Roles and permissions
Microsoft's documented built-in roles and permissions for each admin system, and the changes observed in each public reference.
Source and coverage · 139 documented roles
Baseline 22 Oct 2026. Changes compare accepted reference reads or explicitly labeled public source commits. They do not establish tenant assignments or effective access. Full collection limits
Saved searches 0
Keep up to eight named searches. Saved in this browser. Filters are also shareable in the page address.
Recently changed roles
23 matching roles- Resource Policy Administrator12 actionsCan manage resource policy definitions, assignments, tenant-wide configuration, and evaluation.Changed: 13 Nov 2026 00:53 UTC
- Resource Policy Evaluator1 actionCan evaluate a supplied resource policy without reading or changing policy definitions or assignments.Changed: 13 Nov 2026 00:53 UTC
- Resource Policy Reader5 actionsCan read resource policy definitions, assignments, and tenant-wide configuration, and evaluate policies without making changes.Changed: 13 Nov 2026 00:53 UTC
- Tenant Governance Administrator24 actionsPrivilegedManage all capabilities in the Microsoft Entra Tenant Governance service.Changed: 28 Oct 2026 14:53 UTC
- Application Developer18 actionsPrivilegedCan create application registrations independent of the 'Users can register applications' setting and update applications they own.Changed: 23 Oct 2026 19:54 UTC
- AI Administrator70 actionsPrivilegedManage all aspects of Microsoft Copilot and AI-related enterprise services in Microsoft 365.Changed: 10 Sep 2026 17:45 UTC
- AI Reader45 actionsPrivilegedRead all aspects of Microsoft Copilot and AI-related enterprise services in Microsoft 365.Changed: 10 Sep 2026 17:45 UTC
- Entra SOC Identity Responder4 actionsPrivilegedPerform identity containment actions for SOC incident response, including disabling users, revoking active sign-in sessions, and resetting passwords.Changed: 3 Sep 2026 22:37 UTC
- Security Operator17 actionsPrivilegedCreates and manages security events and performs identity containment actions during security incidents.Changed: 9 Jul 2026 19:55 UTC
- Purview Workload Content AdministratorNo action tableManage or purge data from Microsoft 365 when accessing from the Microsoft Purview portal.Changed: 19 Jun 2026 21:21 UTC
- Purview Workload Content ReaderNo action tableRead data from Microsoft 365 when accessing from the Microsoft Purview portal.Changed: 19 Jun 2026 21:21 UTC
- Purview Workload Content WriterNo action tableRead and edit data from Microsoft 365 when accessing from the Microsoft Purview portal.Changed: 19 Jun 2026 21:21 UTC
- Agent ID Administrator64 actionsPrivilegedManage all aspects of agents in a tenant including identity lifecycle operations for agent blueprints, agent identity blueprint principals, agent identities, and agentic users.Changed: 21 May 2026 11:17 UTC
- Identity Governance Administrator10 actionsPrivilegedManage access using Microsoft Entra ID for identity governance scenarios.Changed: 21 May 2026 11:17 UTC
- Agent ID Developer2 actionsCreate an agent identity blueprint and its agent identity blueprint principal in a tenant. User will be added as an owner of the created agent identity blueprint and its agent identity blueprint principal.Changed: 29 Apr 2026 11:50 UTC
- Azure DevOps Administrator1 actionManage Azure DevOps policies and settings.Changed: 22 Apr 2026 13:43 UTC
- Cloud App Security Administrator2 actionsManage all aspects of the Defender for Cloud Apps product.Changed: 22 Apr 2026 13:43 UTC
- Customer Delegated Admin Relationship Administrator2 actionsManage all aspects of granular delegated admin privileges (GDAP) relationships in a customer tenant.Changed: 22 Apr 2026 13:43 UTC
- Fabric Administrator6 actionsManage all aspects of the Fabric and Power BI products.Changed: 22 Apr 2026 13:43 UTC
- Insights Business Leader2 actionsView and share dashboards and insights via the Microsoft Viva Insights app.Changed: 22 Apr 2026 13:43 UTC
- Knowledge Manager11 actionsOrganize, create, manage, and promote topics and knowledge.Changed: 22 Apr 2026 13:43 UTC
- Power Platform Administrator8 actionsManage all aspects of Microsoft Dynamics 365, Power Apps and Power Automate.Changed: 22 Apr 2026 13:43 UTC
- Teams External Collaboration Administrator4 actionsManage external collaboration policies and settings for Teams, including configuring external domains and controlling which groups and users can interact with the organization.Changed: 23 Mar 2026 14:11 UTC