Recorded 22 Oct 2026 at 18:59 UTC. This is what ChangeIntel recorded, including the title, summary, facts and links. It is not a statement of the source's current position. See the latest record.

Microsoft Entra roleMicrosoft Learn

Application Administrator

Can create and manage all aspects of app registrations and enterprise apps.

Cite this recorded revision

What it said

Permission coverage: Documented resource actions
Action: microsoft.azure.serviceHealth/allEntities/allTasks: Read and configure Azure Service Health
Action: microsoft.azure.supportTickets/allEntities/allTasks: Create and manage Azure support tickets
Action: microsoft.directory/adminConsentRequestPolicy/allProperties/allTasks: Manage admin consent request policies in Microsoft Entra ID
Action: microsoft.directory/appConsent/appConsentRequests/allProperties/read: Read all properties of consent requests for applications registered with Microsoft Entra ID
Action: microsoft.directory/applicationPolicies/basic/update: Update standard properties of application policies
Action: microsoft.directory/applicationPolicies/create: Create application policies
Action: microsoft.directory/applicationPolicies/delete: Delete application policies
Action: microsoft.directory/applicationPolicies/owners/read: Read owners on application policies
Action: microsoft.directory/applicationPolicies/owners/update: Update the owner property of application policies
Action: microsoft.directory/applicationPolicies/policyAppliedTo/read: Read application policies applied to objects list
Action: microsoft.directory/applicationPolicies/standard/read: Read standard properties of application policies
Action: microsoft.directory/applicationTemplates/instantiate: Instantiate gallery applications from application templates
Action: microsoft.directory/applications/appRoles/update: Update the appRoles property on all types of applications
Action: microsoft.directory/applications/applicationProxy/read: Read all application proxy properties
Action: microsoft.directory/applications/applicationProxy/update: Update all application proxy properties
Action: microsoft.directory/applications/applicationProxyAuthentication/update: Update authentication on all types of applications
Action: microsoft.directory/applications/applicationProxySslCertificate/update: Update SSL certificate settings for application proxy
Action: microsoft.directory/applications/applicationProxyUrlSettings/update: Update URL settings for application proxy
Action: microsoft.directory/applications/audience/update: Update the audience property for applications
Action: microsoft.directory/applications/authentication/update: Update authentication on all types of applications
Action: microsoft.directory/applications/basic/update: Update basic properties for applications
Action: microsoft.directory/applications/create: Create all types of applications
Action: microsoft.directory/applications/credentials/update: Update application credentials
Action: microsoft.directory/applications/delete: Delete all types of applications
Action: microsoft.directory/applications/disablement/update: Update whether an application is enabled for users to sign in
Action: microsoft.directory/applications/extensionProperties/update: Update extension properties on applications
Action: microsoft.directory/applications/notes/update: Update notes of applications
Action: microsoft.directory/applications/owners/update: Update owners of applications
Action: microsoft.directory/applications/permissions/update: Update exposed permissions and required permissions on all types of applications
Action: microsoft.directory/applications/policies/update: Update policies of applications
Action: microsoft.directory/applications/synchronization/standard/read: Read provisioning settings associated with the application object
Action: microsoft.directory/applications/tag/update: Update tags of applications
Action: microsoft.directory/applications/verification/update: Update applicationsverification property
Action: microsoft.directory/auditLogs/allProperties/read: Read all properties on audit logs, excluding custom security attributes audit logs
Action: microsoft.directory/connectorGroups/allProperties/read: Read all properties of application proxy connector groups
Action: microsoft.directory/connectorGroups/allProperties/update: Update all properties of application proxy connector groups
Action: microsoft.directory/connectorGroups/create: Create application proxy connector groups
Action: microsoft.directory/connectorGroups/delete: Delete application proxy connector groups
Action: microsoft.directory/connectors/allProperties/read: Read all properties of application proxy connectors
Action: microsoft.directory/connectors/create: Create application proxy connectors
Action: microsoft.directory/customAuthenticationExtensions/allProperties/allTasks: Create and manage custom authentication extensions
Action: microsoft.directory/deletedItems.applications/delete: Permanently delete applications, which can no longer be restored
Action: microsoft.directory/deletedItems.applications/restore: Restore soft deleted applications to original state
Action: microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks: Create and delete OAuth 2.0 permission grants, and read and update all properties
Action: microsoft.directory/provisioningLogs/allProperties/read: Read all properties of provisioning logs
Action: microsoft.directory/servicePrincipals/appRoleAssignedTo/update: Update service principal role assignments
Action: microsoft.directory/servicePrincipals/audience/update: Update audience properties on service principals
Action: microsoft.directory/servicePrincipals/authentication/update: Update authentication properties on service principals
Action: microsoft.directory/servicePrincipals/basic/update: Update basic properties on service principals
Action: microsoft.directory/servicePrincipals/create: Create service principals
Action: microsoft.directory/servicePrincipals/credentials/update: Update credentials of service principals
Action: microsoft.directory/servicePrincipals/delete: Delete service principals
Action: microsoft.directory/servicePrincipals/disable: Disable service principals
Action: microsoft.directory/servicePrincipals/enable: Enable service principals
Action: microsoft.directory/servicePrincipals/getPasswordSingleSignOnCredentials: Manage password single sign-on credentials on service principals
Action: microsoft.directory/servicePrincipals/managePasswordSingleSignOnCredentials: Read password single sign-on credentials on service principals
Action: microsoft.directory/servicePrincipals/managePermissionGrantsForAll.microsoft-application-admin: Grant consent for application permissions and delegated permissions on behalf of any user or all users, except for application permissions for Microsoft Graph and Azure AD Graph
Action: microsoft.directory/servicePrincipals/notes/update: Update notes of service principals
Action: microsoft.directory/servicePrincipals/owners/update: Update owners of service principals
Action: microsoft.directory/servicePrincipals/permissions/update: Update permissions of service principals
Action: microsoft.directory/servicePrincipals/policies/update: Update policies of service principals
Action: microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/credentials/manage: Manage application provisioning secrets and credentials.
Action: microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/jobs/manage: Start, restart, and pause application provisioning synchronization jobs.
Action: microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/schema/manage: Create and manage application provisioning synchronization jobs and schema.
Action: microsoft.directory/servicePrincipals/synchronization/standard/read: Read provisioning settings associated with your service principal
Action: microsoft.directory/servicePrincipals/synchronizationCredentials/manage: Manage application provisioning secrets and credentials
Action: microsoft.directory/servicePrincipals/synchronizationJobs/manage: Start, restart, and pause application provisioning synchronization jobs
Action: microsoft.directory/servicePrincipals/synchronizationSchema/manage: Create and manage application provisioning synchronization jobs and schema
Action: microsoft.directory/servicePrincipals/tag/update: Update the tag property for service principals
Action: microsoft.directory/signInReports/allProperties/read: Read all properties on sign-in reports, including privileged properties
Action: microsoft.office365.serviceHealth/allEntities/allTasks: Read and configure Service Health in the Microsoft 365 admin center
Action: microsoft.office365.supportTickets/allEntities/allTasks: Create and manage Microsoft 365 service requests
Action: microsoft.office365.webPortal/allEntities/standard/read: Read basic properties on all resources in the Microsoft 365 admin center