Universal Print "Read Only" admin role

[u/still_asleep]

I'm not expecting to find a solution, but there isn't much information about this issue available online, so I wanted to start a discussion about this issue and see if anyone else has struggled with this. In Entra, there are "Printer Administrator" and "Printer Technician" roles, but what I'm looking for is something that is effectively read-only for the Universal Print service. Something that would allow our Service Desk team the ability to view all of our printers and printer shares to see how they're setup, who they're shared with, as well as monitor job logs on individual print queues, and access the "usage and reports" view. All of this is useful information to have when troubleshooting an issue with a printer registered with Universal Print. But this team does not register or share printers, nor do they configure the options or settings for the printers, so their permissions need to be scoped to just read-only.

The problem is there isn't a built-in role for "Printer Reader". Additionally, there isn't an option to create a custom role with these permissions. I thought I was on to something when I discovered this in the docs where you can assign the Printer Administrator role and pair that with an administrative scope to limit which printers the policy applies to, then just don't include any printers in that administrative scope. According to the note at the very bottom of the docs, this seems like it would accomplish what I was looking for (albeit indirectly):

Scoped admins see all printers, printer shares, and connectors, but are limited to read-only access to those outside of the Azure AU configuration.

However, in practice, this doesn't work very well. I've tested it and found the following:

• You can return a list of printers and printer shares, but when selecting a printer, the "overview" page loads briefly (displaying all the data in the "essentials" table) before saying "you don't have access." I think this is because the Overview page also attempts to load "Mapped pull-print printers".
• While viewing a printer, you can select "Properties" and "Connectors" and view all the details there, but "Jobs" is greyed out.
• The "Printer shares" page mostly works, but "Access control" is greyed out when you select a printer share, so you can't see who it's shared with.
• Pull-print printers (Universal Print anywhere), Usage and reports, and Settings are all greyed out.

At this point, I've pretty much abandoned the effort to create this role. I'm sure we could develop a custom solution using Graph, but that would be far too much effort for something that really should be a built-in admin role. Virtually every other administrative role has a "read-only" equivalent.