Microsoft Entra built-in roles

In Microsoft Entra ID, if another administrator or non-administrator needs to manage Microsoft Entra resources, you assign them a Microsoft Entra role that provides the permissions they need. For example, you can assign roles to allow adding or changing users, resetting user passwords, managing user licenses, or managing domain names.

This article lists the Microsoft Entra built-in roles you can assign to allow management of Microsoft Entra resources. For information about how to assign roles, see Assign Microsoft Entra roles to users. If you are looking for roles to manage Azure resources, see Azure built-in roles.

All roles

AI Administrator

Assign the AI Administrator role to users who need to do the following tasks:

• Manage all aspects of Microsoft 365 Copilot
• Manage AI-related enterprise services, extensibility, and copilot agents from the Integrated apps page in the Microsoft 365 admin center
• Approve and publish line-of-business copilot agents
• Allow users to install an app or install an app for users in the organization if the app does not require permission
• Read and configure Azure and Microsoft 365 service health dashboards
• View usage reports, adoption insights, and organizational insight
• Create and manage support tickets in Azure and the Microsoft 365 admin center

Application Administrator

This is a privileged role. Users in this role can create and manage all aspects of enterprise applications, application registrations, and application proxy settings. Note that users assigned to this role are not added as owners when creating new application registrations or enterprise applications.

This role also grants the ability to consent for delegated permissions and application permissions, with the exception of application permissions for Azure AD Graph and Microsoft Graph.

Application Developer

This is a privileged role. Users in this role can create application registrations when the "Users can register applications" setting is set to No. This role also grants permission to consent on one's own behalf when the "Users can consent to apps accessing company data on their behalf" setting is set to No. Users assigned to this role are added as owners when creating new application registrations.

Attack Payload Author

Users in this role can create attack payloads but not actually launch or schedule them. Attack payloads are then available to all administrators in the tenant who can use them to create a simulation.

For more information, see Microsoft Defender for Office 365 permissions in the Microsoft 365 Defender portal and Permissions in the Microsoft Purview compliance portal.

Attack Simulation Administrator

Users in this role can create and manage all aspects of attack simulation creation, launch/scheduling of a simulation, and the review of simulation results. Members of this role have this access for all simulations in the tenant.

For more information, see Microsoft Defender for Office 365 permissions in the Microsoft 365 Defender portal and Permissions in the Microsoft Purview compliance portal.

Attribute Assignment Administrator

Users with this role can assign and remove custom security attribute keys and values for supported Microsoft Entra objects such as users, service principals, and devices.

For more information, see Manage access to custom security attributes in Microsoft Entra ID.

Attribute Assignment Reader

Users with this role can read custom security attribute keys and values for supported Microsoft Entra objects.

For more information, see Manage access to custom security attributes in Microsoft Entra ID.

Attribute Definition Administrator

Users with this role can define a valid set of custom security attributes that can be assigned to supported Microsoft Entra objects. This role can also activate and deactivate custom security attributes.

For more information, see Manage access to custom security attributes in Microsoft Entra ID.

Attribute Definition Reader

Users with this role can read the definition of custom security attributes.

For more information, see Manage access to custom security attributes in Microsoft Entra ID.

Attribute Log Administrator

Assign the Attribute Log Reader role to users who need to do the following tasks:

• Read audit logs for custom security attribute value changes
• Read audit logs for custom security attribute definition changes and assignments
• Configure diagnostic settings for custom security attributes

Users with this role cannot read audit logs for other events.

For more information, see Manage access to custom security attributes in Microsoft Entra ID.

Attribute Log Reader

Assign the Attribute Log Reader role to users who need to do the following tasks:

• Read audit logs for custom security attribute value changes
• Read audit logs for custom security attribute definition changes and assignments

Users with this role cannot do the following tasks:

• Configure diagnostic settings for custom security attributes
• Read audit logs for other events

For more information, see Manage access to custom security attributes in Microsoft Entra ID.

Authentication Administrator

This is a privileged role. Assign the Authentication Administrator role to users who need to do the following:

• Set or reset any authentication method (including passwords) for non-administrators and some roles. For a list of the roles that an Authentication Administrator can read or update authentication methods, see Who can reset passwords.
• Require users who are non-administrators or assigned to some roles to re-register against existing non-password credentials (for example, MFA or FIDO), and can also revoke remember MFA on the device, which prompts for MFA on the next sign-in.
• Manage MFA settings in the legacy MFA management portal.
• Perform sensitive actions for some users. For more information, see Who can perform sensitive actions.
• Create and manage support tickets in Azure and the Microsoft 365 admin center.

Users with this role cannot do the following:

• Cannot change the credentials or reset MFA for members and owners of a role-assignable group.
• Cannot manage Hardware OATH tokens.

The following table compares the capabilities of authentication-related roles.

Role	Manage user's auth methods	Manage per-user MFA	Manage MFA settings	Manage auth method policy	Manage password protection policy	Update sensitive properties	Delete and restore users
Authentication Administrator	Yes for some users	Yes for some users	Yes	No	No	Yes for some users	Yes for some users
Privileged Authentication Administrator	Yes for all users	Yes for all users	No	No	No	Yes for all users	Yes for all users
Authentication Policy Administrator	No	Yes	Yes	Yes	Yes	No	No
User Administrator	No	No	No	No	No	Yes for some users	Yes for some users

Authentication Extensibility Administrator

This is a privileged role. Assign the Authentication Extensibility Administrator role to users who need to do the following tasks:

• Create and manage all aspects of custom authentication extensions.

