← All Roles

Authentication Extensibility Password Administrator

PrivilegedEnabled
Versionv5
Last Updated2026-08-07
Categoryidentity
Assignment Modeallowed
Built-inYes
Template ID0b00bede-4072-4d22-b441-e7df02a1ef63

Description

Trigger a password submit event for custom authentication.

Details

Assign the Authentication Extensibility Password Administrator role to users who need to do the following tasks:

  • Trigger a password submit event for custom authentication to migrate user passwords from an external identity system to Microsoft Entra External ID

Directory Actions1

  • microsoft.directory/onPasswordSubmitCustomAuthenticationExtension/allProperties/allTasks

Graph API Permissions2

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

  • CustomAuthenticationExtension.Read.All
  • CustomAuthenticationExtension.ReadWrite.All