Problem
You’re developing in Azure and need a teammate to see the same App Registrations you do. You’ve looked at subscription-level IAM roles and nothing there controls App Registration visibility. That’s because App Registrations live in Microsoft Entra ID (the tenant), not in your Azure subscription.
Three Ways to Grant Access
Option 1: Entra ID Built-in Role
Go to the Entra admin center ? Identity ? Roles & admins. Assign one of these:
| Role | What They Can See | Can Edit? |
|---|---|---|
| Global Reader | All app registrations + enterprise apps | Read-only |
| Application Administrator | All app registrations + enterprise apps + App Proxy | Full management |
| Cloud Application Administrator | Same as above minus App Proxy | Full management |
| Directory Readers | Basic directory info including app registrations | Read-only |
Select the role, click Add assignments, choose your user, and save.
Option 2: Per-App Owner (Quickest)
If they only need visibility into specific registrations:
- Entra admin center ? Applications ? App registrations
- Open the target app ? Owners ? Add owners
- Select the user
They’ll see the app under “Owned applications” in their App Registrations view. No license requirement. No role overhead.
Option 3: Custom Entra ID Role
For read-only access scoped to just the app directory, create a custom role with these permissions:
microsoft.directory/applications/standard/read
microsoft.directory/applications/owners/read
microsoft.directory/servicePrincipals/standard/read
microsoft.directory/servicePrincipals/owners/read
Requires a Microsoft Entra ID P1 license.
Quick Decision Guide
| What You Need | Use This |
|---|---|
| Teammate sees everything but can’t change anything | Global Reader |
| Teammate needs full management of all apps | Application Administrator |
| Teammate only needs to see 1-3 specific apps | Add as Owner on each app |
| Read-only, granular, no extra privilege | Custom role (needs P1) |
Why Subscription RBAC Doesn’t Work
Azure RBAC roles (Owner, Contributor, Reader) control access to Azure resources – VMs, storage accounts, networks. App Registrations are Entra ID tenant objects, governed by Entra ID roles, not subscription-level RBAC. Even a subscription Owner can’t see App Registrations without the right Entra ID role.
Gotcha: “Users can register applications”
There’s a tenant-wide toggle under Entra ID ? User settings called Users can register applications. Turning it on lets anyone in the tenant create app registrations (and they’ll own what they create). This doesn’t grant visibility into existing apps – it only allows creation of new ones.
Leave a Reply