"

You open Microsoft Learn. You open the built-in roles reference. You cross-reference the least-privileged-by-task page. Twenty minutes later you have an answer you are not fully confident in. This happens multiple times a week for anyone managing Entra ID at scale.

There is no interactive tool that answers this question directly. Microsoft's documentation is authoritative, but it is a static table. AzAdvertizer is excellent for browsing roles, but it does not answer the question in reverse. Nobody had built a task-to-minimum-role search engine for the community.

So, I built one.

What Entra RoleLens does

Task → Role mode. Type any Entra admin task in plain language and get back the minimum built-in role required — nothing more. The search engine understands Entra admin vocabulary. Type PIM, MFA, FIDO2, GSA, CAP or any common abbreviation and it knows what you mean. Results link directly to Microsoft's official source documentation.

Role Diff mode. Select any two built-in roles and see every permission one has that the other lacks, in a clean three-column view. Global Administrator has 267 permissions. User Administrator has 56. The diff shows you exactly what separates them — useful for scoping custom roles and understanding blast radius before making assignments.

Both modes are deterministic. Every result comes from Microsoft's own published data. No language model, no interpretation, no hallucination risk. If it says Authentication Administrator, that is what Microsoft's official guidance says.

The Shadow Role discovery

When I built the nightly data pipeline, I cross-referenced the live Microsoft Graph API against Microsoft's public documentation. The result surprised me.

13 roles exist in the Graph API that are not yet documented anywhere. Including:

• AI Reader — a new AI-specific role Microsoft has deployed but not yet announced
• Purview Workload Content Reader, Writer, and Administrator — three new governance roles for Microsoft Purview workloads
• Customer Delegated Admin Relationship Administrator — relevant for MSPs managing multiple tenants

I call these Shadow Roles. The tool detects them every night and surfaces them in the status bar. This means Entra RoleLens can show you new Microsoft roles before Microsoft publishes them in any documentation. For security architects and CISOs who need to stay ahead of identity changes in their tenant, this is genuinely useful intelligence.

How it was built — the technical detail

The full stack runs on Cloudflare's free tier and GitHub Actions. Total infrastructure cost: €0 per month.

The Cloudflare backend:

• Workers (TypeScript) — the API layer, 5 routes, running on 330+ edge locations worldwide. Median response time under 5ms.
• D1 (SQLite) — stores 143 roles, 211 task mappings, a full keyword search index, and a complete audit trail of every role change since launch.
• KV — distributed key-value cache serving the master dataset globally. Sub-millisecond reads from any location.
• Pages — hosts the frontend on a global CDN, auto-deploys on every push to master.
• WAF — custom rules protecting the API from scanners, abuse, and path probing.

The pipeline is Zero Trust by design. GitHub Actions authenticates to Microsoft Entra ID via Workload Identity Federation — no stored secrets, no API keys, no passwords anywhere in the codebase. A short-lived OIDC token is issued per pipeline run, scoped specifically to this repository and branch, and expires automatically after the job completes.

The search engine is pure SQL. Keywords are extracted client-side in JavaScript, expanded through a synonym map of 80+ Entra admin terms and abbreviations, then matched against a weighted keyword table in D1. No language model in the query path. Every result is traceable to a specific row in a specific Microsoft source document.

Self-sustaining — zero manual maintenance

Every night at 01:00 UTC, a GitHub Actions workflow runs automatically:

1. Calls the Microsoft Graph API via OIDC token — live source of truth
2. Scrapes Microsoft Learn for task-to-role mappings
3. Diffs today's roles against yesterday's snapshot — detects every change Microsoft makes
4. Validates data quality before touching production — circuit breaker pattern
5. Pushes updated data to Cloudflare KV and D1
6. Commits updated data files back to the GitHub repo — permanent version history

If the pipeline fails, a GitHub Issue opens automatically, and the previous night's data stays live. Users never see a broken or empty tool.

The GitHub commit history of the repository is a permanent, searchable record of every role change Microsoft has made since launch. No other community tool publishes this.

The data gap and how you can help

211 tasks are mapped. Microsoft's official documentation covers the most common administrative tasks but misses entire product areas — PIM-specific workflows, Conditional Access edge cases, Entitlement Management tasks, External ID operations, and more.

The task dataset lives in data/tasks.json in the public GitHub repository. If a task is missing, open an Issue with the Microsoft Learn source URL or submit a pull request directly. Every merged contribution goes live within minutes via the nightly pipeline.

The community is the quality layer.

Try it

Tool: entrarolelens.aboutcloud.io

GitHub: github.com/arusso-aboutcloud/entra-rolelens

If this saves you one Microsoft docs crawl, it was worth building. And if you find a missing task, a wrong mapping, or a better approach — open an issue. That is how community tools get better.

Sharing is caring.

If you're running a similar setup or have questions, reach out in the comments or on LinkedIn.

— Antonio | AboutCloud

arusso@aboutcloud.io