← All Roles

AI Administrator

PrivilegedEnabled
Versionv8
Last Updated2026-09-12
Categorycollaboration,identity
Assignment Modeallowed
Built-inYes
Template IDd2562ede-74db-457e-a7b6-544e236ebb61

Description

Manage all aspects of Microsoft 365 Copilot and AI-related enterprise services in Microsoft 365.

Details

Assign the AI Administrator role to users who need to do the following tasks:

  • Manage all aspects of Microsoft 365 Copilot
  • Manage AI-related enterprise services, extensibility, and copilot agents from the Integrated apps page in the Microsoft 365 admin center
  • Manage admin consent request policies in Microsoft Entra ID
  • Approve and publish line-of-business copilot agents
  • Allow users to install an app or install an app for users in the organization if the app does not require permission
  • Read and configure Azure and Microsoft 365 service health dashboards
  • View usage reports, adoption insights, and organizational insight
  • Create and manage support tickets in Azure and the Microsoft 365 admin center
  • Manage the full lifecycle of agent identities, agent identity blueprints, agent identity blueprint principals, and agent users including restoration of deleted items

Directory Actions70

ActionCondition
microsoft.azure.serviceHealth/allEntities/allTasksnull
microsoft.azure.supportTickets/allEntities/allTasksnull
microsoft.directory/adminConsentRequestPolicy/allProperties/allTasksnull
microsoft.directory/agentIdentities/allProperties/readnull
microsoft.directory/agentIdentities/appRoleAssignedTo/updatenull
microsoft.directory/agentIdentities/authentication/updatenull
microsoft.directory/agentIdentities/basic/updatenull
microsoft.directory/agentIdentities/createnull
microsoft.directory/agentIdentities/deletenull
microsoft.directory/agentIdentities/disablenull
microsoft.directory/agentIdentities/enablenull
microsoft.directory/agentIdentities/owners/updatenull
microsoft.directory/agentIdentities/tag/updatenull
microsoft.directory/agentIdentityBlueprintPrincipals/allProperties/readnull
microsoft.directory/agentIdentityBlueprintPrincipals/appRoleAssignedTo/updatenull
microsoft.directory/agentIdentityBlueprintPrincipals/authentication/updatenull
microsoft.directory/agentIdentityBlueprintPrincipals/basic/updatenull
microsoft.directory/agentIdentityBlueprintPrincipals/createnull
microsoft.directory/agentIdentityBlueprintPrincipals/deletenull
microsoft.directory/agentIdentityBlueprintPrincipals/disablenull
microsoft.directory/agentIdentityBlueprintPrincipals/enablenull
microsoft.directory/agentIdentityBlueprintPrincipals/owners/updatenull
microsoft.directory/agentIdentityBlueprintPrincipals/tag/updatenull
microsoft.directory/agentIdentityBlueprints/allProperties/readnull
microsoft.directory/agentIdentityBlueprints/allProperties/updatenull
microsoft.directory/agentIdentityBlueprints/appRoles/updatenull
microsoft.directory/agentIdentityBlueprints/audience/updatenull
microsoft.directory/agentIdentityBlueprints/authentication/updatenull
microsoft.directory/agentIdentityBlueprints/basic/updatenull
microsoft.directory/agentIdentityBlueprints/createnull
microsoft.directory/agentIdentityBlueprints/credentials/updatenull
microsoft.directory/agentIdentityBlueprints/deletenull
microsoft.directory/agentIdentityBlueprints/owners/updatenull
microsoft.directory/agentIdentityBlueprints/permissions/updatenull
microsoft.directory/agentIdentityBlueprints/tag/updatenull
microsoft.directory/agentUsers/assignLicensenull
microsoft.directory/agentUsers/basic/updatenull
microsoft.directory/agentUsers/createnull
microsoft.directory/agentUsers/deletenull
microsoft.directory/agentUsers/disablenull
microsoft.directory/agentUsers/enablenull
microsoft.directory/agentUsers/invalidateAllRefreshTokensnull
microsoft.directory/agentUsers/lifeCycleInfo/readnull
microsoft.directory/agentUsers/lifeCycleInfo/updatenull
microsoft.directory/agentUsers/manager/updatenull
microsoft.directory/agentUsers/photo/updatenull
microsoft.directory/agentUsers/reprocessLicenseAssignmentnull
microsoft.directory/agentUsers/restorenull
microsoft.directory/agentUsers/revokeSignInSessionsnull
microsoft.directory/agentUsers/sponsors/updatenull
microsoft.directory/agentUsers/usageLocation/updatenull
microsoft.directory/agentUsers/userPrincipalName/updatenull
microsoft.directory/deletedItems.agentIdentities/deletenull
microsoft.directory/deletedItems.agentIdentities/restorenull
microsoft.directory/deletedItems.agentIdentityBlueprintPrincipals/deletenull
microsoft.directory/deletedItems.agentIdentityBlueprintPrincipals/restorenull
microsoft.directory/deletedItems.agentIdentityBlueprints/deletenull
microsoft.directory/deletedItems.agentIdentityBlueprints/restorenull
microsoft.directory/entitlementManagement/allProperties/readnull
microsoft.directory/oAuth2PermissionGrants/allProperties/allTasksnull
microsoft.directory/subscribedSkus/standard/readnull
microsoft.directory/users/allProperties/readnull
microsoft.office365.copilot/allEntities/allProperties/allTasksnull
microsoft.office365.messageCenter/messages/readnull
microsoft.office365.network/performance/allProperties/readnull
microsoft.office365.search/content/managenull
microsoft.office365.serviceHealth/allEntities/allTasksnull
microsoft.office365.supportTickets/allEntities/allTasksnull
microsoft.office365.usageReports/allEntities/allProperties/readnull
microsoft.office365.webPortal/allEntities/standard/readnull

