Microsoft Entra roles

Find built-in roles, understand their documented resource actions, and follow changes to the public reference.

Source and coverage · 136 documented roles

Baseline 22 Oct 2026. Changes compare accepted reference reads, not tenant assignments or effective access. Full collection limits

Saved searches 0

Keep up to eight named searches. Saved in this browser. Filters are also shareable in the page address.

Roles by documented action

657 matching action patterns

Search an action or its description to find roles that list it. Wildcards are shown literally; assignments and effective access are outside this catalog.

Action	Roles listing this action
microsoft.directory/namedLocations/standard/readOpen history across roles	Conditional Access Administrator Global Administrator Global Reader Global Secure Access Administrator Security Administrator Security Reader
microsoft.directory/oAuth2PermissionGrants/allProperties/allTasksOpen history across roles	Application Administrator Cloud Application Administrator Global Administrator Partner Tier1 Support Partner Tier2 Support Privileged Role Administrator User Administrator
microsoft.directory/oAuth2PermissionGrants/allProperties/readOpen history across roles	Global Reader
microsoft.directory/oAuth2PermissionGrants/basic/updateOpen history across roles	Directory Writers
microsoft.directory/oAuth2PermissionGrants/createOpen history across roles	Directory Writers
microsoft.directory/oAuth2PermissionGrants/createAsOwnerOpen history across roles	Application Developer
microsoft.directory/oAuth2PermissionGrants/standard/readOpen history across roles	AI Reader Directory Readers
microsoft.directory/onPasswordSubmitCustomAuthenticationExtension/allProperties/allTasksOpen history across roles	Authentication Extensibility Password Administrator
microsoft.directory/onPremisesSynchronization/basic/updateOpen history across roles	Global Administrator Hybrid Identity Administrator
microsoft.directory/onPremisesSynchronization/standard/readOpen history across roles	Directory Synchronization Accounts Exchange Administrator Global Administrator Global Reader Hybrid Identity Administrator User Administrator
microsoft.directory/organization/allProperties/allTasksOpen history across roles	Global Administrator
microsoft.directory/organization/allProperties/readOpen history across roles	Global Reader
microsoft.directory/organization/basic/updateOpen history across roles	Billing Administrator Partner Tier2 Support
microsoft.directory/organization/dirSync/updateOpen history across roles	Hybrid Identity Administrator
microsoft.directory/organization/standard/readOpen history across roles	Agent ID Administrator AI Reader Directory Readers Dynamics 365 Business Central Administrator
microsoft.directory/organization/strongAuthentication/allTasksOpen history across roles	Authentication Policy Administrator
microsoft.directory/organization/strongAuthentication/readOpen history across roles	Lifecycle Workflows Administrator
microsoft.directory/organization/trustedCAsForPasswordlessAuth/readOpen history across roles	AI Reader Directory Readers
microsoft.directory/passwordHashSync/allProperties/allTasksOpen history across roles	Global Administrator Hybrid Identity Administrator
microsoft.directory/pendingExternalUserProfiles/basic/updateOpen history across roles	Extended Directory User Administrator Global Administrator Teams Administrator
microsoft.directory/pendingExternalUserProfiles/createOpen history across roles	Extended Directory User Administrator Global Administrator Teams Administrator
microsoft.directory/pendingExternalUserProfiles/deleteOpen history across roles	Extended Directory User Administrator Global Administrator Teams Administrator
microsoft.directory/pendingExternalUserProfiles/standard/readOpen history across roles	Extended Directory User Administrator Global Administrator Global Reader Teams Administrator
microsoft.directory/permissionGrantPolicies/allProperties/readOpen history across roles	Privileged Role Administrator
microsoft.directory/permissionGrantPolicies/allProperties/updateOpen history across roles	Privileged Role Administrator