Users with this role cannot do the following:

• Cannot assign custom authentication extensions to applications to modify the authentication experiences, and cannot consent to application permissions or create app registrations associated with the custom authentication extension. Instead, you must use the Application Administrator, Application Developer, or Cloud Application Administrator roles.

A custom authentication extension is an API endpoint created by a developer for authentication events and is registered in Microsoft Entra ID. Application administrators and application owners can use custom authentication extensions to customize their application's authentication experiences, such as sign in and sign up, or password reset.

Authentication Policy Administrator

Assign the Authentication Policy Administrator role to users who need to do the following:

• Configure the authentication methods policy, tenant-wide MFA settings, and password protection policy that determine which methods each user can register and use.
• Manage Password Protection settings: smart lockout configurations and updating the custom banned passwords list.
• Manage MFA settings in the legacy MFA management portal.
• Create and manage verifiable credentials.
• Create and manage Azure support tickets.

Users with this role cannot do the following:

• Cannot update sensitive properties. For more information, see Who can perform sensitive actions.
• Cannot delete or restore users. For more information, see Who can perform sensitive actions.
• Cannot manage Hardware OATH tokens.

The following table compares the capabilities of authentication-related roles.

Role	Manage user's auth methods	Manage per-user MFA	Manage MFA settings	Manage auth method policy	Manage password protection policy	Update sensitive properties	Delete and restore users
Authentication Administrator	Yes for some users	Yes for some users	Yes	No	No	Yes for some users	Yes for some users
Privileged Authentication Administrator	Yes for all users	Yes for all users	No	No	No	Yes for all users	Yes for all users
Authentication Policy Administrator	No	Yes	Yes	Yes	Yes	No	No
User Administrator	No	No	No	No	No	Yes for some users	Yes for some users

Azure DevOps Administrator

Users with this role can manage all enterprise Azure DevOps policies, applicable to all Azure DevOps organizations backed by Microsoft Entra ID. Users in this role can manage these policies by navigating to any Azure DevOps organization that is backed by the company's Microsoft Entra ID. Additionally, users in this role can claim ownership of orphaned Azure DevOps organizations. This role grants no other Azure DevOps-specific permissions (for example, Project Collection Administrators) inside any of the Azure DevOps organizations backed by the company's Microsoft Entra organization.

Azure Information Protection Administrator

Users with this role have all permissions in the Azure Information Protection service. This role allows configuring labels for the Azure Information Protection policy, managing protection templates, and activating protection. This role does not grant any permissions in Microsoft Entra ID Protection, Privileged Identity Management, Monitor Microsoft 365 Service Health, Microsoft 365 Defender portal, or Microsoft Purview compliance portal.

B2C IEF Keyset Administrator

This is a privileged role. User can create and manage policy keys and secrets for token encryption, token signatures, and claim encryption/decryption. By adding new keys to existing key containers, this limited administrator can roll over secrets as needed without impacting existing applications. This user can see the full content of these secrets and their expiration dates even after their creation.

B2C IEF Policy Administrator

Users in this role have the ability to create, read, update, and delete all custom policies in Azure AD B2C and therefore have full control over the Identity Experience Framework in the relevant Azure AD B2C organization. By editing policies, this user can establish direct federation with external identity providers, change the directory schema, change all user-facing content (HTML, CSS, JavaScript), change the requirements to complete an authentication, create new users, send user data to external systems including full migrations, and edit all user information including sensitive fields like passwords and phone numbers. Conversely, this role cannot change the encryption keys or edit the secrets used for federation in the organization.

Billing Administrator

Makes purchases, manages subscriptions, manages support tickets, and monitors service health.

Cloud App Security Administrator

Users with this role have full permissions in Defender for Cloud Apps. They can add administrators, add Microsoft Defender for Cloud Apps policies and settings, upload logs, and perform governance actions.

Cloud Application Administrator

This is a privileged role. Users in this role have the same permissions as the Application Administrator role, excluding the ability to manage application proxy. This role grants the ability to create and manage all aspects of enterprise applications and application registrations. Users assigned to this role are not added as owners when creating new application registrations or enterprise applications.

This role also grants the ability to consent for delegated permissions and application permissions, with the exception of application permissions for Azure AD Graph and Microsoft Graph.

Cloud Device Administrator

This is a privileged role. Users in this role can enable, disable, and delete devices in Microsoft Entra ID and read Windows 10 BitLocker keys (if present) in the Azure portal. The role does not grant permissions to manage any other properties on the device.

Compliance Administrator

Users with this role have permissions to manage compliance-related features in the Microsoft Purview compliance portal, Microsoft 365 admin center, Azure, and Microsoft 365 Defender portal. Assignees can also manage all features within the Exchange admin center and create support tickets for Azure and Microsoft 365. For more information, see Roles and role groups in Microsoft Defender for Office 365 and Microsoft Purview compliance.

