Microsoft Entra built-in rolePublic reference
Privileged Authentication Administrator
Can access to view, set and reset authentication method information for any user (admin or non-admin).
Documented resource actions
20 documented actionsThese are Microsoft's documented resource actions, separate from Graph OAuth permissions and tenant assignments. Descriptions are shown as supplied in the reference.
| Action | Description |
|---|---|
| microsoft.azure.serviceHealth/allEntities/allTasks | Read and configure Azure Service Health |
| microsoft.azure.supportTickets/allEntities/allTasks | Create and manage Azure support tickets |
| microsoft.directory/deletedItems.users/restore | Restore soft deleted users to original state |
| microsoft.directory/users/authenticationMethods/basic/update | Update basic properties of authentication methods for users |
| microsoft.directory/users/authenticationMethods/create | Update authentication methods for users |
| microsoft.directory/users/authenticationMethods/delete | Delete authentication methods for users |
| microsoft.directory/users/authenticationMethods/standard/read | Read standard properties of authentication methods for users |
| microsoft.directory/users/authorizationInfo/update | Update the multivalued Certificate user IDs property of users |
| microsoft.directory/users/basic/update | Update basic properties on users |
| microsoft.directory/users/delete | Delete users |
| microsoft.directory/users/disable | Disable users |
| microsoft.directory/users/enable | Enable users |
| microsoft.directory/users/invalidateAllRefreshTokens | Force sign-out by invalidating user refresh tokens |
| microsoft.directory/users/manager/update | Update manager for users |
| microsoft.directory/users/password/update | Reset passwords for all users |
| microsoft.directory/users/restore | Restore deleted users |
| microsoft.directory/users/userPrincipalName/update | Update User Principal Name of users |
| microsoft.office365.serviceHealth/allEntities/allTasks | Read and configure Service Health in the Microsoft 365 admin center |
| microsoft.office365.supportTickets/allEntities/allTasks | Create and manage Microsoft 365 service requests |
| microsoft.office365.webPortal/allEntities/standard/read | Read basic properties on all resources in the Microsoft 365 admin center |