Microsoft Entra roles
Find built-in roles, understand their documented resource actions, and follow changes to the public reference.
136 documented roles · baseline 22 Oct 2026 · changes compare accepted reference reads.
Documented built-in roles
136 matching roles- Agent ID AdministratorManage all aspects of agents in a tenant including identity lifecycle operations for agent blueprints, agent identity blueprint principals, agent identities, and agentic users.Marked privileged · 64 documented actions
- Agent ID DeveloperCreate an agent identity blueprint and its agent identity blueprint principal in a tenant. User will be added as an owner of the created agent identity blueprint and its agent identity blueprint principal.No privileged label in reference · 2 documented actions
- Agent Registry AdministratorManage all aspects of the Agent Registry service in Microsoft Entra IDNo privileged label in reference · 1 documented actions
- AI AdministratorManage all aspects of Microsoft Copilot and AI-related enterprise services in Microsoft 365.Marked privileged · 70 documented actions
- AI ReaderRead all aspects of Microsoft Copilot and AI-related enterprise services in Microsoft 365.Marked privileged · 45 documented actions
- Application AdministratorCan create and manage all aspects of app registrations and enterprise apps.Marked privileged · 73 documented actions
- Application DeveloperCan create application registrations independent of the 'Users can register applications' setting and update applications they own.Marked privileged · 3 documented actions
- Attack Payload AuthorCan create attack payloads that an administrator can initiate later.No privileged label in reference · 2 documented actions
- Attack Simulation AdministratorCan create and manage all aspects of attack simulation campaigns.No privileged label in reference · 3 documented actions
- Attribute Assignment AdministratorAssign custom security attribute keys and values to supported Microsoft Entra objects.No privileged label in reference · 10 documented actions
- Attribute Assignment ReaderRead custom security attribute keys and values for supported Microsoft Entra objects.No privileged label in reference · 6 documented actions
- Attribute Definition AdministratorDefine and manage the definition of custom security attributes.No privileged label in reference · 2 documented actions
- Attribute Definition ReaderRead the definition of custom security attributes.No privileged label in reference · 2 documented actions
- Attribute Log AdministratorRead audit logs and configure diagnostic settings for events related to custom security attributes.No privileged label in reference · 2 documented actions
- Attribute Log ReaderRead audit logs related to custom security attributes.No privileged label in reference · 1 documented actions
- Attribute Provisioning AdministratorRead and edit the provisioning configuration of all active custom security attributes for an application.Marked privileged · 2 documented actions
- Attribute Provisioning ReaderRead the provisioning configuration of all active custom security attributes for an application.Marked privileged · 1 documented actions
- Authentication AdministratorCan access to view, set and reset authentication method information for any non-admin user.Marked privileged · 19 documented actions
- Authentication Extensibility AdministratorCustomize sign in and sign up experiences for users by creating and managing custom authentication extensions.Marked privileged · 1 documented actions
- Authentication Extensibility Password AdministratorTrigger a password submit event for custom authentication.No privileged label in reference · 1 documented actions
- Authentication Policy AdministratorCan create and manage the authentication methods policy, tenant-wide MFA settings, password protection policy, and verifiable credentials.No privileged label in reference · 19 documented actions
- Azure DevOps AdministratorManage Azure DevOps policies and settings.No privileged label in reference · 1 documented actions
- Azure Information Protection AdministratorCan manage all aspects of the Azure Information Protection product.No privileged label in reference · 7 documented actions
- B2C IEF Keyset AdministratorCan manage secrets for federation and encryption in the Identity Experience Framework (IEF).Marked privileged · 1 documented actions
- B2C IEF Policy AdministratorCan create and manage trust framework policies in the Identity Experience Framework (IEF).No privileged label in reference · 1 documented actions