Microsoft Entra built-in rolePublic reference
Cloud Device Administrator
Limited access to manage devices in Microsoft Entra ID.
Documented resource actions
19 documented actionsThese are Microsoft's documented resource actions, separate from Graph OAuth permissions and tenant assignments. Descriptions are shown as supplied in the reference.
| Action | Description |
|---|---|
| microsoft.azure.serviceHealth/allEntities/allTasks | Read and configure Azure Service Health |
| microsoft.directory/auditLogs/allProperties/read | Read all properties on audit logs, excluding custom security attributes audit logs |
| microsoft.directory/authorizationPolicy/standard/read | Read standard properties of authorization policy |
| microsoft.directory/bitlockerKeys/key/read | Read bitlocker metadata and key on devices |
| microsoft.directory/deletedItems.devices/delete | Permanently delete devices, which can no longer be restored |
| microsoft.directory/deletedItems.devices/restore | Restore soft deleted devices to original state |
| microsoft.directory/deviceLocalCredentials/password/read | Read all properties of the backed up local administrator account credentials for Microsoft Entra joined devices, including the password |
| microsoft.directory/deviceManagementPolicies/basic/update | Update basic properties on mobile device management and mobile app management policies |
| microsoft.directory/deviceManagementPolicies/standard/read | Read standard properties on mobile device management and mobile app management policies |
| microsoft.directory/deviceRegistrationPolicy/basic/update | Update basic properties on device registration policies |
| microsoft.directory/deviceRegistrationPolicy/standard/read | Read standard properties on device registration policies |
| microsoft.directory/deviceTemplates/owners/read | Read owners on Internet of Things (IoT) device templates |
| microsoft.directory/deviceTemplates/owners/update | Update owners on Internet of Things (IoT) device templates |
| microsoft.directory/devices/delete | Delete devices from Microsoft Entra ID |
| microsoft.directory/devices/disable | Disable devices in Microsoft Entra ID |
| microsoft.directory/devices/enable | Enable devices in Microsoft Entra ID |
| microsoft.directory/devices/permissions/update | Update the alternative name property on an IoT device |
| microsoft.directory/signInReports/allProperties/read | Read all properties on sign-in reports, including privileged properties |
| microsoft.office365.serviceHealth/allEntities/allTasks | Read and configure Service Health in the Microsoft 365 admin center |