Compare Entra role definitions
Compare two roles or the definitions retained around an observed change. Each side names its evidence; action patterns are compared literally.
Selected evidence and scope
| Definition | Left | Right |
|---|---|---|
| Role | Agent ID Administrator | Agent ID Administrator |
| Observation | Current accepted 2026-10-25 22:06:27Z | Current accepted 2026-10-25 22:06:27Z |
| Description | Manage all aspects of agents in a tenant including identity lifecycle operations for agent blueprints, agent identity blueprint principals, agent identities, and agentic users. | Manage all aspects of agents in a tenant including identity lifecycle operations for agent blueprints, agent identity blueprint principals, agent identities, and agentic users. |
| Privileged label | Marked privileged | Marked privileged |
| Action table | 64 actions | 64 actions |
A retained before/after definition is exact evidence from that transition. Gaps and edits between reads are unknown. This does not compare assignments, PIM eligibility or effective access.
Documented action comparison
0 left only · 0 right only · 64 shared
64 actions
| Action | Difference | Left description | Right description |
|---|---|---|---|
| microsoft.azure.serviceHealth/allEntities/allTasks | Shared | Read and configure Azure Service Health | Read and configure Azure Service Health |
| microsoft.azure.supportTickets/allEntities/allTasks | Shared | Create and manage Azure support tickets | Create and manage Azure support tickets |
| microsoft.directory/agentIdentities/appRoleAssignedTo/update | Shared | Update agent identity role assignments | Update agent identity role assignments |
| microsoft.directory/agentIdentities/authentication/update | Shared | Update authentication on agent identities | Update authentication on agent identities |
| microsoft.directory/agentIdentities/basic/update | Shared | Update basic properties on agent identities | Update basic properties on agent identities |
| microsoft.directory/agentIdentities/create | Shared | Create agent identities | Create agent identities |
| microsoft.directory/agentIdentities/delete | Shared | Delete agent identities | Delete agent identities |
| microsoft.directory/agentIdentities/disable | Shared | Disable agent identities | Disable agent identities |
| microsoft.directory/agentIdentities/enable | Shared | Enable agent identities | Enable agent identities |
| microsoft.directory/agentIdentities/owners/update | Shared | Update owners on agent identities | Update owners on agent identities |
| microsoft.directory/agentIdentities/tag/update | Shared | Update tags of agent identities | Update tags of agent identities |
| microsoft.directory/agentIdentityBlueprintPrincipals/appRoleAssignedTo/update | Shared | Update agent identity blueprint principal role assignments | Update agent identity blueprint principal role assignments |
| microsoft.directory/agentIdentityBlueprintPrincipals/authentication/update | Shared | Update authentication on agent identity blueprint principals | Update authentication on agent identity blueprint principals |
| microsoft.directory/agentIdentityBlueprintPrincipals/basic/update | Shared | Update basic properties on agent identity blueprint principals | Update basic properties on agent identity blueprint principals |
| microsoft.directory/agentIdentityBlueprintPrincipals/create | Shared | Create agent identity blueprint principals | Create agent identity blueprint principals |
| microsoft.directory/agentIdentityBlueprintPrincipals/delete | Shared | Delete agent identity blueprint principals | Delete agent identity blueprint principals |
| microsoft.directory/agentIdentityBlueprintPrincipals/disable | Shared | Disable agent identity blueprint principals | Disable agent identity blueprint principals |
| microsoft.directory/agentIdentityBlueprintPrincipals/enable | Shared | Enable agent identity blueprint principals | Enable agent identity blueprint principals |
| microsoft.directory/agentIdentityBlueprintPrincipals/owners/update | Shared | Update owners on agent identity blueprint principals | Update owners on agent identity blueprint principals |
| microsoft.directory/agentIdentityBlueprintPrincipals/tag/update | Shared | Update tags of agent identity blueprint principals | Update tags of agent identity blueprint principals |
| microsoft.directory/agentIdentityBlueprints/allProperties/read | Shared | Read all properties of agent identity blueprints | Read all properties of agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/allProperties/update | Shared | Update all properties of agent identity blueprints | Update all properties of agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/appRoles/update | Shared | Update appRoles on agent identity blueprints | Update appRoles on agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/audience/update | Shared | Update audience on agent identity blueprints | Update audience on agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/authentication/update | Shared | Update authentication on agent identity blueprints | Update authentication on agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/basic/update | Shared | Update basic properties on agent identity blueprints | Update basic properties on agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/create | Shared | Create agent identity blueprints | Create agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/credentials/update | Shared | Update credentials on agent identity blueprints | Update credentials on agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/delete | Shared | Delete agent identity blueprints | Delete agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/owners/update | Shared | Update owners on agent identity blueprints | Update owners on agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/permissions/update | Shared | Update exposed permissions and required permissions on agent identity blueprints | Update exposed permissions and required permissions on agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/tag/update | Shared | Update tags of agent identity blueprints | Update tags of agent identity blueprints |
