Recorded 22 Oct 2026 at 18:59 UTC. This is what ChangeIntel recorded, including the title, summary, facts and links. It is not a statement of the source's current position. See the latest record.

Microsoft Entra roleMicrosoft Learn

Global Administrator

Can manage all aspects of Microsoft Entra ID and Microsoft services that use Microsoft Entra identities.

Cite this recorded revision

What it said

Permission coverage: Documented resource actions
Action: microsoft.agentRegistry/allEntities/allProperties/allTasks: Manage all aspects of Agent Registry in Microsoft Entra ID
Action: microsoft.azure.advancedThreatProtection/allEntities/allTasks: Manage all aspects of Azure Advanced Threat Protection
Action: microsoft.azure.informationProtection/allEntities/allTasks: Manage all aspects of Azure Information Protection
Action: microsoft.azure.serviceHealth/allEntities/allTasks: Read and configure Azure Service Health
Action: microsoft.azure.supportTickets/allEntities/allTasks: Create and manage Azure support tickets
Action: microsoft.backup/allEntities/allProperties/allTasks: Manage all aspects of Microsoft 365 Backup
Action: microsoft.cloudPC/allEntities/allProperties/allTasks: Manage all aspects of Windows 365
Action: microsoft.commerce.billing/allEntities/allProperties/allTasks: Manage all aspects of Office 365 billing
Action: microsoft.commerce.billing/purchases/standard/read: Read purchase services in Microsoft 365 admin center.
Action: microsoft.commerce.tenantRelationships/customerDelegatedAdminPrivileges/allProperties/allTasks: Manage all aspects of granular delegated admin privileges (GDAP) relationships in a customer tenant.
Action: microsoft.directory/accessReviews/allProperties/allTasks: Create and delete access reviews, and read and update all properties of access reviews in Microsoft Entra ID
Action: microsoft.directory/accessReviews/definitions/allProperties/allTasks: Manage access reviews of all reviewable resources in Microsoft Entra ID
Action: microsoft.directory/adminConsentRequestPolicy/allProperties/allTasks: Manage admin consent request policies in Microsoft Entra ID
Action: microsoft.directory/administrativeUnits/allProperties/allTasks: Create and manage administrative units (including members)
Action: microsoft.directory/agentIdentities/appRoleAssignedTo/update: Update agent identity role assignments
Action: microsoft.directory/agentIdentities/authentication/update: Update authentication on agent identities
Action: microsoft.directory/agentIdentities/basic/update: Update basic properties on agent identities
Action: microsoft.directory/agentIdentities/create: Create agent identities
Action: microsoft.directory/agentIdentities/delete: Delete agent identities
Action: microsoft.directory/agentIdentities/disable: Disable agent identities
Action: microsoft.directory/agentIdentities/enable: Enable agent identities
Action: microsoft.directory/agentIdentities/owners/update: Update owners on agent identities
Action: microsoft.directory/agentIdentities/tag/update: Update tags of agent identities
Action: microsoft.directory/agentIdentityBlueprintPrincipals/appRoleAssignedTo/update: Update agent identity blueprint principal role assignments
Action: microsoft.directory/agentIdentityBlueprintPrincipals/authentication/update: Update authentication on agent identity blueprint principals
Action: microsoft.directory/agentIdentityBlueprintPrincipals/basic/update: Update basic properties on agent identity blueprint principals
Action: microsoft.directory/agentIdentityBlueprintPrincipals/create: Create agent identity blueprint principals
Action: microsoft.directory/agentIdentityBlueprintPrincipals/delete: Delete agent identity blueprint principals
Action: microsoft.directory/agentIdentityBlueprintPrincipals/disable: Disable agent identity blueprint principals
Action: microsoft.directory/agentIdentityBlueprintPrincipals/enable: Enable agent identity blueprint principals
Action: microsoft.directory/agentIdentityBlueprintPrincipals/owners/update: Update owners on agent identity blueprint principals
Action: microsoft.directory/agentIdentityBlueprintPrincipals/tag/update: Update tags of agent identity blueprint principals
Action: microsoft.directory/agentIdentityBlueprints/allProperties/update: Update all properties of agent identity blueprints
Action: microsoft.directory/agentIdentityBlueprints/appRoles/update: Update appRoles on agent identity blueprints
Action: microsoft.directory/agentIdentityBlueprints/audience/update: Update audience on agent identity blueprints
Action: microsoft.directory/agentIdentityBlueprints/authentication/update: Update authentication on agent identity blueprints
Action: microsoft.directory/agentIdentityBlueprints/basic/update: Update basic properties on agent identity blueprints
