Recorded 22 Oct 2026 at 18:59 UTC. This is what ChangeIntel recorded, including the title, summary, facts and links. It is not a statement of the source's current position. See the latest record.

Microsoft Entra roleMicrosoft Learn

Privileged Role Administrator

Can manage role assignments in Microsoft Entra ID, and all aspects of Privileged Identity Management.

Cite this recorded revision

What it said

Permission coverage: Documented resource actions
Action: microsoft.directory/accessReviews/definitions.applications/allProperties/read: Read all properties of access reviews of application role assignments in Microsoft Entra ID
Action: microsoft.directory/accessReviews/definitions.directoryRoles/allProperties/allTasks: Manage access reviews for Microsoft Entra role assignments
Action: microsoft.directory/accessReviews/definitions.groups/allProperties/read: Read all properties of access reviews for membership in Security and Microsoft 365 groups, including role-assignable groups.
Action: microsoft.directory/accessReviews/definitions.groupsAssignableToRoles/allProperties/update: Update all properties of access reviews for membership in groups that are assignable to Microsoft Entra roles
Action: microsoft.directory/accessReviews/definitions.groupsAssignableToRoles/create: Create access reviews for membership in groups that are assignable to Microsoft Entra roles
Action: microsoft.directory/accessReviews/definitions.groupsAssignableToRoles/delete: Delete access reviews for membership in groups that are assignable to Microsoft Entra roles
Action: microsoft.directory/administrativeUnits/allProperties/allTasks: Create and manage administrative units (including members)
Action: microsoft.directory/authorizationPolicy/allProperties/allTasks: Manage all aspects of authorization policy
Action: microsoft.directory/directoryRoles/allProperties/allTasks: Create and delete directory roles, and read and update all properties
Action: microsoft.directory/groupsAssignableToRoles/allProperties/update: Update role-assignable groups
Action: microsoft.directory/groupsAssignableToRoles/assignLicense: Assign a license to role-assignable groups
Action: microsoft.directory/groupsAssignableToRoles/create: Create role-assignable groups
Action: microsoft.directory/groupsAssignableToRoles/delete: Delete role-assignable groups
Action: microsoft.directory/groupsAssignableToRoles/reprocessLicenseAssignment: Reprocess license assignments to role-assignable groups
Action: microsoft.directory/groupsAssignableToRoles/restore: Restore role-assignable groups
Action: microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks: Create and delete OAuth 2.0 permission grants, and read and update all properties
Action: microsoft.directory/permissionGrantPolicies/allProperties/read: Read all properties of permission grant policies
Action: microsoft.directory/permissionGrantPolicies/allProperties/update: Update all properties of permission grant policies
Action: microsoft.directory/permissionGrantPolicies/create: Create permission grant policies
Action: microsoft.directory/permissionGrantPolicies/delete: Delete permission grant policies
Action: microsoft.directory/privilegedIdentityManagement/allProperties/allTasks: Create and delete all resources, and read and update standard properties in Privileged Identity Management
Action: microsoft.directory/roleAssignments/allProperties/allTasks: Create and delete role assignments, and read and update all role assignment properties
Action: microsoft.directory/roleDefinitions/allProperties/allTasks: Create and delete role definitions, and read and update all properties
Action: microsoft.directory/scopedRoleMemberships/allProperties/allTasks: Create and delete scopedRoleMemberships, and read and update all properties
Action: microsoft.directory/servicePrincipals/appRoleAssignedTo/update: Update service principal role assignments
Action: microsoft.directory/servicePrincipals/managePermissionGrantsForAll.microsoft-company-admin: Grant consent for any permission to any application
Action: microsoft.directory/servicePrincipals/permissions/update: Update permissions of service principals
Action: microsoft.office365.webPortal/allEntities/standard/read: Read basic properties on all resources in the Microsoft 365 admin center