Entra built-in roles and permissions
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 5009754 · +18 −8 lines · also on GitHub
⋯ 1 unchanged line
22
title: Microsoft Entra built-in roles
33
description: Describes the Microsoft Entra built-in roles and permissions.
44
ms.topic: reference
5
−ms.date: 03/23/2026
5
+ms.date: 04/22/2026
66
ms.reviewer: abhijeetsinha
77
ms.custom: generated, it-pro, fasttrack-edit, has-azure-ad-ps-ref, azure-ad-ref-level-one-done, sfi-ga-nochange
88
---
⋯ 15 unchanged lines
2424
> | [Agent ID Developer](#agent-id-developer) | Create an agent blueprint and its service principal in a tenant. User will be added as an owner of the agent blueprint and its service principal. | adb2368d-a9be-41b5-8667-d96778e081b0 |
2525
> | [Agent Registry Administrator](#agent-registry-administrator) | Manage all aspects of the Agent Registry service in Microsoft Entra ID | 6b942400-691f-4bf0-9d12-d8a254a2baf5 |
2626
> | [AI Administrator](#ai-administrator) | Manage all aspects of Microsoft 365 Copilot and AI-related enterprise services in Microsoft 365.<br/>[](privileged-roles-permissions.md) | d2562ede-74db-457e-a7b6-544e236ebb61 |
27
+> | [AI Reader](#ai-reader) | Read all aspects of Microsoft 365 Copilot and AI-related enterprise services in Microsoft 365.<br/>[](privileged-roles-permissions.md) | 1fe13547-53f6-408d-ac04-7f8eed167b38 |
2728
> | [Application Administrator](#application-administrator) | Can create and manage all aspects of app registrations and enterprise apps.<br/>[](privileged-roles-permissions.md) | 9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3 |
2829
> | [Application Developer](#application-developer) | Can create application registrations independent of the 'Users can register applications' setting.<br/>[](privileged-roles-permissions.md) | cf1c38e5-3621-4004-a7cb-879624dced7c |
2930
> | [Attack Payload Author](#attack-payload-author) | Can create attack payloads that an administrator can initiate later. | 9c6df0f2-1e7c-4dc3-b195-66dfbd24aa8f |
⋯ 10 unchanged lines
4041
> | [Authentication Extensibility Administrator](#authentication-extensibility-administrator) | Customize sign in and sign up experiences for users by creating and managing custom authentication extensions.<br/>[](privileged-roles-permissions.md) | 25a516ed-2fa0-40ea-a2d0-12923a21473a |
4142
> | [Authentication Extensibility Password Administrator](#authentication-extensibility-password-administrator) | Trigger a password submit event for custom authentication.<br/>[](privileged-roles-permissions.md) | 0b00bede-4072-4d22-b441-e7df02a1ef63 |
4243
> | [Authentication Policy Administrator](#authentication-policy-administrator) | Can create and manage the authentication methods policy, tenant-wide MFA settings, password protection policy, and verifiable credentials. | 0526716b-113d-4c15-b2c8-68e3c22b9f80 |
43
−> | [Azure DevOps Administrator](#azure-devops-administrator) | Can manage Azure DevOps policies and settings. | e3973bdf-4987-49ae-837a-ba8e231c7286 |
44
+> | [Azure DevOps Administrator](#azure-devops-administrator) | Manage Azure DevOps policies and settings. | e3973bdf-4987-49ae-837a-ba8e231c7286 |
4445
> | [Azure Information Protection Administrator](#azure-information-protection-administrator) | Can manage all aspects of the Azure Information Protection product. | 7495fdc4-34c4-4d15-a289-98788ce399fd |
4546
> | [B2C IEF Keyset Administrator](#b2c-ief-keyset-administrator) | Can manage secrets for federation and encryption in the Identity Experience Framework (IEF).<br/>[](privileged-roles-permissions.md) | aaf43236-0c0d-4d5f-883a-6955382ac081 |
4647
> | [B2C IEF Policy Administrator](#b2c-ief-policy-administrator) | Can create and manage trust framework policies in the Identity Experience Framework (IEF). | 3edaf663-341e-4475-9f94-5c398ef6c070 |
4748
> | [Billing Administrator](#billing-administrator) | Can perform common billing related tasks like updating payment information. | b0f54661-2d74-4c50-afa3-1ec803f12efe |
48
−> | [Cloud App Security Administrator](#cloud-app-security-administrator) | Can manage all aspects of the Defender for Cloud Apps product. | 892c5842-a9a6-463a-8041-72aa08ca3cf6 |
49
+> | [Cloud App Security Administrator](#cloud-app-security-administrator) | Manage all aspects of the Defender for Cloud Apps product. | 892c5842-a9a6-463a-8041-72aa08ca3cf6 |
4950
> | [Cloud Application Administrator](#cloud-application-administrator) | Can create and manage all aspects of app registrations and enterprise apps except App Proxy.<br/>[](privileged-roles-permissions.md) | 158c047a-c907-4556-b7ef-446551a6b5f7 |
5051