Action: microsoft.directory/agentIdentityBlueprints/create: Create agent identity blueprints
Action: microsoft.directory/agentIdentityBlueprints/credentials/update: Update credentials on agent identity blueprints
Action: microsoft.directory/agentIdentityBlueprints/delete: Delete agent identity blueprints
Action: microsoft.directory/agentIdentityBlueprints/owners/update: Update owners on agent identity blueprints
Action: microsoft.directory/agentIdentityBlueprints/permissions/update: Update exposed permissions and required permissions on agent identity blueprints
Action: microsoft.directory/agentIdentityBlueprints/tag/update: Update tags of agent identity blueprints
Action: microsoft.directory/appConsent/appConsentRequests/allProperties/read: Read all properties of consent requests for applications registered with Microsoft Entra ID
Action: microsoft.directory/applicationTemplates/instantiate: Instantiate gallery applications from application templates
Action: microsoft.directory/applications/allProperties/allTasks: Create and delete applications, and read and update all properties
Action: microsoft.directory/applications/disablement/update: Update whether an application is enabled for users to sign in
Action: microsoft.directory/applications/synchronization/standard/read: Read provisioning settings associated with the application object
Action: microsoft.directory/auditLogs/allProperties/read: Read all properties on audit logs, excluding custom security attributes audit logs
Action: microsoft.directory/authorizationPolicy/allProperties/allTasks: Manage all aspects of authorization policy
Action: microsoft.directory/backup/preview/cancel: Cancel a Microsoft Entra backup operation to compare a backup snapshot with the current state.
Action: microsoft.directory/backup/preview/create: Create a Microsoft Entra backup operation that allows a user to compare a backup snapshot with the current state.
Action: microsoft.directory/backup/recovery/cancel: Cancel a Microsoft Entra recovery operation to recover the contents of a backup snapshot
Action: microsoft.directory/backup/recovery/create: Create a Microsoft Entra recovery operation that allows a user to recover the contents of a backup snapshot.
Action: microsoft.directory/backup/standard/read: List Microsoft Entra backups (for example, backup IDs and timestamps), view difference reports, and list recovery jobs and their associated properties.
Action: microsoft.directory/bitlockerKeys/key/read: Read bitlocker metadata and key on devices
Action: microsoft.directory/bulkJobs/basic/update: Update all the bulk jobs in a directory
Action: microsoft.directory/bulkJobs/create: Create all bulk jobs in a directory
Action: microsoft.directory/cloudAppSecurity/allProperties/allTasks: Create and delete all resources, and read and update standard properties in Microsoft Defender for Cloud Apps
Action: microsoft.directory/conditionalAccessPolicies/allProperties/allTasks: Manage all properties of Conditional Access policies
Action: microsoft.directory/connectorGroups/allProperties/read: Read all properties of application proxy connector groups
Action: microsoft.directory/connectorGroups/allProperties/update: Update all properties of application proxy connector groups
Action: microsoft.directory/connectorGroups/create: Create application proxy connector groups
Action: microsoft.directory/connectorGroups/delete: Delete application proxy connector groups
Action: microsoft.directory/connectors/allProperties/read: Read all properties of application proxy connectors
Action: microsoft.directory/connectors/create: Create application proxy connectors
Action: microsoft.directory/contacts/allProperties/allTasks: Create and delete contacts, and read and update all properties
Action: microsoft.directory/contracts/allProperties/allTasks: Create and delete partner contracts, and read and update all properties
Action: microsoft.directory/crossTenantAccessPolicy/allowedCloudEndpoints/update: Update allowed cloud endpoints of cross-tenant access policy
Action: microsoft.directory/crossTenantAccessPolicy/basic/update: Update basic settings of cross-tenant access policy
Action: microsoft.directory/crossTenantAccessPolicy/default/b2bCollaboration/update: Update Microsoft Entra B2B collaboration settings of the default cross-tenant access policy
Action: microsoft.directory/crossTenantAccessPolicy/default/b2bDirectConnect/update: Update Microsoft Entra B2B direct connect settings of the default cross-tenant access policy
Action: microsoft.directory/crossTenantAccessPolicy/default/crossCloudMeetings/update: Update cross-cloud Teams meeting settings of the default cross-tenant access policy
Action: microsoft.directory/crossTenantAccessPolicy/default/standard/read: Read basic properties of the default cross-tenant access policy
