| microsoft.azure.serviceHealth/allEntities/allTasks | Read and configure Azure Service Health |
| microsoft.azure.supportTickets/allEntities/allTasks | Create and manage Azure support tickets |
| microsoft.directory/deletedItems.users/restore | Restore soft deleted users to original state |
| microsoft.directory/users/authenticationMethods/basic/update | Update basic properties of authentication methods for users |
| microsoft.directory/users/authenticationMethods/create | Update authentication methods for users |
| microsoft.directory/users/authenticationMethods/delete | Delete authentication methods for users |
| microsoft.directory/users/authenticationMethods/standard/restrictedRead | Read standard properties of authentication methods that do not include personally identifiable information for users |
| microsoft.directory/users/basic/update | Update basic properties on users |
| microsoft.directory/users/delete | Delete users |
| microsoft.directory/users/disable | Disable users |
| microsoft.directory/users/enable | Enable users |
| microsoft.directory/users/invalidateAllRefreshTokens | Force sign-out by invalidating user refresh tokens |
| microsoft.directory/users/manager/update | Update manager for users |
| microsoft.directory/users/password/update | Reset passwords for all users |
| microsoft.directory/users/restore | Restore deleted users |
| microsoft.directory/users/userPrincipalName/update | Update User Principal Name of users |
| microsoft.office365.serviceHealth/allEntities/allTasks | Read and configure Service Health in the Microsoft 365 admin center |
| microsoft.office365.supportTickets/allEntities/allTasks | Create and manage Microsoft 365 service requests |
| microsoft.office365.webPortal/allEntities/standard/read | Read basic properties on all resources in the Microsoft 365 admin center |