← All Roles

Authentication Administrator

PrivilegedEnabled
Versionv1
Date Added2026-06-21
Categoryidentity
Assignment Modeallowed
Built-inYes
Template IDc4e39bd9-1100-46d3-8c65-fb160da0071f

Description

Can access to view, set and reset authentication method information for any non-admin user.

Details

Users with this role can set or reset any authentication method (including passwords) for non-administrators and some roles. Authentication Administrators can require users who are non-administrators or assigned to some roles to re-register against existing non-password credentials (for example, multifactor authentication or FIDO), and can also revoke remember multifactor authentication on the device, which prompts for MFA on the next sign-in.

Directory Actions19

ActionCondition
microsoft.azure.serviceHealth/allEntities/allTasksnull
microsoft.azure.supportTickets/allEntities/allTasksnull
microsoft.directory/deletedItems.users/restorenull
microsoft.directory/users/authenticationMethods/basic/updatenull
microsoft.directory/users/authenticationMethods/createnull
microsoft.directory/users/authenticationMethods/deletenull
microsoft.directory/users/authenticationMethods/standard/restrictedReadnull
microsoft.directory/users/basic/updatenull
microsoft.directory/users/deletenull
microsoft.directory/users/disablenull
microsoft.directory/users/enablenull
microsoft.directory/users/invalidateAllRefreshTokensnull
microsoft.directory/users/manager/updatenull
microsoft.directory/users/password/updatenull
microsoft.directory/users/restorenull
microsoft.directory/users/userPrincipalName/updatenull
microsoft.office365.serviceHealth/allEntities/allTasksnull
microsoft.office365.supportTickets/allEntities/allTasksnull
microsoft.office365.webPortal/allEntities/standard/readnull

Graph API Permissions34

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

  • ChangeManagement.Read.All
  • Directory.Read.All
  • LicenseAssignment.Read.All
  • LicenseAssignment.ReadWrite.All
  • ServiceActivity-Exchange.Read.All
  • ServiceActivity-Microsoft365Web.Read.All
  • ServiceActivity-OneDrive.Read.All
  • ServiceActivity-Teams.Read.All
  • ServiceHealth.Read.All
  • ServiceMessage.Read.All
  • ServiceMessageViewpoint.Write
  • SignInIdentifier.Read.All
  • SignInIdentifier.ReadWrite.All
  • User-ConvertToInternal.ReadWrite.All
  • User-LifeCycleInfo.Read.All
  • User-LifeCycleInfo.ReadWrite.All
  • User-Mail.ReadWrite.All
  • User-OnPremisesSyncBehavior.ReadWrite.All
  • User-PasswordProfile.ReadWrite.All
  • User.Create
  • User.DeleteRestore.All
  • User.EnableDisableAccount.All
  • User.Export.All
  • User.Invite.All
  • User.ManageIdentities.All
  • User.Read.All
  • User.ReadBasic.All
  • User.ReadWrite.All
  • User.RevokeSessions.All
  • UserAuthenticationMethod.Read.All
  • UserAuthenticationMethod.ReadWrite.All
  • UserAuthMethod-External.ReadWrite.All
  • UserAuthMethod-HardwareOATH.ReadWrite.All
  • UserAuthMethod-TAP.ReadWrite.All