Recorded 22 Oct 2026 at 18:59 UTC. This is what ChangeIntel recorded, including the title, summary, facts and links. It is not a statement of the source's current position. See the latest record.
Microsoft Entra roleMicrosoft Learn
Security Operator
Creates and manages security events and performs identity containment actions during security incidents.
What it said
- Permission coverage
- Documented resource actions
- Action: microsoft.azure.advancedThreatProtection/allEntities/allTasks
- Manage all aspects of Azure Advanced Threat Protection
- Action: microsoft.azure.supportTickets/allEntities/allTasks
- Create and manage Azure support tickets
- Action: microsoft.directory/auditLogs/allProperties/read
- Read all properties on audit logs, excluding custom security attributes audit logs
- Action: microsoft.directory/authorizationPolicy/standard/read
- Read standard properties of authorization policy
- Action: microsoft.directory/cloudAppSecurity/allProperties/allTasks
- Create and delete all resources, and read and update standard properties in Microsoft Defender for Cloud Apps
- Action: microsoft.directory/identityProtection/allProperties/allTasks
- Create and delete all resources, and read and update standard properties in Microsoft Entra ID Protection
- Action: microsoft.directory/privilegedIdentityManagement/allProperties/read
- Read all resources in Privileged Identity Management
- Action: microsoft.directory/provisioningLogs/allProperties/read
- Read all properties of provisioning logs
- Action: microsoft.directory/signInReports/allProperties/read
- Read all properties on sign-in reports, including privileged properties
- Action: microsoft.directory/users/disable
- Disable users
- Action: microsoft.directory/users/enable
- Enable users
- Action: microsoft.directory/users/invalidateAllRefreshTokens
- Force sign-out by invalidating user refresh tokens
- Action: microsoft.directory/users/password/update
- Reset passwords for all users
- Action: microsoft.intune/allEntities/read
- Read all resources in Microsoft Intune
- Action: microsoft.office365.securityComplianceCenter/allEntities/allTasks
- Create and delete all resources, and read and update standard properties in the Microsoft 365 Security and Compliance Center
- Action: microsoft.office365.supportTickets/allEntities/allTasks
- Create and manage Microsoft 365 service requests
- Action: microsoft.windows.defenderAdvancedThreatProtection/allEntities/allTasks
- Manage all aspects of Microsoft Defender for Endpoint