Assigning Global Reader manually

Before you start

• Admin consent for the module is already granted (the app must exist in the customer's tenant).
• The application ID of the app that needs the role (see below).

Which app needs the role

• M365 Assessment – Exchange & Security and M365 Assessment – Teams (modular customers).
• M365Assessments Collector, application ID 83a56eb5-8a95-493b-8d41-1544aafc40dd (legacy customers).

The application ID is shown in the wizard under each module (“App: … · id”) and in Entra admin center › Enterprise applications › the app › Overview.

Option A: Microsoft Entra admin center

1. Sign in to entra.microsoft.com as a Global Administrator or Privileged Role Administrator.

2. Go to Roles & admins and open Global Reader.

3. Select Add assignments, then Select member(s). Search for the app name or its application ID, select it, and choose Select.

4. If your tenant uses Privileged Identity Management, choose assignment type Active and Permanently assigned: an app can't activate an eligible role.

5. Select Next, then Assign.

Option B: Microsoft Graph PowerShell

# Run as a Global Administrator or Privileged Role Administrator of the customer tenant.
# Needs: Install-Module Microsoft.Graph.Applications, Microsoft.Graph.Identity.Governance -Scope CurrentUser
Connect-MgGraph -Scopes 'RoleManagement.ReadWrite.Directory', 'Application.Read.All' -NoWelcome
$appId        = '<application id>'   # the module app (or the legacy Collector)
$globalReader = 'f2ef992c-3afb-46b9-b7cf-a126ee74c451'   # built-in Global Reader (read-only)
$sp = Get-MgServicePrincipal -Filter "appId eq '$appId'"
if (-not $sp) { throw 'App not found - grant admin consent for this module first.' }
$existing = Get-MgRoleManagementDirectoryRoleAssignment -Filter "principalId eq '$($sp.Id)' and roleDefinitionId eq '$globalReader'"
if ($existing) { 'Global Reader is already assigned.' } else {
    New-MgRoleManagementDirectoryRoleAssignment -PrincipalId $sp.Id -RoleDefinitionId $globalReader -DirectoryScopeId '/' | Out-Null
    'Global Reader assigned.'
}
Disconnect-MgGraph | Out-Null

Replace <application id> with the app's ID. For the Power Platform module, the equivalent step is registering the app as a management application:

# Run as a Power Platform Administrator or Global Administrator of the customer tenant.
# Install-Module Microsoft.PowerApps.Administration.PowerShell -Scope CurrentUser
Add-PowerAppsAccount
New-PowerAppManagementApp -ApplicationId <application id>

After assigning the role

If you are in the onboarding wizard, select I've done this on the row. Either way, the next assessment verifies the role and the Modules card changes to Global Reader verified. Role changes can take up to an hour to reach Exchange Online and Purview, so a run right after the change may still skip those sections.