In	Can do
Microsoft Purview compliance portal	Protect and manage your organization's data across Microsoft 365 services Manage compliance alerts
Microsoft Purview Compliance Manager	Track, assign, and verify your organization's regulatory compliance activities
Microsoft 365 Defender portal	Manage data governance Perform legal and data investigation Manage Data Subject Request This role has the same permissions as the Compliance Administrator role group in Microsoft 365 Defender portal role-based access control.
Intune	View all Intune audit data
Microsoft Defender for Cloud Apps	Has read-only permissions and can manage alerts Can create and modify file policies and allow file governance actions Can view all the built-in reports under Data Management

Compliance Data Administrator

Users with this role have permissions to track data in the Microsoft Purview compliance portal, Microsoft 365 admin center, and Azure. Users can also track compliance data within the Exchange admin center, Compliance Manager, and Teams & Skype for Business admin center and create support tickets for Azure and Microsoft 365. For more information about the differences between Compliance Administrator and Compliance Data Administrator, see Roles and role groups in Microsoft Defender for Office 365 and Microsoft Purview compliance.

In	Can do
Microsoft Purview compliance portal	Monitor compliance-related policies across Microsoft 365 services Manage compliance alerts
Microsoft Purview Compliance Manager	Track, assign, and verify your organization's regulatory compliance activities
Microsoft 365 Defender portal	Manage data governance Perform legal and data investigation Manage Data Subject Request This role has the same permissions as the Compliance Data Administrator role group in Microsoft 365 Defender portal role-based access control.
Intune	View all Intune audit data
Microsoft Defender for Cloud Apps	Has read-only permissions and can manage alerts Can create and modify file policies and allow file governance actions Can view all the built-in reports under Data Management

Conditional Access Administrator

This is a privileged role. Users with this role have the ability to manage Microsoft Entra Conditional Access settings.

Customer LockBox Access Approver

Manages Microsoft Purview Customer Lockbox requests in your organization. They receive email notifications for Customer Lockbox requests and can approve and deny requests from the Microsoft 365 admin center. They can also turn the Customer Lockbox feature on or off. Only Global Administrators can reset the passwords of people assigned to this role.

Desktop Analytics Administrator

Users in this role can manage the Desktop Analytics service. This includes the ability to view asset inventory, create deployment plans, and view deployment and health status.

Directory Readers

Users in this role can read basic directory information. This role should be used for:

• Granting a specific set of guest users read access instead of granting it to all guest users.
• Granting a specific set of non-admin users access to Microsoft Entra admin center when "Restrict access to Microsoft Entra admin center" is set to "Yes".
• Granting service principals access to directory where Directory.Read.All is not an option.

Directory Synchronization Accounts

Do not use. This role is automatically assigned to the Microsoft Entra Connect service, and is not intended or supported for any other use.

Directory Writers

This is a privileged role. Users in this role can read and update basic information of users, groups, and service principals.

Domain Name Administrator

This is a privileged role. Users with this role can manage (read, add, verify, update, and delete) domain names. They can also read directory information about users, groups, and applications, as these objects possess domain dependencies. For on-premises environments, users with this role can configure domain names for federation so that associated users are always authenticated on-premises. These users can then sign into Microsoft Entra based services with their on-premises passwords via single sign-on. Federation settings need to be synced via Microsoft Entra Connect, so users also have permissions to manage Microsoft Entra Connect.

Dynamics 365 Administrator

Users with this role have global permissions within Microsoft Dynamics 365 Online, when the service is present, as well as the ability to manage support tickets and monitor service health. For more information, see Use service admin roles to manage your tenant.

Dynamics 365 Business Central Administrator

Assign the Dynamics 365 Business Central Administrator role to users who need to do the following tasks:

• Access Dynamics 365 Business Central environments
• Perform all administrative tasks on environments
• Manage the lifecycle of customer's environments
• Supervise the extensions installed on environments
• Control upgrades of environments
• Perform data exports of environments
• Read and configure Azure and Microsoft 365 service health dashboards

This role does not provide any permissions for other Dynamics 365 products.

Edge Administrator

Users in this role can create and manage the enterprise site list required for Internet Explorer mode on Microsoft Edge. This role grants permissions to create, edit, and publish the site list and additionally allows access to manage support tickets. Learn more

Exchange Administrator

Users with this role have global permissions within Microsoft Exchange Online, when the service is present. Also has the ability to create and manage all Microsoft 365 groups, manage support tickets, and monitor service health. For more information, see About admin roles in the Microsoft 365 admin center.

Exchange Recipient Administrator

Users with this role have read access to recipients and write access to the attributes of those recipients in Exchange Online. For more information, see Recipients in Exchange Server.

External ID User Flow Administrator

Users with this role can create and manage user flows (also called "built-in" policies) in the Azure portal. These users can customize HTML/CSS/JavaScript content, change MFA requirements, select claims in the token, manage API connectors and their credentials, and configure session settings for all user flows in the Microsoft Entra organization. On the other hand, this role does not include the ability to review user data or make changes to the attributes that are included in the organization schema. Changes to Identity Experience Framework policies (also known as custom policies) are also outside the scope of this role.

External ID User Flow Attribute Administrator

Users with this role add or delete custom attributes available to all user flows in the Microsoft Entra organization. As such, users with this role can change or add new elements to the end-user schema and impact the behavior of all user flows and indirectly result in changes to what data may be asked of end users and ultimately sent as claims to applications. This role cannot edit user flows.

