What can a standard user see in your Microsoft Entra directory?

 When did you last sign in to your tenant using an ordinary employee account and check what it could see?

Most administrators spend their day working with elevated permissions. That makes it easy to overlook the directory information available to everyone else.

A useful review starts with three questions: what can the account read, which applications can retrieve it, and which access policies apply?

1. Standard users have meaningful directory visibility

By default, Entra member users can read a broad range of directory information, including users, groups, application details, devices, and administrative role memberships.

That does not give them unrestricted administrative control. However, it can reveal more about your environment than you intended. Guest accounts have different, more restricted defaults.

From an operational perspective, consider what this information could tell someone using a compromised employee account: who holds privileged roles, how teams are organised, and which applications the organisation uses. These details can inform follow-up phishing and further investigation of potential attack paths.

What to review: Use a dedicated test account with no administrative roles. Record what it can actually retrieve before deciding which controls need changing.

2. The portal restriction toggle has limited reach

Under Entra ID → Users → User settings, you will find the setting to restrict access to the Microsoft Entra administration portal.

With the restriction disabled, non-administrators can enter the admin center. Enabling it restricts several commonly visited pages, but some remain accessible through direct links. It also leaves programmatic access unaffected and does not apply to users holding administrative roles, including custom roles.

Microsoft explicitly describes this setting as “not a security measure.”

What to review: Treat the toggle as a way to discourage casual browsing. A blocked landing page is insufficient proof that directory access has been restricted.

Microsoft reference: Default user permissions and available restrictions

3. Graph access depends on permissions and consent

Tools such as Graph Explorer and Microsoft Graph PowerShell provide another route to directory data.

For delegated access, the application acts on behalf of a signed-in user. What it can do depends on both the permissions granted to the application and the access available to that user. An ordinary account therefore does not automatically gain every Graph permission simply by opening a tool.

What to review: Examine existing application permissions and your user-consent policy together. Check which applications have directory-reading permissions, why they need them, and who owns the approval decision. Microsoft provides controls for restricting when users can consent to applications.

Microsoft references: Graph permissions · Configure user consent

4. Conditional Access must target the correct resource

For Azure management access, review Windows Azure Service Management API. Its coverage includes the Azure portal and Entra admin center. It also affects Azure PowerShell, but does not cover Microsoft Graph PowerShell.

There is another important distinction: Microsoft Admin Portals currently includes the Azure portal, but its grouping does not include every backend service those portals use.

Microsoft Graph itself is not directly selectable as a Conditional Access resource. Microsoft recommends identifying and targeting the underlying services, using audience reporting to understand the dependencies.

What to review: Check the resource and policy results in sign-in logs. A policy name such as “Block admin portals” does not establish which requests it actually covers.

Conditional Access requires appropriate licensing. Microsoft 365 Business Premium includes access to Conditional Access features; risk-based policies require Entra ID P2.

Microsoft reference: Conditional Access target resources

5. Restricting individual tools has a defined scope

Enterprise applications can require user assignment before access is permitted. Where supported, this can limit an application to approved users. Global Administrators are an exception to the assignment requirement.

For Graph Explorer or Microsoft Graph Command Line Tools, validate the behaviour of the relevant enterprise application with assigned and unassigned test accounts.

The scope matters: restricting a particular client does not remove the user’s underlying directory permissions. Other authorised applications may still provide access.

What to review: Document the control accurately—for example, “unassigned users cannot access this application.” Avoid treating that result as proof that all directory enumeration is blocked.

Microsoft reference: Enterprise application properties

6. Test the complete workflow before enforcement

Start Conditional Access changes in report-only mode, examine their results, and move to a small pilot before broader enforcement. Test normal business workflows alongside the access you intend to restrict.

Before enabling restrictive policies, confirm that your emergency access accounts are excluded and functional. Keep those accounts protected and monitored.

Keep a short record of:

• The test account, roles, and application permissions.

• The client and resource being accessed.

• The expected outcome and actual result.

• The policy responsible and the rollback procedure.

Microsoft references: Plan a Conditional Access deployment · Emergency access accounts

Make the outcome measurable

Portal visibility, application access, directory permissions, and Conditional Access each address a different part of the problem.

A useful review should establish exactly what an ordinary account can retrieve, under which conditions, and whether that access serves a business purpose.

ESENEL helps IT teams turn access settings, application ownership, and documented procedures into controls they can test and explain. Start with one standard account and a clear record of what it can see.