Action: microsoft.directory/crossTenantAccessPolicy/default/tenantRestrictions/update: Update tenant restrictions of the default cross-tenant access policy
Action: microsoft.directory/crossTenantAccessPolicy/partners/b2bCollaboration/update: Update Microsoft Entra B2B collaboration settings of cross-tenant access policy for partners
Action: microsoft.directory/crossTenantAccessPolicy/partners/b2bDirectConnect/update: Update Microsoft Entra B2B direct connect settings of cross-tenant access policy for partners
Action: microsoft.directory/crossTenantAccessPolicy/partners/create: Create cross-tenant access policy for partners
Action: microsoft.directory/crossTenantAccessPolicy/partners/crossCloudMeetings/update: Update cross-cloud Teams meeting settings of cross-tenant access policy for partners
Action: microsoft.directory/crossTenantAccessPolicy/partners/delete: Delete cross-tenant access policy for partners
Action: microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/basic/update: Update basic settings of cross-tenant sync policy
Action: microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/create: Create cross-tenant sync policy for partners
Action: microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/standard/read: Read basic properties of cross-tenant sync policy
Action: microsoft.directory/crossTenantAccessPolicy/partners/standard/read: Read basic properties of cross-tenant access policy for partners
Action: microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/basic/update: Update cross tenant sync policy templates for multi-tenant organization
Action: microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/resetToDefaultSettings: Reset cross tenant sync policy template for multi-tenant organization to default settings
Action: microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/standard/read: Read basic properties of cross tenant sync policy templates for multi-tenant organization
Action: microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/basic/update: Update cross tenant access policy templates for multi-tenant organization
Action: microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/resetToDefaultSettings: Reset cross tenant access policy template for multi-tenant organization to default settings
Action: microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/standard/read: Read basic properties of cross tenant access policy templates for multi-tenant organization
Action: microsoft.directory/crossTenantAccessPolicy/partners/tenantRestrictions/update: Update tenant restrictions of cross-tenant access policy for partners
Action: microsoft.directory/crossTenantAccessPolicy/standard/read: Read basic properties of cross-tenant access policy
Action: microsoft.directory/customAuthenticationExtensions/allProperties/allTasks: Create and manage custom authentication extensions
Action: microsoft.directory/deletedItems/delete: Permanently delete objects, which can no longer be restored
Action: microsoft.directory/deletedItems/restore: Restore soft deleted objects to original state
Action: microsoft.directory/deviceLocalCredentials/password/read: Read all properties of the backed up local administrator account credentials for Microsoft Entra joined devices, including the password
Action: microsoft.directory/deviceManagementPolicies/basic/update: Update basic properties on mobile device management and mobile app management policies
Action: microsoft.directory/deviceManagementPolicies/standard/read: Read standard properties on mobile device management and mobile app management policies
Action: microsoft.directory/deviceRegistrationPolicy/basic/update: Update basic properties on device registration policies
Action: microsoft.directory/deviceRegistrationPolicy/standard/read: Read standard properties on device registration policies
Action: microsoft.directory/deviceTemplates/owners/read: Read owners on Internet of Things (IoT) device templates
Action: microsoft.directory/deviceTemplates/owners/update: Update owners on Internet of Things (IoT) device templates
Action: microsoft.directory/devices/allProperties/allTasks: Create and delete devices, and read and update all properties
Action: microsoft.directory/devices/permissions/update: Update the alternative name property on an IoT device
Action: microsoft.directory/directoryRoleTemplates/allProperties/allTasks: Create and delete Microsoft Entra role templates, and read and update all properties
Action: microsoft.directory/directoryRoles/allProperties/allTasks: Create and delete directory roles, and read and update all properties
Action: microsoft.directory/domains/allProperties/allTasks: Create and delete domains, and read and update all properties
