How to find permanent Global Administrators in Entra ID

Before you start

Use an account with Global Reader or Privileged Role Administrator. PIM, and with it eligible and time-bound assignments, needs Microsoft Entra ID P2 or Microsoft Entra ID Governance. If that licence lapses, eligible assignments are removed and time-bound active ones become permanent. The PowerShell example requests RoleManagement.Read.Directory; your organisation may require administrator consent.

An active assignment with no end date is permanent. An eligible one gives nothing until the person activates it, and an activation always ends. The examples read the current assignments and export them; they do not change any role, account or setting.

Option 1

Find permanent Global Administrators with PowerShell

Install the modules once, then connect and export the permanent assignments. The role filter runs in Microsoft Graph, and the script then drops the activated and time-bound assignments.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication -Scope CurrentUser
Install-Module Microsoft.Graph.Identity.Governance -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'RoleManagement.Read.Directory' -NoWelcome
try {
    # The Global Administrator role template ID is the same in every tenant.
    $query = @{
        Filter         = "roleDefinitionId eq '62e90394-69f5-4237-9190-012177145e10'"
        ExpandProperty = 'principal'
        All            = $true
    }
    try {
        # With PIM: keep assignments that were not activated and have no end date.
        $active = Get-MgRoleManagementDirectoryRoleAssignmentScheduleInstance @query
        $permanent = @($active |
            Where-Object { $_.AssignmentType -eq 'Assigned' -and -not $_.EndDateTime })
    } catch {
        # Without PIM there are no schedules to read, and every assignment is permanent.
        Write-Warning "PIM not read ($($_.Exception.Message)): listing every assignment."
        $permanent = @(Get-MgRoleManagementDirectoryRoleAssignment @query)
    }
    $report = @($permanent | ForEach-Object {
        $p = $_.Principal.AdditionalProperties
        [pscustomobject]@{
            DisplayName       = $p['displayName']
            UserPrincipalName = $p['userPrincipalName']
            PrincipalType     = $p['@odata.type'] -replace '^#microsoft\.graph\.', ''
            PrincipalId       = $_.PrincipalId
        }
    } | Sort-Object PrincipalType, DisplayName)
    if ($report.Count -eq 0) {
        Write-Output 'No permanent Global Administrator assignments were found.'
    } else {
        $report | Export-Csv -Path './permanent-global-admins.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) permanent Global Administrator assignments exported."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The script keeps 1 row for each permanent assignment, whether it is held by a user, a group or a service principal. A row whose PrincipalType is group gives the role to everyone in that group, so review the group's members too.

List who is eligible through PIM

Reconnect with Connect-MgGraph, then list the eligible Global Administrators to set beside the permanent ones. This read needs PIM.

# Run while connected to Microsoft Graph.
$roleId = '62e90394-69f5-4237-9190-012177145e10'
$name = @{ n = 'DisplayName'; e = { $_.Principal.AdditionalProperties['displayName'] } }
$until = @{ n = 'EligibleUntil'; e = { $_.ScheduleInfo.Expiration.EndDateTime } }
Get-MgRoleManagementDirectoryRoleEligibilitySchedule -All -ExpandProperty principal |
    Where-Object { $_.RoleDefinitionId -eq $roleId } |
    Select-Object $name, MemberType, $until

A blank EligibleUntil means the person stays eligible with no end date.

Option 2

Review Global Administrator assignments in the admin centre

1. Sign in to the Microsoft Entra admin centre for the correct tenant.
2. Go to Entra ID > Roles & admins.
3. Select the Global Administrator name to open the role, without ticking it.
4. Select Assignments. Without PIM, every assignment listed is permanent.
5. With PIM, eligible and active assignments are listed apart. Read the active ones: an active assignment with no end date is permanent. Leave the page without changing anything.

This suits a quick look at 1 tenant. Open any group listed to see its members. For a list you can keep and compare, use PowerShell or a report.

Common questions

Should every Global Administrator be eligible rather than permanent?

No. Microsoft recommends 2 cloud-only emergency access accounts with Global Administrator assigned as permanent and active, not eligible, for when normal administrator accounts cannot be used. Expect those in the list. Microsoft also recommends fewer than 5 Global Administrators in all.

Why does Get-MgRoleManagementDirectoryRoleAssignment list more people?

Role assignments include activated eligible assignments as well as permanent ones, and only the schedule instances carry the end time that tells them apart. Someone who activated the role an hour ago appears there until the activation ends.

How do I check the other admin roles?

Change the template ID in both scripts to another role's; Microsoft lists the template ID of each built-in role. To list the assignments of every role at once, see how to list admin role assignments.