Authentication Extensibility Administrator
Description
Customize sign in and sign up experiences for users by creating and managing custom authentication extensions.
Details
Users with this role can create and manage all aspects of custom authentication extensions. A custom authentication extension is an API endpoint created by a developer for authentication events and is registered in Microsoft Entra ID. Application administrators and application owners can use custom authentication extensions to customize their application's authentication experiences such as sign in and sign up, or password reset. This role does not grant the ability to apply the custom authentication extensions to applications.
Directory Actions1
microsoft.directory/customAuthenticationExtensions/allProperties/allTasks
Graph API Permissions2
Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.
CustomAuthenticationExtension.Read.AllCustomAuthenticationExtension.ReadWrite.All