Domain Name Administrator

Description

Can manage domain names in cloud and on-premises.

Details

For on-premises environments, users can configure domain names for federation so that associated users are always authenticated on-premises (these users can then sign into Microsoft Entra based services with their on-premises passwords via single sign-on). Federation settings need to be synced via AADConnect, so users also have permissions to manage AADConnect.

Directory Actions3

• microsoft.directory/domains/allProperties/allTasks
• microsoft.office365.supportTickets/allEntities/allTasks
• microsoft.office365.webPortal/allEntities/standard/read

Graph API Permissions4

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

• Directory.Read.All
• Domain-InternalFederation.ReadWrite.All
• Domain.Read.All
• Domain.ReadWrite.All