Microsoft Entra roles

Find built-in roles, understand their documented resource actions, and follow changes to the public reference.

Source and coverage · 136 documented roles

Baseline 22 Oct 2026. Changes compare accepted reference reads, not tenant assignments or effective access. Full collection limits

Saved searches 0

Keep up to eight named searches. Saved in this browser. Filters are also shareable in the page address.

Roles by documented action

657 matching action patterns

Search an action or its description to find roles that list it. Wildcards are shown literally; assignments and effective access are outside this catalog.

Action	Roles listing this action
microsoft.directory/servicePrincipals/getPasswordSingleSignOnCredentialsOpen history across roles	Application Administrator Cloud Application Administrator
microsoft.directory/servicePrincipals/managePasswordSingleSignOnCredentialsOpen history across roles	Application Administrator Cloud Application Administrator
microsoft.directory/servicePrincipals/managePermissionGrantsForAll.microsoft-application-adminOpen history across roles	Application Administrator Cloud Application Administrator
microsoft.directory/servicePrincipals/managePermissionGrantsForAll.microsoft-company-adminOpen history across roles	Global Administrator Privileged Role Administrator
microsoft.directory/servicePrincipals/memberOf/readOpen history across roles	AI Reader Directory Readers
microsoft.directory/servicePrincipals/notes/updateOpen history across roles	Application Administrator Cloud Application Administrator Hybrid Identity Administrator
microsoft.directory/servicePrincipals/oAuth2PermissionGrants/readOpen history across roles	AI Reader Directory Readers
microsoft.directory/servicePrincipals/ownedObjects/readOpen history across roles	AI Reader Directory Readers
microsoft.directory/servicePrincipals/owners/readOpen history across roles	AI Reader Directory Readers
microsoft.directory/servicePrincipals/owners/updateOpen history across roles	Application Administrator Cloud Application Administrator Hybrid Identity Administrator
microsoft.directory/servicePrincipals/permissions/updateOpen history across roles	Application Administrator Cloud Application Administrator Hybrid Identity Administrator Privileged Role Administrator
microsoft.directory/servicePrincipals/policies/readOpen history across roles	AI Reader Directory Readers
microsoft.directory/servicePrincipals/policies/updateOpen history across roles	Application Administrator Cloud Application Administrator Hybrid Identity Administrator Security Administrator
microsoft.directory/servicePrincipals/standard/readOpen history across roles	Agent ID Developer AI Reader Directory Readers
microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/credentials/manageOpen history across roles	Directory Writers Global Administrator Hybrid Identity Administrator
microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/jobs/manageOpen history across roles	Directory Writers Global Administrator Hybrid Identity Administrator
microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/schema/manageOpen history across roles	Directory Writers Global Administrator Hybrid Identity Administrator
microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/credentials/manageOpen history across roles	Application Administrator Cloud Application Administrator Directory Writers Global Administrator Hybrid Identity Administrator
microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/jobs/manageOpen history across roles	Application Administrator Cloud Application Administrator Directory Writers Global Administrator Hybrid Identity Administrator
microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/schema/manageOpen history across roles	Application Administrator Cloud Application Administrator Directory Writers Global Administrator Hybrid Identity Administrator
microsoft.directory/servicePrincipals/synchronization.customSecurityAttributes/schema/readOpen history across roles	Attribute Provisioning Administrator Attribute Provisioning Reader
microsoft.directory/servicePrincipals/synchronization.customSecurityAttributes/schema/updateOpen history across roles	Attribute Provisioning Administrator
microsoft.directory/servicePrincipals/synchronization/standard/readOpen history across roles	Application Administrator Cloud Application Administrator Global Administrator Global Reader Hybrid Identity Administrator
microsoft.directory/servicePrincipals/synchronizationCredentials/manageOpen history across roles	Application Administrator Cloud Application Administrator Directory Writers Hybrid Identity Administrator
microsoft.directory/servicePrincipals/synchronizationJobs/manageOpen history across roles	Application Administrator Cloud Application Administrator Directory Writers Hybrid Identity Administrator