Microsoft Entra built-in rolePublic reference
Privileged Role Administrator
Can manage role assignments in Microsoft Entra ID, and all aspects of Privileged Identity Management.
Documented resource actions
28 documented actionsThese are Microsoft's documented resource actions, separate from Graph OAuth permissions and tenant assignments. Descriptions are shown as supplied in the reference.
| Action | Description |
|---|---|
| microsoft.directory/accessReviews/definitions.applications/allProperties/read | Read all properties of access reviews of application role assignments in Microsoft Entra ID |
| microsoft.directory/accessReviews/definitions.directoryRoles/allProperties/allTasks | Manage access reviews for Microsoft Entra role assignments |
| microsoft.directory/accessReviews/definitions.groups/allProperties/read | Read all properties of access reviews for membership in Security and Microsoft 365 groups, including role-assignable groups. |
| microsoft.directory/accessReviews/definitions.groupsAssignableToRoles/allProperties/update | Update all properties of access reviews for membership in groups that are assignable to Microsoft Entra roles |
| microsoft.directory/accessReviews/definitions.groupsAssignableToRoles/create | Create access reviews for membership in groups that are assignable to Microsoft Entra roles |
| microsoft.directory/accessReviews/definitions.groupsAssignableToRoles/delete | Delete access reviews for membership in groups that are assignable to Microsoft Entra roles |
| microsoft.directory/administrativeUnits/allProperties/allTasks | Create and manage administrative units (including members) |
| microsoft.directory/authorizationPolicy/allProperties/allTasks | Manage all aspects of authorization policy |
| microsoft.directory/directoryRoles/allProperties/allTasks | Create and delete directory roles, and read and update all properties |
| microsoft.directory/groupsAssignableToRoles/allProperties/update | Update role-assignable groups |
| microsoft.directory/groupsAssignableToRoles/assignLicense | Assign a license to role-assignable groups |
| microsoft.directory/groupsAssignableToRoles/create | Create role-assignable groups |
| microsoft.directory/groupsAssignableToRoles/delete | Delete role-assignable groups |
| microsoft.directory/groupsAssignableToRoles/reprocessLicenseAssignment | Reprocess license assignments to role-assignable groups |
| microsoft.directory/groupsAssignableToRoles/restore | Restore role-assignable groups |
| microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks | Create and delete OAuth 2.0 permission grants, and read and update all properties |
| microsoft.directory/permissionGrantPolicies/allProperties/read | Read all properties of permission grant policies |
| microsoft.directory/permissionGrantPolicies/allProperties/update | Update all properties of permission grant policies |
| microsoft.directory/permissionGrantPolicies/create | Create permission grant policies |
| microsoft.directory/permissionGrantPolicies/delete | Delete permission grant policies |
| microsoft.directory/privilegedIdentityManagement/allProperties/allTasks | Create and delete all resources, and read and update standard properties in Privileged Identity Management |
| microsoft.directory/roleAssignments/allProperties/allTasks | Create and delete role assignments, and read and update all role assignment properties |
| microsoft.directory/roleDefinitions/allProperties/allTasks | Create and delete role definitions, and read and update all properties |
| microsoft.directory/scopedRoleMemberships/allProperties/allTasks | Create and delete scopedRoleMemberships, and read and update all properties |
| microsoft.directory/servicePrincipals/appRoleAssignedTo/update | Update service principal role assignments |
| microsoft.directory/servicePrincipals/managePermissionGrantsForAll.microsoft-company-admin | Grant consent for any permission to any application |
| microsoft.directory/servicePrincipals/permissions/update | Update permissions of service principals |
| microsoft.office365.webPortal/allEntities/standard/read | Read basic properties on all resources in the Microsoft 365 admin center |