Roles and permissions
Microsoft's documented built-in roles and permissions for each admin system, and the changes observed in each public reference.
What changed in each system
Last 30 days · public references only- Microsoft Entra roles139 roles
5 role changes: Resource Policy Administrator (newly listed), Resource Policy Evaluator (newly listed), Resource Policy Reader (newly listed) and 2 more
- Azure RBAC19 reference pages
2 observed reference changes across 2 of 19 pages; last 4 Nov 2026.
- Intune RBAC1 reference page
No reference changes in the last 30 days; last change observed 13 Oct 2026.
- Defender unified RBAC1 reference page
2 observed reference changes across 1 of 1 page; last 10 Nov 2026.
- Exchange Online RBAC1 reference page
No reference changes in the last 30 days.
- Purview and Defender for Office 365 role groups1 reference page
No reference changes in the last 30 days.
Microsoft Graph app permissions
The application and delegated permissions an app requests through Microsoft Graph are a separate catalog from admin roles. Microsoft Graph permissions
These are Microsoft's public references. They do not establish tenant assignments, eligibility or effective access.