Microsoft Entra built-in rolePublic reference
Security Operator
Creates and manages security events and performs identity containment actions during security incidents.
Role definition
Microsoft reference- Template ID
- Privileged label
- Marked privileged in Microsoft's reference
- Documented permissions
- 17 resource actions
- Reference accepted
- 22 Oct 2026
Public definitions do not establish assignments, PIM eligibility, effective tenant access or cloud availability. Coverage and collection limits.