← All Roles

Attribute Provisioning Administrator

PrivilegedEnabled
Versionv1
Date Added2026-06-21
Categoryidentity
Assignment Modeallowed
Built-inYes
Template IDecb2c6bf-0ab6-418e-bd87-7986f8d63bbe

Description

Read and edit the provisioning configuration of all active custom security attributes for an application.

Directory Actions2

ActionCondition
microsoft.directory/servicePrincipals/synchronization.customSecurityAttributes/schema/readnull
microsoft.directory/servicePrincipals/synchronization.customSecurityAttributes/schema/updatenull

Graph API Permissions5

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

  • Application.Read.All
  • Application.ReadWrite.All
  • AppRoleAssignment.ReadWrite.All
  • ServicePrincipalEndpoint.Read.All
  • ServicePrincipalEndpoint.ReadWrite.All