> | [Cloud Device Administrator](#cloud-device-administrator) | Limited access to manage devices in Microsoft Entra ID.<br/>[](privileged-roles-permissions.md) | 7698a772-787b-4ac8-901f-60d6b08affd2 |
5152
> | [Compliance Administrator](#compliance-administrator) | Can read and manage compliance configuration and reports in Microsoft Entra ID and Microsoft 365. | 17315797-102d-40b4-93e0-432062caca18 |
5253
> | [Compliance Data Administrator](#compliance-data-administrator) | Creates and manages compliance content. | e6d1a23a-da11-4be4-9570-befc86d067a7 |
5354
> | [Conditional Access Administrator](#conditional-access-administrator) | Can manage Conditional Access capabilities.<br/>[](privileged-roles-permissions.md) | b1be1c3e-b65d-4f19-8427-f6fa0d97feb9 |
55
+> | [Customer Delegated Admin Relationship Administrator](#customer-delegated-admin-relationship-administrator) | Manage all aspects of granular delegated admin privileges (GDAP) relationships in a customer tenant. | fc8ad4e2-40e4-4724-8317-bcda7503ecbf |
5456
> | [Customer Lockbox Access Approver](#customer-lockbox-access-approver) | Can approve Microsoft support requests to access customer organizational data. | 5c4f9dcd-47dc-4cf7-8c9a-9e4207cbfc91 |
5557
> | [Desktop Analytics Administrator](#desktop-analytics-administrator) | Can access and manage Desktop management tools and services. | 38a96431-2bdf-4b4c-8b6e-5d3d8abac1a4 |
5658
> | [Directory Readers](#directory-readers) | Can read basic directory information. Commonly used to grant directory read access to applications and guests. | 88d8e3e3-8f55-4a1e-953a-9b9898b8876b |
⋯ 13 unchanged lines
7072
> | [External ID User Flow Administrator](#external-id-user-flow-administrator) | Can create and manage all aspects of user flows. | 6e591065-9bad-43ed-90f3-e9424366d2f0 |
7173
> | [External ID User Flow Attribute Administrator](#external-id-user-flow-attribute-administrator) | Can create and manage the attribute schema available to all user flows. | 0f971eea-41eb-4569-a71e-57bb8a3eff1e |
7274
> | [External Identity Provider Administrator](#external-identity-provider-administrator) | Can configure identity providers for use in direct federation.<br/>[](privileged-roles-permissions.md) | be2f45a1-457d-42af-a067-6ec1fa63bc45 |
73
−> | [Fabric Administrator](#fabric-administrator) | Can manage all aspects of the Fabric and Power BI products. | a9ea8996-122f-4c74-9520-8edcd192826c |
75
+> | [Fabric Administrator](#fabric-administrator) | Manage all aspects of the Fabric and Power BI products. | a9ea8996-122f-4c74-9520-8edcd192826c |
7476
> | [Global Administrator](#global-administrator) | Can manage all aspects of Microsoft Entra ID and Microsoft services that use Microsoft Entra identities.<br/>[](privileged-roles-permissions.md) | 62e90394-69f5-4237-9190-012177145e10 |
7577
> | [Global Reader](#global-reader) | Can read everything that a Global Administrator can, but not update anything.<br/>[](privileged-roles-permissions.md) | f2ef992c-3afb-46b9-b7cf-a126ee74c451 |
76
−> | [Global Secure Access Administrator](#global-secure-access-administrator) | Create and manage all aspects of Global Secure Internet Access and Microsoft Global Secure Private Access, including managing access to public and private endpoints. | ac434307-12b9-4fa1-a708-88bf58caabc1 |
78
+> | [Global Secure Access Administrator](#global-secure-access-administrator) | Create and manage all aspects of Global Secure Internet Access and Microsoft Global Secure Private Access, including managing access to public and private endpoints. | ac434307-12b9-4fa1-a708-88bf58caabc1 |
7779
> | [Global Secure Access Log Reader](#global-secure-access-log-reader) | Provides designated security personnel with read-only access to network traffic logs in Microsoft Entra Internet Access and Microsoft Entra Private Access for detailed analysis. | 843318fb-79a6-4168-9e6f-aa9a07481cc4 |
7880
> | [Groups Administrator](#groups-administrator) | Members of this role can create/manage groups, create/manage groups settings like naming and expiration policies, and view groups activity and audit reports. | fdd7a751-b60b-444a-984c-02652fe8fa1c |
7981
> | [Guest Inviter](#guest-inviter) | Can invite guest users independent of the 'members can invite guests' setting. | 95e79109-95c0-4d8e-aee3-d01accf2d47b |
⋯ 2 unchanged lines
8284
> | [Identity Governance Administrator](#identity-governance-administrator) | Manage access using Microsoft Entra ID for identity governance scenarios. | 45d8d3c5-c802-45c6-b32a-1d70b5e1e86e |
8385
> | [Insights Administrator](#insights-administrator) | Has administrative access in the Microsoft 365 Insights app. | eb1f4a8d-243a-41f0-9fbd-c7cdf6c5ef7c |
