Microsoft Entra roles

Find built-in roles, understand their documented resource actions, and follow changes to the public reference.

Source and coverage · 136 documented roles

Baseline 22 Oct 2026. Changes compare accepted reference reads, not tenant assignments or effective access. Full collection limits

Saved searches 0

Keep up to eight named searches. Saved in this browser. Filters are also shareable in the page address.

Roles by documented action

657 matching action patterns

Search an action or its description to find roles that list it. Wildcards are shown literally; assignments and effective access are outside this catalog.

Action	Roles listing this action
microsoft.directory/users/licenseDetails/readOpen history across roles	Directory Readers Guest Inviter
microsoft.directory/users/lifeCycleInfo/readOpen history across roles	Lifecycle Workflows Administrator User Administrator
microsoft.directory/users/manager/readOpen history across roles	Directory Readers Guest Inviter
microsoft.directory/users/manager/updateOpen history across roles	Authentication Administrator Directory Writers Intune Administrator Partner Tier1 Support Partner Tier2 Support Privileged Authentication Administrator User Administrator
microsoft.directory/users/memberOf/readOpen history across roles	Directory Readers Guest Inviter
microsoft.directory/users/oAuth2PermissionGrants/readOpen history across roles	Directory Readers Guest Inviter
microsoft.directory/users/ownedDevices/readOpen history across roles	Directory Readers Guest Inviter
microsoft.directory/users/ownedObjects/readOpen history across roles	Directory Readers Guest Inviter
microsoft.directory/users/password/updateOpen history across roles	Authentication Administrator Entra SOC Identity Responder Helpdesk Administrator Partner Tier1 Support Partner Tier2 Support Password Administrator Privileged Authentication Administrator Security Operator User Administrator
microsoft.directory/users/photo/readOpen history across roles	Directory Readers Guest Inviter
microsoft.directory/users/photo/updateOpen history across roles	Directory Writers Intune Administrator Partner Tier1 Support Partner Tier2 Support User Administrator
microsoft.directory/users/registeredDevices/readOpen history across roles	Directory Readers Guest Inviter
microsoft.directory/users/reprocessLicenseAssignmentOpen history across roles	Directory Writers License Administrator User Administrator
microsoft.directory/users/restoreOpen history across roles	Authentication Administrator Partner Tier1 Support Partner Tier2 Support Privileged Authentication Administrator User Administrator
microsoft.directory/users/scopedRoleMemberOf/readOpen history across roles	Directory Readers Guest Inviter
microsoft.directory/users/sponsorOf/readOpen history across roles	Directory Readers Guest Inviter
microsoft.directory/users/sponsors/readOpen history across roles	Directory Readers Guest Inviter
microsoft.directory/users/sponsors/updateOpen history across roles	Directory Writers User Administrator
microsoft.directory/users/standard/readOpen history across roles	Directory Readers Dynamics 365 Business Central Administrator Guest Inviter
microsoft.directory/users/usageLocation/updateOpen history across roles	License Administrator User Administrator
microsoft.directory/users/userPrincipalName/updateOpen history across roles	Authentication Administrator Directory Writers Partner Tier1 Support Partner Tier2 Support Privileged Authentication Administrator User Administrator
microsoft.directory/verifiableCredentials/configuration/allProperties/readOpen history across roles	Authentication Policy Administrator Global Administrator Global Reader
microsoft.directory/verifiableCredentials/configuration/allProperties/updateOpen history across roles	Authentication Policy Administrator Global Administrator
microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/readOpen history across roles	Authentication Policy Administrator Global Administrator Global Reader
microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/updateOpen history across roles	Authentication Policy Administrator Global Administrator