Recorded 22 Oct 2026 at 18:59 UTC. This is what ChangeIntel recorded, including the title, summary, facts and links. It is not a statement of the source's current position. See the latest record.

Microsoft Entra roleMicrosoft Learn

Directory Writers

Can read and write basic directory information. For granting access to applications, not intended for users.

Cite this recorded revision

What it said

Permission coverage: Documented resource actions
Action: microsoft.directory/applications/extensionProperties/update: Update extension properties on applications
Action: microsoft.directory/contacts/create: Create contacts
Action: microsoft.directory/groupSettings/basic/update: Update basic properties on group settings
Action: microsoft.directory/groupSettings/create: Create group settings
Action: microsoft.directory/groupSettings/delete: Delete group settings
Action: microsoft.directory/groups/assignLicense: Assign product licenses to groups for group-based licensing
Action: microsoft.directory/groups/assignedLabels/update: Update the assigned labels property on groups of assigned membership type, excluding role-assignable groups
Action: microsoft.directory/groups/basic/update: Update basic properties on Security groups and Microsoft 365 groups, excluding role-assignable groups
Action: microsoft.directory/groups/classification/update: Update the classification property on Security groups and Microsoft 365 groups, excluding role-assignable groups
Action: microsoft.directory/groups/create: Create Security groups and Microsoft 365 groups, excluding role-assignable groups
Action: microsoft.directory/groups/dynamicMembershipRule/update: Update the dynamic membership rule on Security groups and Microsoft 365 groups, excluding role-assignable groups
Action: microsoft.directory/groups/groupType/update: Update properties that would affect the group type of Security groups and Microsoft 365 groups, excluding role-assignable groups
Action: microsoft.directory/groups/members/update: Update members of Security groups and Microsoft 365 groups, excluding role-assignable groups
Action: microsoft.directory/groups/onPremWriteBack/update: Update Microsoft Entra groups to be written back to on-premises with Microsoft Entra Connect
Action: microsoft.directory/groups/owners/update: Update owners of Security groups and Microsoft 365 groups, excluding role-assignable groups
Action: microsoft.directory/groups/reprocessLicenseAssignment: Reprocess license assignments for group-based licensing
Action: microsoft.directory/groups/settings/update: Update settings of groups
Action: microsoft.directory/groups/visibility/update: Update the visibility property of Security groups and Microsoft 365 groups, excluding role-assignable groups
Action: microsoft.directory/oAuth2PermissionGrants/basic/update: Update OAuth 2.0 permission grants
Action: microsoft.directory/oAuth2PermissionGrants/create: Create OAuth 2.0 permission grants
Action: microsoft.directory/servicePrincipals/appRoleAssignedTo/update: Update service principal role assignments
Action: microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/credentials/manage: Manage cloud tenant to cloud tenant application provisioning secrets and credentials.
Action: microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/jobs/manage: Start, restart, and pause cloud tenant to cloud tenant application provisioning synchronization jobs.
Action: microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/schema/manage: Create and manage cloud tenant to cloud tenant application provisioning synchronization jobs and schema.
Action: microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/credentials/manage: Manage application provisioning secrets and credentials.
Action: microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/jobs/manage: Start, restart, and pause application provisioning synchronization jobs.
Action: microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/schema/manage: Create and manage application provisioning synchronization jobs and schema.
Action: microsoft.directory/servicePrincipals/synchronizationCredentials/manage: Manage application provisioning secrets and credentials
Action: microsoft.directory/servicePrincipals/synchronizationJobs/manage: Start, restart, and pause application provisioning synchronization jobs
Action: microsoft.directory/servicePrincipals/synchronizationSchema/manage: Create and manage application provisioning synchronization jobs and schema
Action: microsoft.directory/users/assignLicense: Manage user licenses
Action: microsoft.directory/users/basic/update: Update basic properties on users
Action: microsoft.directory/users/create: Add users
Action: microsoft.directory/users/disable: Disable users
Action: microsoft.directory/users/enable: Enable users
Action: microsoft.directory/users/invalidateAllRefreshTokens: Force sign-out by invalidating user refresh tokens
Action: microsoft.directory/users/inviteGuest: Invite guest users
Action: microsoft.directory/users/manager/update: Update manager for users
Action: microsoft.directory/users/photo/update: Update photo of users
Action: microsoft.directory/users/reprocessLicenseAssignment: Reprocess license assignments for users
Action: microsoft.directory/users/sponsors/update: Update sponsors of users
Action: microsoft.directory/users/userPrincipalName/update: Update User Principal Name of users