External Identity Provider Administrator

This is a privileged role. This administrator manages federation between Microsoft Entra organizations and external identity providers. With this role, users can add new identity providers and configure all available settings (e.g. authentication path, service ID, assigned key containers). This user can enable the Microsoft Entra organization to trust authentications from external identity providers. The resulting impact on end-user experiences depends on the type of organization:

• Microsoft Entra organizations for employees and partners: The addition of a federation (e.g. with Gmail) will immediately impact all guest invitations not yet redeemed.
• Azure Active Directory B2C organizations: The addition of a federation (for example, with another Microsoft Entra organization) does not immediately impact end-user flows until the identity provider is added as an option in a user flow (also called a built-in policy). To change user flows, the limited role of "B2C User Flow Administrator" is required.

Fabric Administrator

Users with this role have global permissions within Microsoft Fabric and Power BI, when the service is present, as well as the ability to manage support tickets and monitor service health.

Global Administrator

This is a privileged role. Users with this role have access to all administrative features in Microsoft Entra ID, as well as services that use Microsoft Entra identities like the Microsoft 365 Defender portal, the Microsoft Purview compliance portal, Exchange Online, SharePoint Online, and Skype for Business Online. Global Administrators can view Directory Activity logs. Furthermore, Global Administrators can elevate their access to manage all Azure subscriptions and management groups. This allows Global Administrators to get full access to all Azure resources using the respective Microsoft Entra tenant. The person who signs up for the Microsoft Entra organization becomes a Global Administrator. There can be more than one Global Administrator at your company. Global Administrators can reset the password for any user and all other administrators. A Global Administrator cannot remove their own Global Administrator assignment. This is to prevent a situation where an organization has zero Global Administrators.

Global Reader

This is a privileged role. Users in this role can read settings and administrative information across Microsoft 365 services but can't take management actions. Global Reader is the read-only counterpart to Global Administrator. Assign Global Reader instead of Global Administrator for planning, audits, or investigations. Use Global Reader in combination with other limited admin roles like Exchange Administrator to make it easier to get work done without the assigning the Global Administrator role. Global Reader works with Microsoft 365 admin center, Exchange admin center, SharePoint admin center, Teams admin center, Microsoft 365 Defender portal, Microsoft Purview compliance portal, Azure portal, and Device Management admin center.

Users with this role cannot do the following:

• Cannot access the Purchase Services area in the Microsoft 365 admin center.

Global Secure Access Administrator

Assign the Global Secure Access Administrator role to users who need to do the following:

• Create and manage all aspects of Microsoft Entra Internet Access and Microsoft Entra Private Access
• Manage access to public and private endpoints

Users with this role cannot do the following:

• Cannot manage enterprise applications, application registrations, Conditional Access, or application proxy settings

Groups Administrator

Users in this role can create/manage groups and its settings like naming and expiration policies. It is important to understand that assigning a user to this role gives them the ability to manage all groups in the organization across various workloads like Teams, SharePoint, Yammer in addition to Outlook. Also the user will be able to manage the various groups settings across various admin portals like Microsoft admin center, Azure portal, as well as workload specific ones like Teams and SharePoint admin centers.

Guest Inviter

Users in this role can manage Microsoft Entra B2B guest user invitations when the Members can invite user setting is set to No. More information about B2B collaboration at About Microsoft Entra B2B collaboration. It does not include any other permissions.

Helpdesk Administrator

This is a privileged role. Users with this role can change passwords, invalidate refresh tokens, create and manage support requests with Microsoft for Azure and Microsoft 365 services, and monitor service health. Invalidating a refresh token forces the user to sign in again. Whether a Helpdesk Administrator can reset a user's password and invalidate refresh tokens depends on the role the user is assigned. For a list of the roles that a Helpdesk Administrator can reset passwords for and invalidate refresh tokens, see Who can reset passwords.

Users with this role cannot do the following:

• Cannot change the credentials or reset MFA for members and owners of a role-assignable group.

Delegating administrative permissions over subsets of users and applying policies to a subset of users is possible with Administrative Units.

This role was previously named Password Administrator in the Azure portal. It was renamed to Helpdesk Administrator to align with the existing name in the Microsoft Graph API and Microsoft Graph PowerShell.

Hybrid Identity Administrator

This is a privileged role. Users in this role can create, manage and deploy provisioning configuration setup from Active Directory to Microsoft Entra ID using Cloud Provisioning as well as manage Microsoft Entra Connect, Password hash synchronization (PHS), and federation settings. Users can also troubleshoot and monitor logs using this role.

Identity Governance Administrator

Users with this role can manage Microsoft Entra ID Governance configuration, including access packages, access reviews, catalogs and policies, ensuring access is approved and reviewed and guest users who no longer need access are removed.

Insights Administrator

Users in this role can access the full set of administrative capabilities in the Microsoft Viva Insights app. This role has the ability to read directory information, monitor service health, file support tickets, and access the Insights Administrator settings aspects.

Learn more

Insights Analyst

Assign the Insights Analyst role to users who need to do the following:

• Analyze data in the Microsoft Viva Insights app, but can't manage any configuration settings
• Create, manage, and run queries
• View basic settings and reports in the Microsoft 365 admin center
• Create and manage service requests in the Microsoft 365 admin center

Learn more

Insights Business Leader

Users in this role can access a set of dashboards and insights via the Microsoft Viva Insights app. This includes full access to all dashboards and presented insights and data exploration functionality. Users in this role do not have access to product configuration settings, which is the responsibility of the Insights Administrator role.

