Really often, when you are trying to assess a customer’s Microsoft 365 tenant, a quick solution is to require the Global Reader role. The role is described here About admin roles in the Microsoft 365 admin center and presents a relatively low risk because it has no capability to change any setting or parameter.
| Global Reader | Assign the global reader role to users who need to view admin features and settings in admin centers that the global admin can view. The global reader admin can’t edit any settings. |
However, when you try to gather information from the Teams Admin Center (TAC) or from PowerShell, you will notice that some information are not available. Specifically:
- Manage teams in the Teams menu is not available
- The whole Teams devices menu is not available
- The whole Teams apps menu is not available
- Teams advisor inside the Planning menu is not available
- Reporting Labels in the Analytics & Reports menu is not available
- The whole Notifications & alerts menu is missing
(The menu missing for the Global Reader are shown in the following images)
The only solution available is to ask for the Teams Administrator role.
All the other Teams administrative roles do not add the required menus / features.
The situation is similar in PowerShell, with an additional issue: if the Global Reader has no Teams license, and you try to run a command like get-team you will have an error:
ErrorMessage: Failed to get license information for the user. Ensure user has a valid Office365 license assigned to them.
If you add a Teams license to the user you will have the following error:
ErrorMessage: Failed to execute Skype backend request GetThreadRequest
At the moment the number of administrative roles available in Teams is really limited. Also, there is no read-only role or read-only Administrator in Microsoft Teams
In the next image you can see a full comparison of the Global Reader access to TAC, compared to a Teams Administrator
