Microsoft Entra built-in rolePublic reference

Attack Payload Author

Can create attack payloads that an administrator can initiate later.

Documented resource actions

2 documented actions

These are Microsoft's documented resource actions, separate from Graph OAuth permissions and tenant assignments. Descriptions are shown as supplied in the reference.

Action	Description
microsoft.office365.protectionCenter/attackSimulator/payload/allProperties/allTasks	Create and manage attack payloads in Attack Simulator
microsoft.office365.protectionCenter/attackSimulator/reports/allProperties/read	Read reports of attack simulation, responses, and associated training