Recorded 22 Oct 2026 at 18:59 UTC. This is what ChangeIntel recorded, including the title, summary, facts and links. It is not a statement of the source's current position. See the latest record.

Microsoft Entra roleMicrosoft Learn

User Administrator

Can manage all aspects of users and groups, including resetting passwords for limited admins.

Cite this recorded revision

What it said

Permission coverage: Documented resource actions
Action: microsoft.azure.serviceHealth/allEntities/allTasks: Read and configure Azure Service Health
Action: microsoft.azure.supportTickets/allEntities/allTasks: Create and manage Azure support tickets
Action: microsoft.directory/accessReviews/definitions.applications/allProperties/allTasks: Manage access reviews of application role assignments in Microsoft Entra ID
Action: microsoft.directory/accessReviews/definitions.directoryRoles/allProperties/read: Read all properties of access reviews for Microsoft Entra role assignments
Action: microsoft.directory/accessReviews/definitions.entitlementManagement/allProperties/allTasks: Manage access reviews for access package assignments in entitlement management
Action: microsoft.directory/accessReviews/definitions.groups/allProperties/read: Read all properties of access reviews for membership in Security and Microsoft 365 groups, including role-assignable groups.
Action: microsoft.directory/accessReviews/definitions.groups/allProperties/update: Update all properties of access reviews for membership in Security and Microsoft 365 groups, excluding role-assignable groups.
Action: microsoft.directory/accessReviews/definitions.groups/create: Create access reviews for membership in Security and Microsoft 365 groups.
Action: microsoft.directory/accessReviews/definitions.groups/delete: Delete access reviews for membership in Security and Microsoft 365 groups.
Action: microsoft.directory/contacts/basic/update: Update basic properties on contacts
Action: microsoft.directory/contacts/create: Create contacts
Action: microsoft.directory/contacts/delete: Delete contacts
Action: microsoft.directory/deletedItems.groups/restore: Restore soft deleted groups to original state
Action: microsoft.directory/deletedItems.users/restore: Restore soft deleted users to original state
Action: microsoft.directory/entitlementManagement/allProperties/allTasks: Create and delete resources, and read and update all properties in Microsoft Entra entitlement management
Action: microsoft.directory/groups.unified/assignedLabels/update: Update the assigned labels property on Microsoft 365 groups of assigned membership type, excluding role-assignable groups
Action: microsoft.directory/groups/assignLicense: Assign product licenses to groups for group-based licensing
Action: microsoft.directory/groups/basic/update: Update basic properties on Security groups and Microsoft 365 groups, excluding role-assignable groups
Action: microsoft.directory/groups/classification/update: Update the classification property on Security groups and Microsoft 365 groups, excluding role-assignable groups
Action: microsoft.directory/groups/create: Create Security groups and Microsoft 365 groups, excluding role-assignable groups
Action: microsoft.directory/groups/delete: Delete Security groups and Microsoft 365 groups, excluding role-assignable groups
Action: microsoft.directory/groups/dynamicMembershipRule/update: Update the dynamic membership rule on Security groups and Microsoft 365 groups, excluding role-assignable groups
Action: microsoft.directory/groups/groupType/update: Update properties that would affect the group type of Security groups and Microsoft 365 groups, excluding role-assignable groups
Action: microsoft.directory/groups/hiddenMembers/read: Read hidden members of Security groups and Microsoft 365 groups, including role-assignable groups
Action: microsoft.directory/groups/members/update: Update members of Security groups and Microsoft 365 groups, excluding role-assignable groups
Action: microsoft.directory/groups/onPremWriteBack/update: Update Microsoft Entra groups to be written back to on-premises with Microsoft Entra Connect
Action: microsoft.directory/groups/owners/update: Update owners of Security groups and Microsoft 365 groups, excluding role-assignable groups
Action: microsoft.directory/groups/reprocessLicenseAssignment: Reprocess license assignments for group-based licensing
Action: microsoft.directory/groups/restore: Restore groups from soft-deleted container
Action: microsoft.directory/groups/settings/update: Update settings of groups
Action: microsoft.directory/groups/visibility/update: Update the visibility property of Security groups and Microsoft 365 groups, excluding role-assignable groups
Action: microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks: Create and delete OAuth 2.0 permission grants, and read and update all properties
Action: microsoft.directory/onPremisesSynchronization/standard/read: Read standard on-premises directory synchronization information
Action: microsoft.directory/policies/standard/read: Read basic properties on policies
Action: microsoft.directory/servicePrincipals/appRoleAssignedTo/update: Update service principal role assignments
Action: microsoft.directory/users/assignLicense: Manage user licenses
Action: microsoft.directory/users/basic/update: Update basic properties on users
Action: microsoft.directory/users/convertExternalToInternalMemberUser: Convert external user to internal user
Action: microsoft.directory/users/create: Add users
Action: microsoft.directory/users/delete: Delete users
Action: microsoft.directory/users/disable: Disable users
Action: microsoft.directory/users/enable: Enable users
Action: microsoft.directory/users/invalidateAllRefreshTokens: Force sign-out by invalidating user refresh tokens
Action: microsoft.directory/users/inviteGuest: Invite guest users
Action: microsoft.directory/users/lifeCycleInfo/read: Read lifecycle information of users, such as employeeLeaveDateTime
Action: microsoft.directory/users/manager/update: Update manager for users
Action: microsoft.directory/users/password/update: Reset passwords for all users
Action: microsoft.directory/users/photo/update: Update photo of users
Action: microsoft.directory/users/reprocessLicenseAssignment: Reprocess license assignments for users
Action: microsoft.directory/users/restore: Restore deleted users
Action: microsoft.directory/users/sponsors/update: Update sponsors of users
Action: microsoft.directory/users/usageLocation/update: Update usage location of users
Action: microsoft.directory/users/userPrincipalName/update: Update User Principal Name of users
Action: microsoft.office365.serviceHealth/allEntities/allTasks: Read and configure Service Health in the Microsoft 365 admin center
Action: microsoft.office365.supportTickets/allEntities/allTasks: Create and manage Microsoft 365 service requests
Action: microsoft.office365.webPortal/allEntities/standard/read: Read basic properties on all resources in the Microsoft 365 admin center