Learn more

Intune Administrator

This is a privileged role. Users with this role have global permissions within Microsoft Intune Online, when the service is present. Additionally, this role contains the ability to manage users and devices in order to associate policy, as well as create and manage groups. For more information, see Role-based administration control (RBAC) with Microsoft Intune.

This role can create and manage all security groups. However, Intune Administrator does not have admin rights over Microsoft 365 groups. That means the admin cannot update owners or memberships of all Microsoft 365 groups in the organization. However, he/she can manage the Microsoft 365 group that he creates which comes as a part of his/her end-user privileges. So, any Microsoft 365 group (not security group) that he/she creates should be counted against his/her quota of 250.

Kaizala Administrator

Users with this role have global permissions to manage settings within Microsoft Kaizala, when the service is present, as well as the ability to manage support tickets and monitor service health. Additionally, the user can access reports related to adoption & usage of Kaizala by Organization members and business reports generated using the Kaizala actions.

Knowledge Administrator

Users in this role have full access to all knowledge, learning and intelligent features settings in the Microsoft 365 admin center. They have a general understanding of the suite of products, licensing details and have responsibility to control access. Knowledge Administrator can create and manage content, like topics, acronyms and learning resources. Additionally, these users can create content centers, monitor service health, and create service requests.

Knowledge Manager

Users in this role can create and manage content, like topics, acronyms and learning content. These users are primarily responsible for the quality and structure of knowledge. This user has full rights to topic management actions to confirm a topic, approve edits, or delete a topic. This role can also manage taxonomies as part of the term store management tool and create content centers.

License Administrator

Users in this role can read, add, remove, and update license assignments on users, groups (using group-based licensing), and manage the usage location on users. The role does not grant the ability to purchase or manage subscriptions, create or manage groups, or create or manage users beyond the usage location. This role has no access to view, create, or manage support tickets.

Lifecycle Workflows Administrator

This is a privileged role. Assign the Lifecycle Workflows Administrator role to users who need to do the following tasks:

• Create and manage all aspects of workflows and tasks associated with Lifecycle Workflows in Microsoft Entra ID
• Check the execution of scheduled workflows
• Launch on-demand workflow runs
• Inspect workflow execution logs

Message Center Privacy Reader

Users in this role can monitor all notifications in the Message Center, including data privacy messages. Message Center Privacy Readers get email notifications including those related to data privacy and they can unsubscribe using Message Center Preferences. Only the Global Administrator and the Message Center Privacy Reader can read data privacy messages. Additionally, this role contains the ability to view groups, domains, and subscriptions. This role has no permission to view, create, or manage service requests.

Message Center Reader

Users in this role can monitor notifications and advisory health updates in Message center for their organization on configured services such as Exchange, Intune, and Microsoft Teams. Message Center Readers receive weekly email digests of posts, updates, and can share message center posts in Microsoft 365. In Microsoft Entra ID, users assigned to this role will only have read-only access on Microsoft Entra services such as users and groups. This role has no access to view, create, or manage support tickets.

Microsoft 365 Migration Administrator

Assign the Microsoft 365 Migration Administrator role to users who need to do the following tasks:

• Use Migration Manager in the Microsoft 365 admin center to manage content migration to Microsoft 365, including Teams, OneDrive for Business, and SharePoint sites, from Google Drive, Dropbox, Box, and Egnyte
• Select migration sources, create migration inventories (such as Google Drive user lists), schedule and execute migrations, and download reports
• Create new SharePoint sites if the destination sites don't already exist, create SharePoint lists under the SharePoint admin sites, and create and update items in SharePoint lists
• Manage migration project settings and migration lifecycle for tasks
• Manage permission mappings from source to destination

Learn more

Microsoft Entra Joined Device Local Administrator

This role is available for assignment only as an additional local administrator in Device settings. Users with this role become local machine administrators on all Windows 10 devices that are joined to Microsoft Entra ID. They do not have the ability to manage devices objects in Microsoft Entra ID.

Network Administrator

Users in this role can review network perimeter architecture recommendations from Microsoft that are based on network telemetry from their user locations. Network performance for Microsoft 365 relies on careful enterprise customer network perimeter architecture which is generally user location specific. This role allows for editing of discovered user locations and configuration of network parameters for those locations to facilitate improved telemetry measurements and design recommendations

Office Apps Administrator

Users in this role can manage Microsoft 365 apps' cloud settings. This includes managing cloud policies, self-service download management and the ability to view Office apps related report. This role additionally grants the ability to manage support tickets, and monitor service health within the main admin center. Users assigned to this role can also manage communication of new features in Office apps.

