Get-EntraPrivilegedRoleAssignmentReport

<#
.SYNOPSIS
    Reports users assigned to privileged directory roles.

.DESCRIPTION
    Lists every member of built in privileged roles like Global
    Administrator, Privileged Role Administrator and Exchange
    Administrator, so standing (non PIM) access gets reviewed rather than
    accumulating unnoticed.

.EXAMPLE
    .\Get-EntraPrivilegedRoleAssignmentReport.ps1

.NOTES
    Requires Microsoft.Graph.Identity.DirectoryManagement with an active
    Connect-MgGraph session.

.AUTHOR
    Shehryar Hassan
#>

$privilegedRoles = @("Global Administrator", "Privileged Role Administrator", "Exchange Administrator", "SharePoint Administrator", "User Administrator")

$report = foreach ($roleName in $privilegedRoles) {
    $role = Get-MgDirectoryRole -Filter "displayName eq '$roleName'"
    if ($role) {
        $members = Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id
        foreach ($member in $members) {
            [pscustomobject]@{
                Role   = $roleName
                Member = $member.AdditionalProperties.displayName
                Type   = $member.AdditionalProperties.'@odata.type' -replace '#microsoft.graph.', ''
            }
        }
    }
}

$report | Sort-Object Role | Format-Table -AutoSize
Write-Host "$($report.Count) privileged role assignment(s) found" -ForegroundColor Cyan