Microsoft Entra roles
Find built-in roles, understand their documented resource actions, and follow changes to the public reference.
What this catalog covers
136 built-in roles listed in Microsoft's public Entra permissions reference; 132 have action tables.
Baseline: 22 Oct 2026. Last accepted reference: 22 Oct 2026. Last successful check: 22 Oct 2026.
Collection health and retry details.
The first read establishes a quiet baseline. Later reads compare stable template GUIDs, names, descriptions, documented actions and privileged labels. Up to 1,000 changes are retained; earlier or intermediate edits are unknown. “No longer listed” describes this reference, not deletion from a tenant.
These public definitions do not establish assignments, PIM eligibility, effective permissions, or availability in a particular cloud. Azure RBAC, Exchange, Intune and Defender role catalogs are separate. Resource actions here are not Microsoft Graph OAuth scopes.
Only an explicit privileged label is reported; an absent label does not establish that a role is safe. A missing action table means permissions are not established by this reference.
Microsoft's role reference