Action: microsoft.directory/domains/federationConfiguration/basic/update: Update basic federation configuration for domains
Action: microsoft.directory/domains/federationConfiguration/create: Create federation configuration for domains
Action: microsoft.directory/domains/federationConfiguration/delete: Delete federation configuration for domains
Action: microsoft.directory/domains/federationConfiguration/standard/read: Read standard properties of federation configuration for domains
Action: microsoft.directory/entitlementManagement/allProperties/allTasks: Create and delete resources, and read and update all properties in Microsoft Entra entitlement management
Action: microsoft.directory/externalUserProfiles/basic/update: Update basic properties of external user profiles in the extended directory for Teams
Action: microsoft.directory/externalUserProfiles/delete: Delete external user profiles in the extended directory for Teams
Action: microsoft.directory/externalUserProfiles/standard/read: Read standard properties of external user profiles in the extended directory for Teams
Action: microsoft.directory/groupSettingTemplates/allProperties/allTasks: Create and delete group setting templates, and read and update all properties
Action: microsoft.directory/groupSettings/allProperties/allTasks: Create and delete group settings, and read and update all properties
Action: microsoft.directory/groups/allProperties/allTasks: Create and delete groups, and read and update all properties
Action: microsoft.directory/groupsAssignableToRoles/allProperties/update: Update role-assignable groups
Action: microsoft.directory/groupsAssignableToRoles/assignLicense: Assign a license to role-assignable groups
Action: microsoft.directory/groupsAssignableToRoles/create: Create role-assignable groups
Action: microsoft.directory/groupsAssignableToRoles/delete: Delete role-assignable groups
Action: microsoft.directory/groupsAssignableToRoles/reprocessLicenseAssignment: Reprocess license assignments to role-assignable groups
Action: microsoft.directory/groupsAssignableToRoles/restore: Restore role-assignable groups
Action: microsoft.directory/hybridAuthenticationPolicy/allProperties/allTasks: Manage hybrid authentication policy in Microsoft Entra ID
Action: microsoft.directory/identityProtection/allProperties/allTasks: Create and delete all resources, and read and update standard properties in Microsoft Entra ID Protection
Action: microsoft.directory/lifecycleWorkflows/workflows/allProperties/allTasks: Manage all aspects of lifecycle workflows and tasks in Microsoft Entra ID
Action: microsoft.directory/loginOrganizationBranding/allProperties/allTasks: Create and delete loginTenantBranding, and read and update all properties
Action: microsoft.directory/multiTenantOrganization/basic/update: Update basic properties of a multi-tenant organization
Action: microsoft.directory/multiTenantOrganization/create: Create a multi-tenant organization
Action: microsoft.directory/multiTenantOrganization/joinRequest/organizationDetails/update: Join a multi-tenant organization
Action: microsoft.directory/multiTenantOrganization/joinRequest/standard/read: Read properties of a multi-tenant organization join request
Action: microsoft.directory/multiTenantOrganization/standard/read: Read basic properties of a multi-tenant organization
Action: microsoft.directory/multiTenantOrganization/tenants/create: Create a tenant in a multi-tenant organization
Action: microsoft.directory/multiTenantOrganization/tenants/delete: Delete a tenant participating in a multi-tenant organization
Action: microsoft.directory/multiTenantOrganization/tenants/organizationDetails/read: Read organization details of a tenant participating in a multi-tenant organization
Action: microsoft.directory/multiTenantOrganization/tenants/organizationDetails/update: Update basic properties of a tenant participating in a multi-tenant organization
Action: microsoft.directory/multiTenantOrganization/tenants/standard/read: Read basic properties of a tenant participating in a multi-tenant organization
Action: microsoft.directory/namedLocations/basic/update: Update basic properties of custom rules that define network locations
Action: microsoft.directory/namedLocations/create: Create custom rules that define network locations
Action: microsoft.directory/namedLocations/delete: Delete custom rules that define network locations
Action: microsoft.directory/namedLocations/standard/read: Read basic properties of custom rules that define network locations
Action: microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks: Create and delete OAuth 2.0 permission grants, and read and update all properties
Action: microsoft.directory/onPremisesSynchronization/basic/update: Update basic on-premises directory synchronization information