Organizational Branding Administrator

Assign the Organizational Branding Administrator role to users who need to do the following tasks:

• Manage all aspects of organizational branding in a tenant
• Read, create, update, and delete branding themes
• Manage the default branding theme and all branding localization themes

Organizational Messages Approver

Assign the Organizational Messages Approver role to users who need to do the following tasks:

• Review, approve, or reject new organizational messages for delivery in the Microsoft 365 admin center before they are sent to users using the Microsoft 365 Organizational Messages platform
• Read all aspects of organizational messages
• Read basic properties on all resources in the Microsoft 365 admin center

Organizational Messages Writer

Assign the Organizational Messages Writer role to users who need to do the following tasks:

• Write, publish, and delete organizational messages using Microsoft 365 admin center or Microsoft Intune
• Manage organizational message delivery options using Microsoft 365 admin center or Microsoft Intune
• Read organizational message delivery results using Microsoft 365 admin center or Microsoft Intune
• View usage reports and most settings in the Microsoft 365 admin center, but can't make changes

Password Administrator

This is a privileged role. Users with this role have limited ability to manage passwords. This role does not grant the ability to manage service requests or monitor service health. Whether a Password Administrator can reset a user's password depends on the role the user is assigned. For a list of the roles that a Password Administrator can reset passwords for, see Who can reset passwords.

Users with this role cannot do the following:

• Cannot change the credentials or reset MFA for members and owners of a role-assignable group.

Power Platform Administrator

Users in this role can create and manage all aspects of environments, Power Apps, Flows, Data Loss Prevention policies. Additionally, users with this role have the ability to manage support tickets and monitor service health.

Printer Administrator

Users in this role can register printers and manage all aspects of all printer configurations in the Microsoft Universal Print solution, including the Universal Print Connector settings. They can consent to all delegated print permission requests. Printer Administrators also have access to print reports.

Printer Technician

Users with this role can register printers and manage printer status in the Microsoft Universal Print solution. They can also read all connector information. Key task a Printer Technician cannot do is set user permissions on printers and sharing printers.

Privileged Authentication Administrator

This is a privileged role. Assign the Privileged Authentication Administrator role to users who need to do the following:

• Set or reset any authentication method (including passwords) for any user, including Global Administrators.
• Delete or restore any users, including Global Administrators. For more information, see Who can perform sensitive actions.
• Force users to re-register against existing non-password credential (such as MFA or FIDO2) and revoke remember MFA on the device, prompting for MFA on the next sign-in of all users.
• Update sensitive properties for all users. For more information, see Who can perform sensitive actions.
• Create and manage support tickets in Azure and the Microsoft 365 admin center.
• Configure certificate authorities with a PKI-based trust store (preview)

Users with this role cannot do the following:

• Cannot manage per-user MFA in the legacy MFA management portal.

The following table compares the capabilities of authentication-related roles.

Role	Manage user's auth methods	Manage per-user MFA	Manage MFA settings	Manage auth method policy	Manage password protection policy	Update sensitive properties	Delete and restore users
Authentication Administrator	Yes for some users	Yes for some users	Yes	No	No	Yes for some users	Yes for some users
Privileged Authentication Administrator	Yes for all users	Yes for all users	No	No	No	Yes for all users	Yes for all users
Authentication Policy Administrator	No	Yes	Yes	Yes	Yes	No	No
User Administrator	No	No	No	No	No	Yes for some users	Yes for some users

Privileged Role Administrator

This is a privileged role. Users with this role can manage role assignments in Microsoft Entra ID, as well as within Microsoft Entra Privileged Identity Management. They can create and manage groups that can be assigned to Microsoft Entra roles. In addition, this role allows management of all aspects of Privileged Identity Management and administrative units.

Reports Reader

Users with this role can view usage reporting data and the reports dashboard in Microsoft 365 admin center and the adoption context pack in Fabric and Power BI. Additionally, the role provides access to all sign-in logs, audit logs, and activity reports in Microsoft Entra ID and data returned by the Microsoft Graph reporting API. A user assigned to the Reports Reader role can access only relevant usage and adoption metrics. They don't have any admin permissions to configure settings or access the product-specific admin centers like Exchange. This role has no access to view, create, or manage support tickets.

Search Administrator

Users in this role have full access to all Microsoft Search management features in the Microsoft 365 admin center. Additionally, these users can view the message center, monitor service health, and create service requests.

Search Editor

Users in this role can create, manage, and delete content for Microsoft Search in the Microsoft 365 admin center, including bookmarks, Q&As, and locations.

Security Administrator

This is a privileged role. Users with this role have permissions to manage security-related features in the Microsoft 365 Defender portal, Microsoft Entra ID Protection, Microsoft Entra Authentication, Azure Information Protection, and Microsoft Purview compliance portal. For more information about Office 365 permissions, see Roles and role groups in Microsoft Defender for Office 365 and Microsoft Purview compliance.

In	Can do
Microsoft 365 Defender portal	Monitor security-related policies across Microsoft 365 services Manage security threats and alerts View reports
Privileged Identity Management	All permissions of the Security Reader role Cannot manage Microsoft Entra role assignments or settings
Microsoft Purview compliance portal	Manage security policies View, investigate, and respond to security threats View reports
Azure Advanced Threat Protection	Monitor and respond to suspicious security activity
Microsoft Defender for Endpoint	Assign roles Manage machine groups Configure endpoint threat detection and automated remediation View, investigate, and respond to alerts View machines/device inventory
Intune	Maps to the Intune Endpoint Security Manager role
Microsoft Defender for Cloud Apps	Add admins, add policies and settings, upload logs and perform governance actions
Microsoft 365 service health	View the health of Microsoft 365 services
Smart lockout	Define the threshold and duration for lockouts when failed sign-in events happen.
Password Protection	Configure custom banned password list or on-premises password protection.

