Microsoft Entra roles

Find built-in roles, understand their documented resource actions, and follow changes to the public reference.

Source and coverage · 136 documented roles

Baseline 22 Oct 2026. Changes compare accepted reference reads, not tenant assignments or effective access. Full collection limits

Saved searches 0

Keep up to eight named searches. Saved in this browser. Filters are also shareable in the page address.

Roles by documented action

657 matching action patterns

Search an action or its description to find roles that list it. Wildcards are shown literally; assignments and effective access are outside this catalog.

Action	Roles listing this action
microsoft.directory/authorizationPolicy/allProperties/allTasksOpen history across roles	Global Administrator Privileged Role Administrator
microsoft.directory/authorizationPolicy/standard/readOpen history across roles	Azure Information Protection Administrator Cloud Device Administrator Compliance Data Administrator Desktop Analytics Administrator Global Reader Kaizala Administrator License Administrator Security Administrator Security Operator Security Reader Teams Administrator Teams Communications Administrator Teams Communications Support Engineer Teams Communications Support Specialist Teams External Collaboration Administrator Teams Telephony Administrator
microsoft.directory/azureManagedIdentities/customSecurityAttributes/readOpen history across roles	Attribute Assignment Administrator Attribute Assignment Reader
microsoft.directory/azureManagedIdentities/customSecurityAttributes/updateOpen history across roles	Attribute Assignment Administrator
microsoft.directory/b2cTrustFrameworkKeySet/allProperties/allTasksOpen history across roles	B2C IEF Keyset Administrator
microsoft.directory/b2cTrustFrameworkPolicy/allProperties/allTasksOpen history across roles	B2C IEF Policy Administrator
microsoft.directory/b2cUserAttribute/allProperties/allTasksOpen history across roles	External ID User Flow Attribute Administrator
microsoft.directory/b2cUserFlow/allProperties/allTasksOpen history across roles	External ID User Flow Administrator
microsoft.directory/backup/preview/cancelOpen history across roles	Entra Backup Administrator Entra Backup Reader Global Administrator
microsoft.directory/backup/preview/createOpen history across roles	Entra Backup Administrator Entra Backup Reader Global Administrator
microsoft.directory/backup/recovery/cancelOpen history across roles	Entra Backup Administrator Global Administrator
microsoft.directory/backup/recovery/createOpen history across roles	Entra Backup Administrator Global Administrator
microsoft.directory/backup/standard/readOpen history across roles	Entra Backup Administrator Entra Backup Reader Global Administrator
microsoft.directory/bitlockerKeys/key/readOpen history across roles	Cloud Device Administrator Global Administrator Global Reader Helpdesk Administrator Intune Administrator Security Administrator Security Reader
microsoft.directory/bulkJobs.groups/basic/updateOpen history across roles	Groups Administrator
microsoft.directory/bulkJobs.groups/createOpen history across roles	Groups Administrator
microsoft.directory/bulkJobs.groups/standard/readOpen history across roles	Groups Administrator
microsoft.directory/bulkJobs/basic/updateOpen history across roles	Global Administrator
microsoft.directory/bulkJobs/createOpen history across roles	Global Administrator
microsoft.directory/certificateBasedDeviceAuthConfigurations/createOpen history across roles	IoT Device Administrator
microsoft.directory/certificateBasedDeviceAuthConfigurations/credentials/updateOpen history across roles	IoT Device Administrator
microsoft.directory/certificateBasedDeviceAuthConfigurations/deleteOpen history across roles	IoT Device Administrator
microsoft.directory/certificateBasedDeviceAuthConfigurations/standard/readOpen history across roles	IoT Device Administrator
microsoft.directory/cloudAppSecurity/allProperties/allTasksOpen history across roles	Cloud App Security Administrator Compliance Data Administrator Global Administrator Security Operator
microsoft.directory/cloudAppSecurity/allProperties/readOpen history across roles	Global Reader