Action: microsoft.directory/onPremisesSynchronization/standard/read: Read standard on-premises directory synchronization information
Action: microsoft.directory/organization/allProperties/allTasks: Read and update all properties for an organization
Action: microsoft.directory/passwordHashSync/allProperties/allTasks: Manage all aspects of Password Hash Synchronization (PHS) in Microsoft Entra ID
Action: microsoft.directory/pendingExternalUserProfiles/basic/update: Update basic properties of external user profiles in the extended directory for Teams
Action: microsoft.directory/pendingExternalUserProfiles/create: Create external user profiles in the extended directory for Teams
Action: microsoft.directory/pendingExternalUserProfiles/delete: Delete external user profiles in the extended directory for Teams
Action: microsoft.directory/pendingExternalUserProfiles/standard/read: Read standard properties of external user profiles in the extended directory for Teams
Action: microsoft.directory/permissionGrantPolicies/basic/update: Update basic properties of permission grant policies
Action: microsoft.directory/permissionGrantPolicies/create: Create permission grant policies
Action: microsoft.directory/permissionGrantPolicies/delete: Delete permission grant policies
Action: microsoft.directory/permissionGrantPolicies/standard/read: Read standard properties of permission grant policies
Action: microsoft.directory/policies/allProperties/allTasks: Create and delete policies, and read and update all properties
Action: microsoft.directory/privilegedIdentityManagement/allProperties/read: Read all resources in Privileged Identity Management
Action: microsoft.directory/provisioningLogs/allProperties/read: Read all properties of provisioning logs
Action: microsoft.directory/resourceNamespaces/resourceActions/authenticationContext/update: Update Conditional Access authentication context of Microsoft 365 role-based access control (RBAC) resource actions
Action: microsoft.directory/roleAssignments/allProperties/allTasks: Create and delete role assignments, and read and update all role assignment properties
Action: microsoft.directory/roleDefinitions/allProperties/allTasks: Create and delete role definitions, and read and update all properties
Action: microsoft.directory/scopedRoleMemberships/allProperties/allTasks: Create and delete scopedRoleMemberships, and read and update all properties
Action: microsoft.directory/serviceAction/activateService: Can perform the "activate service" action for a service
Action: microsoft.directory/serviceAction/disableDirectoryFeature: Can perform the "disable directory feature" service action
Action: microsoft.directory/serviceAction/enableDirectoryFeature: Can perform the "enable directory feature" service action
Action: microsoft.directory/serviceAction/getAvailableExtentionProperties: Can perform the getAvailableExtentionProperties service action
Action: microsoft.directory/servicePrincipalCreationPolicies/basic/update: Update basic properties of service principal creation policies
Action: microsoft.directory/servicePrincipalCreationPolicies/create: Create service principal creation policies
Action: microsoft.directory/servicePrincipalCreationPolicies/delete: Delete service principal creation policies
Action: microsoft.directory/servicePrincipalCreationPolicies/standard/read: Read standard properties of service principal creation policies
Action: microsoft.directory/servicePrincipals/allProperties/allTasks: Create and delete service principals, and read and update all properties
Action: microsoft.directory/servicePrincipals/managePermissionGrantsForAll.microsoft-company-admin: Grant consent for any permission to any application
Action: microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/credentials/manage: Manage cloud tenant to cloud tenant application provisioning secrets and credentials.
Action: microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/jobs/manage: Start, restart, and pause cloud tenant to cloud tenant application provisioning synchronization jobs.
Action: microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/schema/manage: Create and manage cloud tenant to cloud tenant application provisioning synchronization jobs and schema.
Action: microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/credentials/manage: Manage application provisioning secrets and credentials.
Action: microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/jobs/manage: Start, restart, and pause application provisioning synchronization jobs.
Action: microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/schema/manage: Create and manage application provisioning synchronization jobs and schema.
