Microsoft Entra built-in rolePublic reference
Groups Administrator
Members of this role can create/manage groups, create/manage groups settings like naming and expiration policies, and view groups activity and audit reports.
Documented resource actions
26 documented actionsThese are Microsoft's documented resource actions, separate from Graph OAuth permissions and tenant assignments. Descriptions are shown as supplied in the reference.
| Action | Description |
|---|---|
| microsoft.azure.serviceHealth/allEntities/allTasks | Read and configure Azure Service Health |
| microsoft.azure.supportTickets/allEntities/allTasks | Create and manage Azure support tickets |
| microsoft.directory/bulkJobs.groups/basic/update | Update bulk jobs related to groups |
| microsoft.directory/bulkJobs.groups/create | Create bulk jobs related to groups |
| microsoft.directory/bulkJobs.groups/standard/read | Read bulk jobs related to groups |
| microsoft.directory/deletedItems.groups/delete | Permanently delete groups, which can no longer be restored |
| microsoft.directory/deletedItems.groups/restore | Restore soft deleted groups to original state |
| microsoft.directory/groups/assignLicense | Assign product licenses to groups for group-based licensing |
| microsoft.directory/groups/assignedLabels/update | Update the assigned labels property on groups of assigned membership type, excluding role-assignable groups |
| microsoft.directory/groups/basic/update | Update basic properties on Security groups and Microsoft 365 groups, excluding role-assignable groups |
| microsoft.directory/groups/classification/update | Update the classification property on Security groups and Microsoft 365 groups, excluding role-assignable groups |
| microsoft.directory/groups/create | Create Security groups and Microsoft 365 groups, excluding role-assignable groups |
| microsoft.directory/groups/delete | Delete Security groups and Microsoft 365 groups, excluding role-assignable groups |
| microsoft.directory/groups/dynamicMembershipRule/update | Update the dynamic membership rule on Security groups and Microsoft 365 groups, excluding role-assignable groups |
| microsoft.directory/groups/groupType/update | Update properties that would affect the group type of Security groups and Microsoft 365 groups, excluding role-assignable groups |
| microsoft.directory/groups/hiddenMembers/read | Read hidden members of Security groups and Microsoft 365 groups, including role-assignable groups |
| microsoft.directory/groups/members/update | Update members of Security groups and Microsoft 365 groups, excluding role-assignable groups |
| microsoft.directory/groups/onPremWriteBack/update | Update Microsoft Entra groups to be written back to on-premises with Microsoft Entra Connect |
| microsoft.directory/groups/owners/update | Update owners of Security groups and Microsoft 365 groups, excluding role-assignable groups |
| microsoft.directory/groups/reprocessLicenseAssignment | Reprocess license assignments for group-based licensing |
| microsoft.directory/groups/restore | Restore groups from soft-deleted container |
| microsoft.directory/groups/settings/update | Update settings of groups |
| microsoft.directory/groups/visibility/update | Update the visibility property of Security groups and Microsoft 365 groups, excluding role-assignable groups |
| microsoft.office365.serviceHealth/allEntities/allTasks | Read and configure Service Health in the Microsoft 365 admin center |
| microsoft.office365.supportTickets/allEntities/allTasks | Create and manage Microsoft 365 service requests |
| microsoft.office365.webPortal/allEntities/standard/read | Read basic properties on all resources in the Microsoft 365 admin center |