← All Roles

Extended Directory User Administrator

Enabled
Versionv1
Date Added2026-06-21
Categorycollaboration,identity
Assignment Modeallowed
Built-inYes
Template IDdd13091a-6207-4fc0-82ba-3641e056ab95

Description

Manage all aspects of external user profiles in the extended directory for Teams.

Directory Actions7

ActionCondition
microsoft.directory/externalUserProfiles/basic/updatenull
microsoft.directory/externalUserProfiles/deletenull
microsoft.directory/externalUserProfiles/standard/readnull
microsoft.directory/pendingExternalUserProfiles/basic/updatenull
microsoft.directory/pendingExternalUserProfiles/createnull
microsoft.directory/pendingExternalUserProfiles/deletenull
microsoft.directory/pendingExternalUserProfiles/standard/readnull

Graph API Permissions4

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

  • ExternalUserProfile.Read.All
  • ExternalUserProfile.ReadWrite.All
  • PendingExternalUserProfile.Read.All
  • PendingExternalUserProfile.ReadWrite.All