Action: microsoft.directory/servicePrincipals/synchronization/standard/read: Read provisioning settings associated with your service principal
Action: microsoft.directory/signInReports/allProperties/read: Read all properties on sign-in reports, including privileged properties
Action: microsoft.directory/subscribedSkus/allProperties/allTasks: Buy and manage subscriptions and delete subscriptions
Action: microsoft.directory/tenantManagement/tenants/create: Create new tenants in Microsoft Entra ID
Action: microsoft.directory/users/allProperties/allTasks: Create and delete users, and read and update all properties
Action: microsoft.directory/users/authenticationMethods/basic/update: Update basic properties of authentication methods for users
Action: microsoft.directory/users/authenticationMethods/create: Update authentication methods for users
Action: microsoft.directory/users/authenticationMethods/delete: Delete authentication methods for users
Action: microsoft.directory/users/authenticationMethods/standard/read: Read standard properties of authentication methods for users
Action: microsoft.directory/users/convertExternalToInternalMemberUser: Convert external user to internal user
Action: microsoft.directory/verifiableCredentials/configuration/allProperties/read: Read configuration required to create and manage verifiable credentials
Action: microsoft.directory/verifiableCredentials/configuration/allProperties/update: Update configuration required to create and manage verifiable credentials
Action: microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/read: Read a verifiable credential contract
Action: microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/update: Update a verifiable credential contract
Action: microsoft.directory/verifiableCredentials/configuration/contracts/cards/allProperties/read: Read a verifiable credential card
Action: microsoft.directory/verifiableCredentials/configuration/contracts/cards/revoke: Revoke a verifiable credential card
Action: microsoft.directory/verifiableCredentials/configuration/contracts/create: Create a verifiable credential contract
Action: microsoft.directory/verifiableCredentials/configuration/create: Create configuration required to create and manage verifiable credentials
Action: microsoft.directory/verifiableCredentials/configuration/delete: Delete configuration required to create and manage verifiable credentials and delete all of its verifiable credentials
Action: microsoft.dynamics365/allEntities/allTasks: Manage all aspects of Dynamics 365
Action: microsoft.edge/allEntities/allProperties/allTasks: Manage all aspects of Microsoft Edge
Action: microsoft.flow/allEntities/allTasks: Manage all aspects of Microsoft Power Automate
Action: microsoft.graph.dataConnect/allEntities/allProperties/allTasks: Manage aspects of Microsoft Graph Data Connect
Action: microsoft.hardware.support/shippingAddress/allProperties/allTasks: Create, read, update, and delete shipping addresses for Microsoft hardware warranty claims, including shipping addresses created by others
Action: microsoft.hardware.support/shippingStatus/allProperties/read: Read shipping status for open Microsoft hardware warranty claims
Action: microsoft.hardware.support/warrantyClaims/allProperties/allTasks: Create and manage all aspects of Microsoft hardware warranty claims
Action: microsoft.healthPlatform/allEntities/allProperties/allTasks: Manage all aspects of Microsoft Dragon admin center
Action: microsoft.insights/allEntities/allProperties/allTasks: Manage all aspects of Insights app
Action: microsoft.intune/allEntities/allTasks: Manage all aspects of Microsoft Intune
Action: microsoft.microsoft365.organizationalData/allEntities/allProperties/allTasks: Manage all aspects of organizational data in Microsoft 365
Action: microsoft.networkAccess/allEntities/allProperties/allTasks: Manage all aspects of Microsoft Entra Network Access
Action: microsoft.networkAccess/trafficLogs/standard/read: Read standard properties of traffic logs such as DeviceId, DestinationIp and PolicyRuleId
Action: microsoft.office365.complianceManager/allEntities/allTasks: Manage all aspects of Office 365 Compliance Manager
Action: microsoft.office365.copilot/allEntities/allProperties/allTasks: Create and manage all settings for Microsoft Copilot
Action: microsoft.office365.desktopAnalytics/allEntities/allTasks: Manage all aspects of Desktop Analytics
Action: microsoft.office365.exchange/allEntities/basic/allTasks: Manage all aspects of Exchange Online
Action: microsoft.office365.fileStorageContainers/allEntities/allProperties/allTasks: Manage all aspects of SharePoint Embedded containers
Action: microsoft.office365.knowledge/contentUnderstanding/allProperties/allTasks: Read and update all properties of content understanding in Microsoft 365 admin center
Action: microsoft.office365.knowledge/contentUnderstanding/analytics/allProperties/read: Read analytics reports of content understanding in Microsoft 365 admin center
Action: microsoft.office365.knowledge/knowledgeNetwork/allProperties/allTasks: Read and update all properties of knowledge network in Microsoft 365 admin center
Action: microsoft.office365.knowledge/knowledgeNetwork/topicVisibility/allProperties/allTasks: Manage topic visibility of knowledge network in Microsoft 365 admin center
Action: microsoft.office365.knowledge/learningSources/allProperties/allTasks: Manage learning sources and all their properties in Learning App.