8486
> | [Insights Analyst](#insights-analyst) | Access the analytical capabilities in Microsoft Viva Insights and run custom queries. | 25df335f-86eb-4119-b717-0ff02de207e9 |
85
−> | [Insights Business Leader](#insights-business-leader) | Can view and share dashboards and insights via the Microsoft 365 Insights app. | 31e939ad-9672-4796-9c2e-873181342d2d |
87
+> | [Insights Business Leader](#insights-business-leader) | View and share dashboards and insights via the Microsoft Viva Insights app. | 31e939ad-9672-4796-9c2e-873181342d2d |
8688
> | [Intune Administrator](#intune-administrator) | Can manage all aspects of the Intune product.<br/>[](privileged-roles-permissions.md) | 3a2c62db-5318-420d-8d74-23affee5d9d5 |
8789
> | [IoT Device Administrator](#iot-device-administrator) | Provision new IoT devices, manage their lifecycle, configure certificates, and manage device templates. | 2ea5ce4c-b2d8-4668-bd81-3680bd2d227a |
8890
> | [Kaizala Administrator](#kaizala-administrator) | Can manage settings for Microsoft Kaizala. | 74ef975b-6605-40af-a5d2-b9539d836353 |
8991
> | [Knowledge Administrator](#knowledge-administrator) | Can configure knowledge, learning, and other intelligent features. | b5a8dcf3-09d5-43a9-a639-8e29ef291470 |
90
−> | [Knowledge Manager](#knowledge-manager) | Can organize, create, manage, and promote topics and knowledge. | 744ec460-397e-42ad-a462-8b3f9747a02c |
92
+> | [Knowledge Manager](#knowledge-manager) | Organize, create, manage, and promote topics and knowledge. | 744ec460-397e-42ad-a462-8b3f9747a02c |
9193
> | [License Administrator](#license-administrator) | Can manage product licenses on users and groups. | 4d6ac14f-3453-41d0-bef9-a3e0c569773a |
9294
> | [Lifecycle Workflows Administrator](#lifecycle-workflows-administrator) | Create and manage all aspects of workflows and tasks associated with Lifecycle Workflows in Microsoft Entra ID.<br/>[](privileged-roles-permissions.md) | 59d46f88-662b-457b-bceb-5c3809e5908f |
9395
> | [Message Center Privacy Reader](#message-center-privacy-reader) | Can read security messages and updates in Office 365 Message Center only. | ac16e43d-7b2d-40e0-ac05-243ff356ab5b |
⋯ 16 unchanged lines
110112
> | [People Administrator](#people-administrator) | Manage profile photos of users and people settings for all users in the organization. | 024906de-61e5-49c8-8572-40335f1e0e10 |
111113
> | [Permissions Management Administrator](#permissions-management-administrator) | Manage all aspects of Microsoft Entra Permissions Management. | af78dc32-cf4d-46f9-ba4e-4428526346b5 |
112114
> | [Places Administrator](#places-administrator) | Manage all aspects of the Microsoft Places service. | 78b0ccd1-afc2-4f92-9116-b41aedd09592 |
113
−> | [Power Platform Administrator](#power-platform-administrator) | Can create and manage all aspects of Microsoft Dynamics 365, Power Apps and Power Automate. | 11648597-926c-4cf3-9c36-bcebb0ba8dcc |
115
+> | [Power Platform Administrator](#power-platform-administrator) | Manage all aspects of Microsoft Dynamics 365, Power Apps and Power Automate. | 11648597-926c-4cf3-9c36-bcebb0ba8dcc |
114116
> | [Printer Administrator](#printer-administrator) | Can manage all aspects of printers and printer connectors. | 644ef478-e28f-4e28-b9dc-3fdde9aa0b1f |
115117
> | [Printer Technician](#printer-technician) | Can register and unregister printers and update printer status. | e8cef6f1-e4bd-4ea8-bc07-4b8d950f4477 |
116118
> | [Privileged Authentication Administrator](#privileged-authentication-administrator) | Can access to view, set and reset authentication method information for any user (admin or non-admin).<br/>[](privileged-roles-permissions.md) | 7be44c8a-adaf-4e2a-84d6-ab2649e08a13 |
⋯ 51 unchanged lines
168170
169171
[!INCLUDE [ai-administrator](includes/ai-administrator.md)]
170172
173
+## AI Reader
174
+
175
+[!INCLUDE [ai-reader](includes/ai-reader.md)]
176
+
171177
## Application Administrator
172178
173179
[!INCLUDE [application-administrator](includes/application-administrator.md)]
⋯ 101 unchanged lines
275281
## Conditional Access Administrator
276282
277283
[!INCLUDE [conditional-access-administrator](includes/conditional-access-administrator.md)]
284
+
285
+## Customer Delegated Admin Relationship Administrator
286
+
287
+[!INCLUDE [customer-delegated-admin-relationship-administrator](includes/customer-delegated-admin-relationship-administrator.md)]
278288
279289
## Customer Lockbox Access Approver
280290
⋯ 441 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 08:48 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.