Verifying "Restrict access to Microsoft Entra administration portal" Setting via API in Azure Entra ID

Question

Verifying "Restrict access to Microsoft Entra administration portal" Setting via API in Azure Entra ID

DiptiRanjan Swain 236

How can a script be written to check the current setting of all options under user settings in Azure Entra ID? Specifically, what is the method to verify via API whether the "Restrict access to Microsoft Entra administration portal" option is turned on or off?

Raja Pothuraju 32,635 Reputation points Microsoft External Staff Moderator

2025-08-12T15:22:41.5733333+00:00
Hello DiptiRanjan Swain,

To update User settings via PowerShell or the Graph API, you’ll need to work with the authorizationPolicy resource type.

PowerShell: Update-MgBetaPolicyAuthorizationPolicy

Graph API: authorizationPolicy resource type

Currently, the following properties can be updated via API:

allowEmailVerifiedUsersToJoinOrganization

allowInvitesFrom

allowUserConsentForRiskyApps

allowedToSignUpEmailBasedSubscriptions

allowedToUseSSPR

blockMsolPowerShell

defaultUserRolePermissions

However, the "Restrict access to Microsoft Entra administration portal" setting cannot be updated via the API at this time.

I’ll check internally to see if there’s any alternative method to update this setting other than through the UI.
DiptiRanjan Swain 236 Reputation points

2025-08-12T16:43:15.24+00:00

Hi Raja, thank you for answering. My requirement is to only fetch the current settings and do not update. The goal is to verify what is the current setting and if that is deviating from security standard. So, is there any other way to fetch all settings under "User settings" ?

Accepted answer

0 additional answers

Your answer

Raja Pothuraju 32,635 Reputation points Microsoft External Staff Moderator

2025-08-12T15:22:41.5733333+00:00

Hello DiptiRanjan Swain,

To update User settings via PowerShell or the Graph API, you’ll need to work with the authorizationPolicy resource type.

PowerShell: Update-MgBetaPolicyAuthorizationPolicy

Graph API: authorizationPolicy resource type

Currently, the following properties can be updated via API:

allowEmailVerifiedUsersToJoinOrganization

allowInvitesFrom

allowUserConsentForRiskyApps

allowedToSignUpEmailBasedSubscriptions

allowedToUseSSPR

blockMsolPowerShell

defaultUserRolePermissions

However, the "Restrict access to Microsoft Entra administration portal" setting cannot be updated via the API at this time.

I’ll check internally to see if there’s any alternative method to update this setting other than through the UI.
DiptiRanjan Swain 236 Reputation points

2025-08-12T16:43:15.24+00:00

Hi Raja, thank you for answering. My requirement is to only fetch the current settings and do not update. The goal is to verify what is the current setting and if that is deviating from security standard. So, is there any other way to fetch all settings under "User settings" ?

Answer 1

Raja Pothuraju 32,635 Microsoft External Staff Moderator

Hello DiptiRanjan Swain,

At present, the "Restrict access to Microsoft Entra administration portal" setting can only be viewed through the Azure Portal / Entra Admin Center. There are currently no Graph API or PowerShell commands available to retrieve or update this setting.

However, to fetch or update other details available in the User Settings blade, you can refer to the following documentation:

PowerShell: Update-MgBetaPolicyAuthorizationPolicy
Graph API: authorizationPolicy resource type
defaultUserRolePermissions resource type - Microsoft Graph v1.0 | Microsoft Learn to restrict user permissions.

How do I restrict access to the Entra Portal?

To restrict users from enumerating other users in the directory, the recommended approach is to modify the "defaultUserRolePermissions" in the tenant's AuthorizationPolicy and change the "allowedToReadOtherUsers" to FALSE Modify Default User Role Permissions in Graph

Raja Pothuraju 32,635 Reputation points Microsoft External Staff Moderator

2025-08-19T19:15:54.04+00:00

Hello DiptiRanjan Swain,

Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.
Raja Pothuraju 32,635 Reputation points Microsoft External Staff Moderator

2025-08-22T13:12:56.5066667+00:00

Hello DiptiRanjan Swain,

Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.
DiptiRanjan Swain 236 Reputation points

2025-08-25T14:11:51.8733333+00:00

Thank you. This is meeting the need for getting user settings, although not all but most.

Share via

Verifying "Restrict access to Microsoft Entra administration portal" Setting via API in Azure Entra ID

0 additional answers

Your answer