Authentication Policy Administrator

Description

Can create and manage the authentication methods policy, tenant-wide MFA settings, password protection policy, and verifiable credentials.

Details

Users in this role can create, deploy, and maintain password protection policies and configure authentication methods in a tenant. An Authentication policy administrator can perform the following tasks - manage authentication method settings; configure smart lockout settings; manage a custom banned password list. Users in this role cannot set, change, or reset any individual users' registered authentication methods. This role is intended for managing policy rather than managing users. For example, an Authentication policy administrator will be able to configure that passwords are required to be registered, and the lockout policy for those passwords, but will not be able to reset a user's password.

Directory Actions19

• microsoft.azure.supportTickets/allEntities/allTasks
• microsoft.directory/organization/strongAuthentication/allTasks
• microsoft.directory/userCredentialPolicies/basic/update
• microsoft.directory/userCredentialPolicies/create
• microsoft.directory/userCredentialPolicies/delete
• microsoft.directory/userCredentialPolicies/owners/read
• microsoft.directory/userCredentialPolicies/owners/update
• microsoft.directory/userCredentialPolicies/policyAppliedTo/read
• microsoft.directory/userCredentialPolicies/standard/read
• microsoft.directory/userCredentialPolicies/tenantDefault/update
• microsoft.directory/verifiableCredentials/configuration/allProperties/read
• microsoft.directory/verifiableCredentials/configuration/allProperties/update
• microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/read
• microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/update
• microsoft.directory/verifiableCredentials/configuration/contracts/cards/allProperties/read
• microsoft.directory/verifiableCredentials/configuration/contracts/cards/revoke
• microsoft.directory/verifiableCredentials/configuration/contracts/create
• microsoft.directory/verifiableCredentials/configuration/create
• microsoft.directory/verifiableCredentials/configuration/delete

Graph API Permissions8

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

• Organization.Read.All
• Organization.ReadWrite.All
• Policy.Read.All
• Policy.ReadWrite.AuthenticationMethod
• UserAuthenticationMethod.Read.All
• UserAuthenticationMethod.ReadWrite.All
• VerifiedId-Profile.Read.All
• VerifiedId-Profile.ReadWrite.All