Microsoft Entra built-in rolePublic reference
Cloud Application Administrator
Can create and manage all aspects of app registrations and enterprise apps except App Proxy.
Documented resource actions
61 documented actionsThese are Microsoft's documented resource actions, separate from Graph OAuth permissions and tenant assignments. Descriptions are shown as supplied in the reference.
| Action | Description |
|---|---|
| microsoft.azure.serviceHealth/allEntities/allTasks | Read and configure Azure Service Health |
| microsoft.azure.supportTickets/allEntities/allTasks | Create and manage Azure support tickets |
| microsoft.directory/adminConsentRequestPolicy/allProperties/allTasks | Manage admin consent request policies in Microsoft Entra ID |
| microsoft.directory/appConsent/appConsentRequests/allProperties/read | Read all properties of consent requests for applications registered with Microsoft Entra ID |
| microsoft.directory/applicationPolicies/basic/update | Update standard properties of application policies |
| microsoft.directory/applicationPolicies/create | Create application policies |
| microsoft.directory/applicationPolicies/delete | Delete application policies |
| microsoft.directory/applicationPolicies/owners/read | Read owners on application policies |
| microsoft.directory/applicationPolicies/owners/update | Update the owner property of application policies |
| microsoft.directory/applicationPolicies/policyAppliedTo/read | Read application policies applied to objects list |
| microsoft.directory/applicationPolicies/standard/read | Read standard properties of application policies |
| microsoft.directory/applicationTemplates/instantiate | Instantiate gallery applications from application templates |
| microsoft.directory/applications/appRoles/update | Update the appRoles property on all types of applications |
| microsoft.directory/applications/audience/update | Update the audience property for applications |
| microsoft.directory/applications/authentication/update | Update authentication on all types of applications |
| microsoft.directory/applications/basic/update | Update basic properties for applications |
| microsoft.directory/applications/create | Create all types of applications |
| microsoft.directory/applications/credentials/update | Update application credentials |
| microsoft.directory/applications/delete | Delete all types of applications |
| microsoft.directory/applications/disablement/update | Update whether an application is enabled for users to sign in |
| microsoft.directory/applications/extensionProperties/update | Update extension properties on applications |
| microsoft.directory/applications/notes/update | Update notes of applications |
| microsoft.directory/applications/owners/update | Update owners of applications |
| microsoft.directory/applications/permissions/update | Update exposed permissions and required permissions on all types of applications |
| microsoft.directory/applications/policies/update | Update policies of applications |
| microsoft.directory/applications/synchronization/standard/read | Read provisioning settings associated with the application object |
| microsoft.directory/applications/tag/update | Update tags of applications |
| microsoft.directory/applications/verification/update | Update applicationsverification property |
| microsoft.directory/auditLogs/allProperties/read | Read all properties on audit logs, excluding custom security attributes audit logs |
| microsoft.directory/deletedItems.applications/delete | Permanently delete applications, which can no longer be restored |
| microsoft.directory/deletedItems.applications/restore | Restore soft deleted applications to original state |
| microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks | Create and delete OAuth 2.0 permission grants, and read and update all properties |
| microsoft.directory/provisioningLogs/allProperties/read | Read all properties of provisioning logs |
| microsoft.directory/servicePrincipals/appRoleAssignedTo/update | Update service principal role assignments |
| microsoft.directory/servicePrincipals/audience/update | Update audience properties on service principals |
| microsoft.directory/servicePrincipals/authentication/update | Update authentication properties on service principals |
| microsoft.directory/servicePrincipals/basic/update | Update basic properties on service principals |
| microsoft.directory/servicePrincipals/create | Create service principals |
| microsoft.directory/servicePrincipals/credentials/update | Update credentials of service principals |
| microsoft.directory/servicePrincipals/delete | Delete service principals |
| microsoft.directory/servicePrincipals/disable | Disable service principals |
| microsoft.directory/servicePrincipals/enable | Enable service principals |
| microsoft.directory/servicePrincipals/getPasswordSingleSignOnCredentials | Manage password single sign-on credentials on service principals |
| microsoft.directory/servicePrincipals/managePasswordSingleSignOnCredentials | Read password single sign-on credentials on service principals |
| microsoft.directory/servicePrincipals/managePermissionGrantsForAll.microsoft-application-admin | Grant consent for application permissions and delegated permissions on behalf of any user or all users, except for application permissions for Microsoft Graph and Azure AD Graph |
| microsoft.directory/servicePrincipals/notes/update | Update notes of service principals |
| microsoft.directory/servicePrincipals/owners/update | Update owners of service principals |
| microsoft.directory/servicePrincipals/permissions/update | Update permissions of service principals |
| microsoft.directory/servicePrincipals/policies/update | Update policies of service principals |
| microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/credentials/manage | Manage application provisioning secrets and credentials. |
| microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/jobs/manage | Start, restart, and pause application provisioning synchronization jobs. |
| microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/schema/manage | Create and manage application provisioning synchronization jobs and schema. |
| microsoft.directory/servicePrincipals/synchronization/standard/read | Read provisioning settings associated with your service principal |
| microsoft.directory/servicePrincipals/synchronizationCredentials/manage | Manage application provisioning secrets and credentials |
| microsoft.directory/servicePrincipals/synchronizationJobs/manage | Start, restart, and pause application provisioning synchronization jobs |
| microsoft.directory/servicePrincipals/synchronizationSchema/manage | Create and manage application provisioning synchronization jobs and schema |
| microsoft.directory/servicePrincipals/tag/update | Update the tag property for service principals |
| microsoft.directory/signInReports/allProperties/read | Read all properties on sign-in reports, including privileged properties |
| microsoft.office365.serviceHealth/allEntities/allTasks | Read and configure Service Health in the Microsoft 365 admin center |
| microsoft.office365.supportTickets/allEntities/allTasks | Create and manage Microsoft 365 service requests |
| microsoft.office365.webPortal/allEntities/standard/read | Read basic properties on all resources in the Microsoft 365 admin center |