Security Operator

This is a privileged role. Users with this role can manage alerts and have global read-only access on security-related features, including all information in Microsoft 365 Defender portal, Microsoft Entra ID Protection, Privileged Identity Management and Microsoft Purview compliance portal. For more information about Office 365 permissions, see Roles and role groups in Microsoft Defender for Office 365 and Microsoft Purview compliance.

In	Can do
Microsoft 365 Defender portal	All permissions of the Security Reader role View, investigate, and respond to security threats alerts Manage security settings in Microsoft 365 Defender portal
Privileged Identity Management	All permissions of the Security Reader role
Microsoft Purview compliance portal	All permissions of the Security Reader role View, investigate, and respond to security alerts
Microsoft Defender for Endpoint	All permissions of the Security Reader role View, investigate, and respond to security alerts When you turn on role-based access control in Microsoft Defender for Endpoint, users with read-only permissions such as the Security Reader role lose access until they are assigned a Microsoft Defender for Endpoint role.
Intune	All permissions of the Security Reader role
Microsoft Defender for Cloud Apps	All permissions of the Security Reader role View, investigate, and respond to security alerts
Microsoft 365 service health	View the health of Microsoft 365 services

Security Reader

This is a privileged role. Users with this role have global read-only access on security-related feature, including all information in Microsoft 365 Defender portal, Microsoft Entra ID Protection, Privileged Identity Management, as well as the ability to read Microsoft Entra sign-in reports and audit logs, and in Microsoft Purview compliance portal. For more information about Office 365 permissions, see Roles and role groups in Microsoft Defender for Office 365 and Microsoft Purview compliance.

In	Can do
Microsoft 365 Defender portal	View security-related policies across Microsoft 365 services View security threats and alerts View reports
Privileged Identity Management	Has read-only access to all information surfaced in Microsoft Entra Privileged Identity Management: Policies and reports for Microsoft Entra role assignments and security reviews. Cannot sign up for Microsoft Entra Privileged Identity Management or make any changes to it. In the Privileged Identity Management portal or via PowerShell, someone in this role can activate additional roles (for example, Privileged Role Administrator), if the user is eligible for them.
Microsoft Purview compliance portal	View security policies View and investigate security threats View reports
Microsoft Defender for Endpoint	View and investigate alerts When you turn on role-based access control in Microsoft Defender for Endpoint, users with read-only permissions such as the Security Reader role lose access until they are assigned a Microsoft Defender for Endpoint role.
Intune	Views user, device, enrollment, configuration, and application information. Cannot make changes to Intune.
Microsoft Defender for Cloud Apps	Has read permissions.
Microsoft 365 service health	View the health of Microsoft 365 services

Service Support Administrator

Users with this role can create and manage support requests with Microsoft for Azure and Microsoft 365 services, and view the service dashboard and message center in the Azure portal and Microsoft 365 admin center. For more information, see About admin roles in the Microsoft 365 admin center.

SharePoint Administrator

Users with this role have global permissions within Microsoft SharePoint Online, when the service is present, as well as the ability to create and manage all Microsoft 365 groups, manage support tickets, and monitor service health. For more information, see About admin roles in the Microsoft 365 admin center.

SharePoint Embedded Administrator

Assign the SharePoint Embedded Administrator role to users who need to do the following tasks:

• Perform all tasks using PowerShell, Microsoft Graph API, or SharePoint admin center
• Manage, configure, and maintain SharePoint Embedded containers
• Enumerate and manage SharePoint Embedded containers
• Enumerate and manage permissions for SharePoint Embedded containers
• Manage storage of SharePoint Embedded containers in a tenant
• Assign security and compliance policies on SharePoint Embedded containers
• Apply security and compliance policies on SharePoint Embedded containers in a tenant

Learn more

Skype for Business Administrator

Users with this role have global permissions within Microsoft Skype for Business, when the service is present, as well as manage Skype-specific user attributes in Microsoft Entra ID. Additionally, this role grants the ability to manage support tickets and monitor service health, and to access the Teams and Skype for Business admin center. The account must also be licensed for Teams or it can't run Teams PowerShell cmdlets. For more information, see Skype for Business Online Admin and Teams licensing information at Skype for Business add-on licensing.

Teams Administrator

Users in this role can manage all aspects of the Microsoft Teams workload via the Microsoft Teams & Skype for Business admin center and the respective PowerShell modules. This includes, among other areas, all management tools related to telephony, messaging, meetings, and the teams themselves. This role additionally grants the ability to create and manage all Microsoft 365 groups, manage support tickets, and monitor service health.

Teams Communications Administrator

Users in this role can manage aspects of the Microsoft Teams workload related to voice & telephony. This includes the management tools for telephone number assignment, voice and meeting policies, and full access to the call analytics toolset.

Teams Communications Support Engineer

Users in this role can troubleshoot communication issues within Microsoft Teams & Skype for Business using the user call troubleshooting tools in the Microsoft Teams & Skype for Business admin center. Users in this role can view full call record information for all participants involved. This role has no access to view, create, or manage support tickets.

Teams Communications Support Specialist

Users in this role can troubleshoot communication issues within Microsoft Teams & Skype for Business using the user call troubleshooting tools in the Microsoft Teams & Skype for Business admin center. Users in this role can only view user details in the call for the specific user they have looked up. This role has no access to view, create, or manage support tickets.

