Microsoft Entra built-in rolePublic reference
Conditional Access Administrator
Can manage Conditional Access capabilities.
Documented resource actions
13 documented actionsThese are Microsoft's documented resource actions, separate from Graph OAuth permissions and tenant assignments. Descriptions are shown as supplied in the reference.
| Action | Description |
|---|---|
| microsoft.directory/conditionalAccessPolicies/basic/update | Update basic properties for Conditional Access policies |
| microsoft.directory/conditionalAccessPolicies/create | Create Conditional Access policies |
| microsoft.directory/conditionalAccessPolicies/delete | Delete Conditional Access policies |
| microsoft.directory/conditionalAccessPolicies/owners/read | Read the owners of Conditional Access policies |
| microsoft.directory/conditionalAccessPolicies/owners/update | Update owners for Conditional Access policies |
| microsoft.directory/conditionalAccessPolicies/policyAppliedTo/read | Read the "applied to" property for Conditional Access policies |
| microsoft.directory/conditionalAccessPolicies/standard/read | Read Conditional Access for policies |
| microsoft.directory/conditionalAccessPolicies/tenantDefault/update | Update the default tenant for Conditional Access policies |
| microsoft.directory/namedLocations/basic/update | Update basic properties of custom rules that define network locations |
| microsoft.directory/namedLocations/create | Create custom rules that define network locations |
| microsoft.directory/namedLocations/delete | Delete custom rules that define network locations |
| microsoft.directory/namedLocations/standard/read | Read basic properties of custom rules that define network locations |
| microsoft.directory/resourceNamespaces/resourceActions/authenticationContext/update | Update Conditional Access authentication context of Microsoft 365 role-based access control (RBAC) resource actions |