Conditional Access Administrator

Description

Can manage Conditional Access capabilities.

Details

Users with this role have the ability to manage Microsoft Entra Conditional Access settings. Note: To deploy Exchange ActiveSync Conditional Access policy in Azure, the user must also be Global Administrator.

Directory Actions13

• microsoft.directory/conditionalAccessPolicies/basic/update
• microsoft.directory/conditionalAccessPolicies/create
• microsoft.directory/conditionalAccessPolicies/delete
• microsoft.directory/conditionalAccessPolicies/owners/read
• microsoft.directory/conditionalAccessPolicies/owners/update
• microsoft.directory/conditionalAccessPolicies/policyAppliedTo/read
• microsoft.directory/conditionalAccessPolicies/standard/read
• microsoft.directory/conditionalAccessPolicies/tenantDefault/update
• microsoft.directory/namedLocations/basic/update
• microsoft.directory/namedLocations/create
• microsoft.directory/namedLocations/delete
• microsoft.directory/namedLocations/standard/read
• microsoft.directory/resourceNamespaces/resourceActions/authenticationContext/update

Graph API Permissions6

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

• Policy.Read.All
• Policy.Read.ConditionalAccess
• Policy.ReadWrite.AuthenticationMethod
• Policy.ReadWrite.ConditionalAccess
• RoleManagement.Read.Directory
• RoleManagement.ReadWrite.Directory