← All Roles

Conditional Access Administrator

PrivilegedEnabled
Versionv1
Date Added2026-06-21
Categoryidentity,securityAndCompliance
Assignment Modeallowed
Built-inYes
Template IDb1be1c3e-b65d-4f19-8427-f6fa0d97feb9

Description

Can manage Conditional Access capabilities.

Details

Users with this role have the ability to manage Microsoft Entra Conditional Access settings. Note: To deploy Exchange ActiveSync Conditional Access policy in Azure, the user must also be Global Administrator.

Directory Actions13

ActionCondition
microsoft.directory/conditionalAccessPolicies/basic/updatenull
microsoft.directory/conditionalAccessPolicies/createnull
microsoft.directory/conditionalAccessPolicies/deletenull
microsoft.directory/conditionalAccessPolicies/owners/readnull
microsoft.directory/conditionalAccessPolicies/owners/updatenull
microsoft.directory/conditionalAccessPolicies/policyAppliedTo/readnull
microsoft.directory/conditionalAccessPolicies/standard/readnull
microsoft.directory/conditionalAccessPolicies/tenantDefault/updatenull
microsoft.directory/namedLocations/basic/updatenull
microsoft.directory/namedLocations/createnull
microsoft.directory/namedLocations/deletenull
microsoft.directory/namedLocations/standard/readnull
microsoft.directory/resourceNamespaces/resourceActions/authenticationContext/updatenull

Graph API Permissions6

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

  • Policy.Read.All
  • Policy.Read.ConditionalAccess
  • Policy.ReadWrite.AuthenticationMethod
  • Policy.ReadWrite.ConditionalAccess
  • RoleManagement.Read.Directory
  • RoleManagement.ReadWrite.Directory