Microsoft Entra built-in rolePublic reference
Authentication Policy Administrator
Can create and manage the authentication methods policy, tenant-wide MFA settings, password protection policy, and verifiable credentials.
Documented resource actions
19 documented actionsThese are Microsoft's documented resource actions, separate from Graph OAuth permissions and tenant assignments. Descriptions are shown as supplied in the reference.
| Action | Description |
|---|---|
| microsoft.azure.supportTickets/allEntities/allTasks | Create and manage Azure support tickets |
| microsoft.directory/organization/strongAuthentication/allTasks | Manage all aspects of strong authentication properties of an organization |
| microsoft.directory/userCredentialPolicies/basic/update | Update basic policies for users |
| microsoft.directory/userCredentialPolicies/create | Create credential policies for users |
| microsoft.directory/userCredentialPolicies/delete | Delete credential policies for users |
| microsoft.directory/userCredentialPolicies/owners/read | Read owners of credential policies for users |
| microsoft.directory/userCredentialPolicies/owners/update | Update owners of credential policies for users |
| microsoft.directory/userCredentialPolicies/policyAppliedTo/read | Read policy.appliesTo navigation link |
| microsoft.directory/userCredentialPolicies/standard/read | Read standard properties of credential policies for users |
| microsoft.directory/userCredentialPolicies/tenantDefault/update | Update policy.isOrganizationDefault property |
| microsoft.directory/verifiableCredentials/configuration/allProperties/read | Read configuration required to create and manage verifiable credentials |
| microsoft.directory/verifiableCredentials/configuration/allProperties/update | Update configuration required to create and manage verifiable credentials |
| microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/read | Read a verifiable credential contract |
| microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/update | Update a verifiable credential contract |
| microsoft.directory/verifiableCredentials/configuration/contracts/cards/allProperties/read | Read a verifiable credential card |
| microsoft.directory/verifiableCredentials/configuration/contracts/cards/revoke | Revoke a verifiable credential card |
| microsoft.directory/verifiableCredentials/configuration/contracts/create | Create a verifiable credential contract |
| microsoft.directory/verifiableCredentials/configuration/create | Create configuration required to create and manage verifiable credentials |
| microsoft.directory/verifiableCredentials/configuration/delete | Delete configuration required to create and manage verifiable credentials and delete all of its verifiable credentials |