Recorded 22 Oct 2026 at 18:59 UTC. This is what ChangeIntel recorded, including the title, summary, facts and links. It is not a statement of the source's current position. See the latest record.

Microsoft Entra roleMicrosoft Learn

Windows 365 Administrator

Can provision and manage all aspects of Cloud PCs.

Cite this recorded revision

What it said

Permission coverage: Documented resource actions
Action: microsoft.azure.supportTickets/allEntities/allTasks: Create and manage Azure support tickets
Action: microsoft.cloudPC/allEntities/allProperties/allTasks: Manage all aspects of Windows 365
Action: microsoft.directory/deletedItems.devices/delete: Permanently delete devices, which can no longer be restored
Action: microsoft.directory/deletedItems.devices/restore: Restore soft deleted devices to original state
Action: microsoft.directory/deviceManagementPolicies/standard/read: Read standard properties on mobile device management and mobile app management policies
Action: microsoft.directory/deviceRegistrationPolicy/standard/read: Read standard properties on device registration policies
Action: microsoft.directory/devices/basic/update: Update basic properties on devices
Action: microsoft.directory/devices/create: Create devices (enroll in Microsoft Entra ID)
Action: microsoft.directory/devices/delete: Delete devices from Microsoft Entra ID
Action: microsoft.directory/devices/disable: Disable devices in Microsoft Entra ID
Action: microsoft.directory/devices/enable: Enable devices in Microsoft Entra ID
Action: microsoft.directory/devices/extensionAttributeSet1/update: Update the extensionAttribute1 to extensionAttribute5 properties on devices
Action: microsoft.directory/devices/extensionAttributeSet2/update: Update the extensionAttribute6 to extensionAttribute10 properties on devices
Action: microsoft.directory/devices/extensionAttributeSet3/update: Update the extensionAttribute11 to extensionAttribute15 properties on devices
Action: microsoft.directory/devices/registeredOwners/update: Update registered owners of devices
Action: microsoft.directory/devices/registeredUsers/update: Update registered users of devices
Action: microsoft.directory/groups.security/assignedLabels/update: Update the assigned labels property on Security groups of assigned membership type, excluding role-assignable groups
Action: microsoft.directory/groups.security/basic/update: Update basic properties on Security groups, excluding role-assignable groups
Action: microsoft.directory/groups.security/classification/update: Update the classification property on Security groups, excluding role-assignable groups
Action: microsoft.directory/groups.security/create: Create Security groups, excluding role-assignable groups
Action: microsoft.directory/groups.security/delete: Delete Security groups, excluding role-assignable groups
Action: microsoft.directory/groups.security/dynamicMembershipRule/update: Update the dynamic membership rule on Security groups, excluding role-assignable groups
Action: microsoft.directory/groups.security/members/update: Update members of Security groups, excluding role-assignable groups
Action: microsoft.directory/groups.security/owners/update: Update owners of Security groups, excluding role-assignable groups
Action: microsoft.directory/groups.security/visibility/update: Update the visibility property on Security groups, excluding role-assignable groups
Action: microsoft.office365.supportTickets/allEntities/allTasks: Create and manage Microsoft 365 service requests
Action: microsoft.office365.usageReports/allEntities/allProperties/read: Read Office 365 usage reports
Action: microsoft.office365.webPortal/allEntities/standard/read: Read basic properties on all resources in the Microsoft 365 admin center