← All Roles

Device Managers

Enabled
Versionv1
Date Added2026-06-21
Categorydevices
Assignment Modeallowed
Built-inYes
Template ID2b499bcd-da44-4968-8aec-78e1674fa64d

Description

Deprecated - Do Not Use.

Directory Actions10

ActionCondition
microsoft.directory/devices/basic/updatenull
microsoft.directory/devices/extensionAttributeSet1/updatenull
microsoft.directory/devices/extensionAttributeSet2/updatenull
microsoft.directory/devices/extensionAttributeSet3/updatenull
microsoft.directory/devices/memberOf/readnull
microsoft.directory/devices/registeredOwners/readnull
microsoft.directory/devices/registeredOwners/updatenull
microsoft.directory/devices/registeredUsers/readnull
microsoft.directory/devices/registeredUsers/updatenull
microsoft.directory/devices/standard/readnull

Graph API Permissions5

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

  • Device.CreateFromOwnedTemplate
  • Device.Read.All
  • DeviceLocalCredential.ReadBasic.All
  • DeviceTemplate.Read.All
  • DeviceTemplate.ReadWrite.All