Teams Devices Administrator

Users with this role can manage Teams-certified devices from the Teams admin center. This role allows viewing all devices at single glance, with ability to search and filter devices. The user can check details of each device including logged-in account, make and model of the device. The user can change the settings on the device and update the software versions. This role does not grant permissions to check Teams activity and call quality of the device.

Teams Telephony Administrator

Assign the Teams Telephony Administrator role to users who need to do the following tasks:

• Manage voice and telephony, including calling policies, phone number management and assignment, and voice applications
• Access to only Public Switched Telephone Network (PSTN) usage reports from Teams admin center
• View user profile page
• Create and manage support tickets in Azure and the Microsoft 365 admin center

Learn more

Tenant Creator

Assign the Tenant Creator role to users who need to do the following tasks:

• Create both Microsoft Entra and Azure Active Directory B2C tenants even if the tenant creation toggle is turned off in the user settings

Usage Summary Reports Reader

Assign the Usage Summary Reports Reader role to users who need to do the following tasks in the Microsoft 365 admin center:

• View the Usage reports and Adoption Score
• Read organizational insights, but not personally identifiable information (PII) of users

This role only allows users to view organizational-level data with the following exceptions:

• Member users can view user management data and settings.
• Guest users assigned this role cannot view user management data and settings.

User Administrator

This is a privileged role. Assign the User Administrator role to users who need to do the following:

Permission	More information
Create users
Update most user properties for all users, including all administrators	Who can perform sensitive actions
Update sensitive properties (including user principal name) for some users	Who can perform sensitive actions
Disable or enable some users	Who can perform sensitive actions
Delete or restore some users	Who can perform sensitive actions
Create and manage user views
Create and manage all groups
Assign and read licenses for all users, including all administrators
Reset passwords	Who can reset passwords
Invalidate refresh tokens	Who can reset passwords
Update (FIDO) device keys
Update password expiration policies
Create and manage support tickets in Azure and the Microsoft 365 admin center
Monitor service health

Users with this role cannot do the following:

• Cannot manage MFA.
• Cannot change the credentials or reset MFA for members and owners of a role-assignable group.
• Cannot manage shared mailboxes.
• Cannot modify security questions for password reset operation.

Virtual Visits Administrator

Users with this role can do the following tasks:

• Manage and configure all aspects of Virtual Visits in Bookings in the Microsoft 365 admin center, and in the Teams EHR connector
• View usage reports for Virtual Visits in the Teams admin center, Microsoft 365 admin center, Fabric, and Power BI
• View features and settings in the Microsoft 365 admin center, but can't edit any settings

Virtual Visits are a simple way to schedule and manage online and video appointments for staff and attendees. For example, usage reporting can show how sending SMS text messages before appointments can reduce the number of people who don't show up for appointments.

Windows 365 Administrator

Users with this role have global permissions on Windows 365 resources, when the service is present. Additionally, this role contains the ability to manage users and devices in order to associate policy, as well as create and manage groups.

This role can create and manage security groups, but does not have administrator rights over Microsoft 365 groups. That means administrators cannot update owners or memberships of Microsoft 365 groups in the organization. However, they can manage the Microsoft 365 group they create, which is a part of their end-user privileges. So, any Microsoft 365 group (not security group) they create is counted against their quota of 250.

Assign the Windows 365 Administrator role to users who need to do the following tasks:

• Manage Windows 365 Cloud PCs in Microsoft Intune
• Enroll and manage devices in Microsoft Entra ID, including assigning users and policies
• Create and manage security groups, but not role-assignable groups
• View basic properties in the Microsoft 365 admin center
• Read usage reports in the Microsoft 365 admin center
• Create and manage support tickets in Azure and the Microsoft 365 admin center

Windows Update Deployment Administrator

Users in this role can create and manage all aspects of Windows Update deployments through the Windows Update for Business deployment service. The deployment service enables users to define settings for when and how updates are deployed, and specify which updates are offered to groups of devices in their tenant. It also allows users to monitor the update progress.

Deprecated roles

The following roles should not be used. They have been deprecated and will be removed from Microsoft Entra ID in the future.

• AdHoc License Administrator
• Device Join
• Device Managers
• Device Users
• Email Verified User Creator
• Mailbox Administrator
• Workplace Device Join

Roles not shown in the portal

Not every role returned by PowerShell or MS Graph API is visible in Azure portal. The following table organizes those differences.

API name	Azure portal name	Notes
Device Join	Deprecated	Deprecated roles documentation
Device Managers	Deprecated	Deprecated roles documentation
Device Users	Deprecated	Deprecated roles documentation
Directory Synchronization Accounts	Not shown because it shouldn't be used	Directory Synchronization Accounts documentation
Guest User	Not shown because it can't be used	NA
Partner Tier 1 Support	Not shown because it shouldn't be used	Partner Tier1 Support documentation
Partner Tier 2 Support	Not shown because it shouldn't be used	Partner Tier2 Support documentation
Restricted Guest User	Not shown because it can't be used	NA
User	Not shown because it can't be used	NA
Workplace Device Join	Deprecated	Deprecated roles documentation

Next steps

• Assign Microsoft Entra roles to groups
• Understand the different roles
• Assign a user as an administrator of an Azure subscription