Recorded 22 Oct 2026 at 18:59 UTC. This is what ChangeIntel recorded, including the title, summary, facts and links. It is not a statement of the source's current position. See the latest record.
Microsoft Entra roleMicrosoft Learn
Groups Administrator
Members of this role can create/manage groups, create/manage groups settings like naming and expiration policies, and view groups activity and audit reports.
What it said
- Permission coverage
- Documented resource actions
- Action: microsoft.azure.serviceHealth/allEntities/allTasks
- Read and configure Azure Service Health
- Action: microsoft.azure.supportTickets/allEntities/allTasks
- Create and manage Azure support tickets
- Action: microsoft.directory/bulkJobs.groups/basic/update
- Update bulk jobs related to groups
- Action: microsoft.directory/bulkJobs.groups/create
- Create bulk jobs related to groups
- Action: microsoft.directory/bulkJobs.groups/standard/read
- Read bulk jobs related to groups
- Action: microsoft.directory/deletedItems.groups/delete
- Permanently delete groups, which can no longer be restored
- Action: microsoft.directory/deletedItems.groups/restore
- Restore soft deleted groups to original state
- Action: microsoft.directory/groups/assignLicense
- Assign product licenses to groups for group-based licensing
- Action: microsoft.directory/groups/assignedLabels/update
- Update the assigned labels property on groups of assigned membership type, excluding role-assignable groups
- Action: microsoft.directory/groups/basic/update
- Update basic properties on Security groups and Microsoft 365 groups, excluding role-assignable groups
- Action: microsoft.directory/groups/classification/update
- Update the classification property on Security groups and Microsoft 365 groups, excluding role-assignable groups
- Action: microsoft.directory/groups/create
- Create Security groups and Microsoft 365 groups, excluding role-assignable groups
- Action: microsoft.directory/groups/delete
- Delete Security groups and Microsoft 365 groups, excluding role-assignable groups
- Action: microsoft.directory/groups/dynamicMembershipRule/update
- Update the dynamic membership rule on Security groups and Microsoft 365 groups, excluding role-assignable groups
- Action: microsoft.directory/groups/groupType/update
- Update properties that would affect the group type of Security groups and Microsoft 365 groups, excluding role-assignable groups
- Action: microsoft.directory/groups/hiddenMembers/read
- Read hidden members of Security groups and Microsoft 365 groups, including role-assignable groups
- Action: microsoft.directory/groups/members/update
- Update members of Security groups and Microsoft 365 groups, excluding role-assignable groups
- Action: microsoft.directory/groups/onPremWriteBack/update
- Update Microsoft Entra groups to be written back to on-premises with Microsoft Entra Connect
- Action: microsoft.directory/groups/owners/update
- Update owners of Security groups and Microsoft 365 groups, excluding role-assignable groups
- Action: microsoft.directory/groups/reprocessLicenseAssignment
- Reprocess license assignments for group-based licensing
- Action: microsoft.directory/groups/restore
- Restore groups from soft-deleted container
- Action: microsoft.directory/groups/settings/update
- Update settings of groups
- Action: microsoft.directory/groups/visibility/update
- Update the visibility property of Security groups and Microsoft 365 groups, excluding role-assignable groups
- Action: microsoft.office365.serviceHealth/allEntities/allTasks
- Read and configure Service Health in the Microsoft 365 admin center
- Action: microsoft.office365.supportTickets/allEntities/allTasks
- Create and manage Microsoft 365 service requests
- Action: microsoft.office365.webPortal/allEntities/standard/read
- Read basic properties on all resources in the Microsoft 365 admin center