| microsoft.azure.serviceHealth/allEntities/allTasks | Read and configure Azure Service Health |
| microsoft.azure.supportTickets/allEntities/allTasks | Create and manage Azure support tickets |
| microsoft.directory/agentIdentities/appRoleAssignedTo/update | Update agent identity role assignments |
| microsoft.directory/agentIdentities/authentication/update | Update authentication on agent identities |
| microsoft.directory/agentIdentities/basic/update | Update basic properties on agent identities |
| microsoft.directory/agentIdentities/create | Create agent identities |
| microsoft.directory/agentIdentities/delete | Delete agent identities |
| microsoft.directory/agentIdentities/disable | Disable agent identities |
| microsoft.directory/agentIdentities/enable | Enable agent identities |
| microsoft.directory/agentIdentities/owners/update | Update owners on agent identities |
| microsoft.directory/agentIdentities/tag/update | Update tags of agent identities |
| microsoft.directory/agentIdentityBlueprintPrincipals/appRoleAssignedTo/update | Update agent identity blueprint principal role assignments |
| microsoft.directory/agentIdentityBlueprintPrincipals/authentication/update | Update authentication on agent identity blueprint principals |
| microsoft.directory/agentIdentityBlueprintPrincipals/basic/update | Update basic properties on agent identity blueprint principals |
| microsoft.directory/agentIdentityBlueprintPrincipals/create | Create agent identity blueprint principals |
| microsoft.directory/agentIdentityBlueprintPrincipals/delete | Delete agent identity blueprint principals |
| microsoft.directory/agentIdentityBlueprintPrincipals/disable | Disable agent identity blueprint principals |
| microsoft.directory/agentIdentityBlueprintPrincipals/enable | Enable agent identity blueprint principals |
| microsoft.directory/agentIdentityBlueprintPrincipals/owners/update | Update owners on agent identity blueprint principals |
| microsoft.directory/agentIdentityBlueprintPrincipals/tag/update | Update tags of agent identity blueprint principals |
| microsoft.directory/agentIdentityBlueprints/allProperties/read | Read all properties of agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/allProperties/update | Update all properties of agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/appRoles/update | Update appRoles on agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/audience/update | Update audience on agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/authentication/update | Update authentication on agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/basic/update | Update basic properties on agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/create | Create agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/credentials/update | Update credentials on agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/delete | Delete agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/owners/update | Update owners on agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/permissions/update | Update exposed permissions and required permissions on agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/tag/update | Update tags of agent identity blueprints |
| microsoft.directory/agentUsers/assignLicense | Assign product licenses for agent users |
| microsoft.directory/agentUsers/basic/update | Update basic properties on agent users, such display name, user type, and mail nickname |
| microsoft.directory/agentUsers/create | Create agent users |
| microsoft.directory/agentUsers/delete | Delete agent users |
| microsoft.directory/agentUsers/disable | Disable agent users |
| microsoft.directory/agentUsers/enable | Enable agent users |
| microsoft.directory/agentUsers/invalidateAllRefreshTokens | Force sign-out by invalidating agent user refresh tokens |
| microsoft.directory/agentUsers/lifeCycleInfo/read | Read lifecycle information of agent users, such as employeeLeaveDateTime |
| microsoft.directory/agentUsers/lifeCycleInfo/update | Update lifecycle information of agent users, such as employeeLeaveDateTime |
| microsoft.directory/agentUsers/manager/update | Update manager for agent users |
| microsoft.directory/agentUsers/photo/update | Update photo of agent users |
| microsoft.directory/agentUsers/reprocessLicenseAssignment | Reprocess license assignments for agent users |
| microsoft.directory/agentUsers/restore | Restore deleted agent users |
| microsoft.directory/agentUsers/revokeSignInSessions | Revoke sign-in sessions for agent users |
| microsoft.directory/agentUsers/sponsors/update | Update sponsors of agent users |
| microsoft.directory/agentUsers/usageLocation/update | Update usage location of agent users |
| microsoft.directory/agentUsers/userPrincipalName/update | Update the user principal name of agent users |
| microsoft.directory/auditLogs/allProperties/read | Read all properties on audit logs, excluding custom security attributes audit logs |
| microsoft.directory/deletedItems.agentIdentities/delete | Permanently delete agent identities, which can no longer be restored |
| microsoft.directory/deletedItems.agentIdentities/restore | Restore soft-deleted agent identities to original state |
| microsoft.directory/deletedItems.agentIdentityBlueprintPrincipals/delete | Permanently delete agent identity blueprint principals, which can no longer be restored |
| microsoft.directory/deletedItems.agentIdentityBlueprintPrincipals/restore | Restore soft-deleted agent identity blueprint principals to original state |
| microsoft.directory/deletedItems.agentIdentityBlueprints/delete | Permanently delete agent identity blueprints, which can no longer be restored |
| microsoft.directory/deletedItems.agentIdentityBlueprints/restore | Restore soft-deleted agent identity blueprints to original state |
| microsoft.directory/externalUserProfiles/standard/read | Read standard properties of external user profiles in the extended directory for Teams |
| microsoft.directory/groups.unified/createAsOwner | Create Microsoft 365 groups, excluding role-assignable groups. Creator is added as the first owner. |
| microsoft.directory/groups/hiddenMembers/read | Read hidden members of Security groups and Microsoft 365 groups, including role-assignable groups |
| microsoft.directory/organization/standard/read | Read basic properties on an organization |
| microsoft.directory/policies/standard/read | Read basic properties on policies |
| microsoft.directory/signInReports/allProperties/read | Read all properties on sign-in reports, including privileged properties |
| microsoft.office365.serviceHealth/allEntities/allTasks | Read and configure Service Health in the Microsoft 365 admin center |
| microsoft.office365.supportTickets/allEntities/allTasks | Create and manage Microsoft 365 service requests |