Action: microsoft.office365.lockbox/allEntities/allTasks: Manage all aspects of Customer Lockbox
Action: microsoft.office365.messageCenter/messages/read: Read messages in Message Center in the Microsoft 365 admin center, excluding security messages
Action: microsoft.office365.messageCenter/securityMessages/read: Read security messages in Message Center in the Microsoft 365 admin center
Action: microsoft.office365.migrations/allEntities/allProperties/allTasks: Manage all aspects of Microsoft 365 migrations
Action: microsoft.office365.network/performance/allProperties/read: Read all network performance properties in the Microsoft 365 admin center
Action: microsoft.office365.organizationalMessages/allEntities/allProperties/allTasks: Manage all authoring aspects of Microsoft 365 Organizational Messages
Action: microsoft.office365.protectionCenter/allEntities/allProperties/allTasks: Manage all aspects of the Security and Compliance centers
Action: microsoft.office365.search/content/manage: Create and delete content, and read and update all properties in Microsoft Search
Action: microsoft.office365.securityComplianceCenter/allEntities/allTasks: Create and delete all resources, and read and update standard properties in the Microsoft 365 Security and Compliance Center
Action: microsoft.office365.serviceHealth/allEntities/allTasks: Read and configure Service Health in the Microsoft 365 admin center
Action: microsoft.office365.sharePoint/allEntities/allTasks: Create and delete all resources, and read and update standard properties in SharePoint
Action: microsoft.office365.sharePointAdvancedManagement/allEntities/allProperties/allTasks: Manage all aspects of SharePoint Advanced Management
Action: microsoft.office365.skypeForBusiness/allEntities/allTasks: Manage all aspects of Skype for Business Online
Action: microsoft.office365.supportTickets/allEntities/allTasks: Create and manage Microsoft 365 service requests
Action: microsoft.office365.usageReports/allEntities/allProperties/read: Read Office 365 usage reports
Action: microsoft.office365.userCommunication/allEntities/allTasks: Read and update what's new messages visibility
Action: microsoft.office365.webPortal/allEntities/standard/read: Read basic properties on all resources in the Microsoft 365 admin center
Action: microsoft.office365.yammer/allEntities/allProperties/allTasks: Manage all aspects of Yammer
Action: microsoft.people/users/photo/read: Read profile photo of user
Action: microsoft.people/users/photo/update: Update profile photo of user
Action: microsoft.peopleAdmin/organization/allProperties/read: Read people settings for users, such as pronouns, name pronunciation, and profile card settings
Action: microsoft.peopleAdmin/organization/allProperties/update: Update people settings for users, such as pronouns, name pronunciation, and profile card settings
Action: microsoft.permissionsManagement/allEntities/allProperties/allTasks: Manage all aspects of Microsoft Entra Permissions Management
Action: microsoft.powerApps.powerBI/allEntities/allTasks: Manage all aspects of Fabric and Power BI
Action: microsoft.powerApps/allEntities/allTasks: Manage all aspects of Power Apps
Action: microsoft.teams/allEntities/allProperties/allTasks: Manage all resources in Teams
Action: microsoft.virtualVisits/allEntities/allProperties/allTasks: Manage and share Virtual Visits information and metrics from admin centers or the Virtual Visits app
Action: microsoft.viva.glint/allEntities/allProperties/allTasks: Manage and configure all Microsoft Viva Glint settings in the Microsoft 365 admin center
Action: microsoft.viva.goals/allEntities/allProperties/allTasks: Manage all aspects of Microsoft Viva Goals
Action: microsoft.viva.pulse/allEntities/allProperties/allTasks: Manage all aspects of Microsoft Viva Pulse
Action: microsoft.windows.defenderAdvancedThreatProtection/allEntities/allTasks: Manage all aspects of Microsoft Defender for Endpoint
Action: microsoft.windows.updatesDeployments/allEntities/allProperties/allTasks: Read and configure all aspects of Windows Update Service