Graph API Permissions54

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

  • AgentIdentity.Create.All
  • AgentIdentity.DeleteRestore.All
  • AgentIdentity.EnableDisable.All
  • AgentIdentity.Read.All
  • AgentIdentity.ReadWrite.All
  • AgentIdentityBlueprint.AddRemoveCreds.All
  • AgentIdentityBlueprint.Create
  • AgentIdentityBlueprint.DeleteRestore.All
  • AgentIdentityBlueprint.Read.All
  • AgentIdentityBlueprint.ReadWrite.All
  • AgentIdentityBlueprintPrincipal.Create
  • AgentIdentityBlueprintPrincipal.DeleteRestore.All
  • AgentIdentityBlueprintPrincipal.EnableDisable.All
  • AgentIdentityBlueprintPrincipal.Read.All
  • AgentIdentityBlueprintPrincipal.ReadWrite.All
  • AgentIdUser.ReadWrite.All
  • AgentIdUser.ReadWrite.IdentityParentedBy
  • AppRoleAssignment.ReadWrite.All
  • ChangeManagement.Read.All
  • ConsentRequest.Read.All
  • ConsentRequest.ReadWrite.All
  • DelegatedPermissionGrant.Read.All
  • DelegatedPermissionGrant.ReadWrite.All
  • Directory.Read.All
  • EntitlementManagement.Read.All
  • ExternalConnection.Read.All
  • ExternalConnection.ReadWrite.All
  • ExternalConnection.ReadWrite.OwnedBy
  • ExternalItem.Read.All
  • ExternalItem.ReadWrite.All
  • ExternalItem.ReadWrite.OwnedBy
  • LicenseAssignment.Read.All
  • NetworkAccess-Reports.Read.All
  • Organization.Read.All
  • Policy.Read.All
  • Policy.Read.PermissionGrant
  • Policy.ReadWrite.ConsentRequest
  • Policy.ReadWrite.PermissionGrant
  • Reports.Read.All
  • ReportSettings.Read.All
  • SearchConfiguration.Read.All
  • SearchConfiguration.ReadWrite.All
  • ServiceActivity-Exchange.Read.All
  • ServiceActivity-Microsoft365Web.Read.All
  • ServiceActivity-OneDrive.Read.All
  • ServiceActivity-Teams.Read.All
  • ServiceHealth.Read.All
  • ServiceMessage.Read.All
  • ServiceMessageViewpoint.Write
  • SignInIdentifier.Read.All
  • User-LifeCycleInfo.Read.All
  • User.Read.All
  • User.ReadBasic.All
  • UserAuthenticationMethod.Read.All