| microsoft.directory/agentUsers/assignLicense | Shared | Assign product licenses for agent users | Assign product licenses for agent users |
| microsoft.directory/agentUsers/basic/update | Shared | Update basic properties on agent users, such display name, user type, and mail nickname | Update basic properties on agent users, such display name, user type, and mail nickname |
| microsoft.directory/agentUsers/create | Shared | Create agent users | Create agent users |
| microsoft.directory/agentUsers/delete | Shared | Delete agent users | Delete agent users |
| microsoft.directory/agentUsers/disable | Shared | Disable agent users | Disable agent users |
| microsoft.directory/agentUsers/enable | Shared | Enable agent users | Enable agent users |
| microsoft.directory/agentUsers/invalidateAllRefreshTokens | Shared | Force sign-out by invalidating agent user refresh tokens | Force sign-out by invalidating agent user refresh tokens |
| microsoft.directory/agentUsers/lifeCycleInfo/read | Shared | Read lifecycle information of agent users, such as employeeLeaveDateTime | Read lifecycle information of agent users, such as employeeLeaveDateTime |
| microsoft.directory/agentUsers/lifeCycleInfo/update | Shared | Update lifecycle information of agent users, such as employeeLeaveDateTime | Update lifecycle information of agent users, such as employeeLeaveDateTime |
| microsoft.directory/agentUsers/manager/update | Shared | Update manager for agent users | Update manager for agent users |
| microsoft.directory/agentUsers/photo/update | Shared | Update photo of agent users | Update photo of agent users |
| microsoft.directory/agentUsers/reprocessLicenseAssignment | Shared | Reprocess license assignments for agent users | Reprocess license assignments for agent users |
| microsoft.directory/agentUsers/restore | Shared | Restore deleted agent users | Restore deleted agent users |
| microsoft.directory/agentUsers/revokeSignInSessions | Shared | Revoke sign-in sessions for agent users | Revoke sign-in sessions for agent users |
| microsoft.directory/agentUsers/sponsors/update | Shared | Update sponsors of agent users | Update sponsors of agent users |
| microsoft.directory/agentUsers/usageLocation/update | Shared | Update usage location of agent users | Update usage location of agent users |
| microsoft.directory/agentUsers/userPrincipalName/update | Shared | Update the user principal name of agent users | Update the user principal name of agent users |
| microsoft.directory/auditLogs/allProperties/read | Shared | Read all properties on audit logs, excluding custom security attributes audit logs | Read all properties on audit logs, excluding custom security attributes audit logs |
| microsoft.directory/deletedItems.agentIdentities/delete | Shared | Permanently delete agent identities, which can no longer be restored | Permanently delete agent identities, which can no longer be restored |
| microsoft.directory/deletedItems.agentIdentities/restore | Shared | Restore soft-deleted agent identities to original state | Restore soft-deleted agent identities to original state |
| microsoft.directory/deletedItems.agentIdentityBlueprintPrincipals/delete | Shared | Permanently delete agent identity blueprint principals, which can no longer be restored | Permanently delete agent identity blueprint principals, which can no longer be restored |
| microsoft.directory/deletedItems.agentIdentityBlueprintPrincipals/restore | Shared | Restore soft-deleted agent identity blueprint principals to original state | Restore soft-deleted agent identity blueprint principals to original state |
| microsoft.directory/deletedItems.agentIdentityBlueprints/delete | Shared | Permanently delete agent identity blueprints, which can no longer be restored | Permanently delete agent identity blueprints, which can no longer be restored |
| microsoft.directory/deletedItems.agentIdentityBlueprints/restore | Shared | Restore soft-deleted agent identity blueprints to original state | Restore soft-deleted agent identity blueprints to original state |
| microsoft.directory/externalUserProfiles/standard/read | Shared | Read standard properties of external user profiles in the extended directory for Teams | Read standard properties of external user profiles in the extended directory for Teams |
| microsoft.directory/groups.unified/createAsOwner | Shared | Create Microsoft 365 groups, excluding role-assignable groups. Creator is added as the first owner. | Create Microsoft 365 groups, excluding role-assignable groups. Creator is added as the first owner. |
| microsoft.directory/groups/hiddenMembers/read | Shared | Read hidden members of Security groups and Microsoft 365 groups, including role-assignable groups | Read hidden members of Security groups and Microsoft 365 groups, including role-assignable groups |
| microsoft.directory/organization/standard/read | Shared | Read basic properties on an organization | Read basic properties on an organization |
| microsoft.directory/policies/standard/read | Shared | Read basic properties on policies | Read basic properties on policies |
| microsoft.directory/signInReports/allProperties/read | Shared | Read all properties on sign-in reports, including privileged properties | Read all properties on sign-in reports, including privileged properties |
| microsoft.office365.serviceHealth/allEntities/allTasks | Shared | Read and configure Service Health in the Microsoft 365 admin center | Read and configure Service Health in the Microsoft 365 admin center |
| microsoft.office365.supportTickets/allEntities/allTasks | Shared | Create and manage Microsoft 365 service requests | Create and manage Microsoft 365 service requests |
Wildcards remain literal patterns. A shared pattern does not prove unchanged effective access when Microsoft adds resource operations.