Read-Only Access to Everything in Entra ID: Global Reader

To give someone read-only access to all tenant settings, assign the Global Reader role:

Entra admin center > Identity > Roles & admins > Global Reader > Add assignments and pick the user.

Global Reader can see everything in Entra ID and the Microsoft 365 admin centers, but can't change anything.

Note: Global Reader does not cover Azure resources (VMs, storage, etc.). For those, also assign the Azure RBAC Reader role at subscription or management group level:

Subscriptions > your subscription > Access control (IAM) > Add role assignment > Reader

More info.