Global Administrator | MS Admin Roles

← All Roles

Compare with previous version (v5)

Versionv6

Last Updated2026-07-12

Categoryglobal

Assignment Modeallowed

Built-inYes

Template ID62e90394-69f5-4237-9190-012177145e10

Attack path

Compromise of a Global Administrator gives an attacker control of almost every administrative setting in the tenant. They could weaken Conditional Access, create backdoor identities and grant persistent permissions to a workload identity, retaining access even after the original account is recovered. The role can also enable access management for Azure resources, allowing the attacker to assign Azure RBAC roles at the root scope and move from Microsoft Entra ID into subscriptions, Key Vaults and other connected services.

Description

Can manage all aspects of Microsoft Entra ID and Microsoft services that use Microsoft Entra identities.

Details

Users with this role have access to all administrative features in Microsoft Entra ID, as well as services that federate to Microsoft Entra ID like Exchange Online, SharePoint Online, and Skype for Business Online. The person who signs up for the Microsoft Entra tenant becomes a global administrator. Only global administrators can assign other administrator roles. There can be more than one global administrator at your company. Global admins can reset the password for any user and all other administrators. Note: In Microsoft Graph API, Azure AD Graph API, and Azure AD PowerShell, this role is identified as "Company Administrator". It is "Global Administrator" in the Azure portal.

Directory Actions262

Action	Condition
`microsoft.agentRegistry/allEntities/allProperties/allTasks`	`null`
`microsoft.azure.advancedThreatProtection/allEntities/allTasks`	`null`
`microsoft.azure.informationProtection/allEntities/allTasks`	`null`
`microsoft.azure.serviceHealth/allEntities/allTasks`	`null`
`microsoft.azure.supportTickets/allEntities/allTasks`	`null`
`microsoft.backup/allEntities/allProperties/allTasks`	`null`
`microsoft.cloudPC/allEntities/allProperties/allTasks`	`null`
`microsoft.commerce.billing/allEntities/allProperties/allTasks`	`null`
`microsoft.commerce.billing/purchases/standard/read`	`null`
`microsoft.commerce.tenantRelationships/customerDelegatedAdminPrivileges/allProperties/allTasks`	`null`
`microsoft.directory/accessReviews/allProperties/allTasks`	`null`
`microsoft.directory/accessReviews/definitions/allProperties/allTasks`	`null`
`microsoft.directory/adminConsentRequestPolicy/allProperties/allTasks`	`null`
`microsoft.directory/administrativeUnits/allProperties/allTasks`	`null`
`microsoft.directory/agentIdentities/allProperties/read`	`null`
`microsoft.directory/agentIdentities/appRoleAssignedTo/update`	`null`
`microsoft.directory/agentIdentities/authentication/update`	`null`
`microsoft.directory/agentIdentities/basic/update`	`null`
`microsoft.directory/agentIdentities/create`	`null`
`microsoft.directory/agentIdentities/delete`	`null`
`microsoft.directory/agentIdentities/disable`	`null`
`microsoft.directory/agentIdentities/enable`	`null`
`microsoft.directory/agentIdentities/owners/update`	`null`
`microsoft.directory/agentIdentities/tag/update`	`null`
`microsoft.directory/agentIdentityBlueprintPrincipals/allProperties/read`	`null`
`microsoft.directory/agentIdentityBlueprintPrincipals/appRoleAssignedTo/update`	`null`
`microsoft.directory/agentIdentityBlueprintPrincipals/authentication/update`	`null`
`microsoft.directory/agentIdentityBlueprintPrincipals/basic/update`	`null`
`microsoft.directory/agentIdentityBlueprintPrincipals/create`	`null`
`microsoft.directory/agentIdentityBlueprintPrincipals/delete`	`null`
`microsoft.directory/agentIdentityBlueprintPrincipals/disable`	`null`
`microsoft.directory/agentIdentityBlueprintPrincipals/enable`	`null`
`microsoft.directory/agentIdentityBlueprintPrincipals/owners/update`	`null`
`microsoft.directory/agentIdentityBlueprintPrincipals/tag/update`	`null`
`microsoft.directory/agentIdentityBlueprints/allProperties/read`	`null`
`microsoft.directory/agentIdentityBlueprints/allProperties/update`	`null`
`microsoft.directory/agentIdentityBlueprints/appRoles/update`	`null`
`microsoft.directory/agentIdentityBlueprints/audience/update`	`null`
`microsoft.directory/agentIdentityBlueprints/authentication/update`	`null`
`microsoft.directory/agentIdentityBlueprints/basic/update`	`null`
`microsoft.directory/agentIdentityBlueprints/create`	`null`
`microsoft.directory/agentIdentityBlueprints/credentials/update`	`null`
`microsoft.directory/agentIdentityBlueprints/delete`	`null`
`microsoft.directory/agentIdentityBlueprints/owners/update`	`null`
`microsoft.directory/agentIdentityBlueprints/permissions/update`	`null`
`microsoft.directory/agentIdentityBlueprints/tag/update`	`null`
`microsoft.directory/appConsent/appConsentRequests/allProperties/read`	`null`
`microsoft.directory/applications/allProperties/allTasks`	`null`
`microsoft.directory/applications/disablement/update`	`null`
`microsoft.directory/applications/synchronization/standard/read`	`null`
`microsoft.directory/applicationTemplates/instantiate`	`null`
`microsoft.directory/auditLogs/allProperties/read`	`null`
`microsoft.directory/authorizationPolicy/allProperties/allTasks`	`null`
`microsoft.directory/backup/preview/cancel`	`null`
`microsoft.directory/backup/preview/create`	`null`
`microsoft.directory/backup/recovery/cancel`	`null`
`microsoft.directory/backup/recovery/create`	`null`
`microsoft.directory/backup/standard/read`	`null`
`microsoft.directory/bitlockerKeys/key/read`	`null`
`microsoft.directory/bulkJobs/basic/update`	`null`
`microsoft.directory/bulkJobs/create`	`null`
`microsoft.directory/bulkJobs/standard/read`	`null`
`microsoft.directory/cloudAppSecurity/allProperties/allTasks`	`null`
`microsoft.directory/conditionalAccessPolicies/allProperties/allTasks`	`null`
`microsoft.directory/connectorGroups/allProperties/read`	`null`
`microsoft.directory/connectorGroups/allProperties/update`	`null`
`microsoft.directory/connectorGroups/create`	`null`
`microsoft.directory/connectorGroups/delete`	`null`
`microsoft.directory/connectors/allProperties/read`	`null`
`microsoft.directory/connectors/create`	`null`
`microsoft.directory/contacts/allProperties/allTasks`	`null`
`microsoft.directory/contracts/allProperties/allTasks`	`null`
`microsoft.directory/crossTenantAccessPolicy/allowedCloudEndpoints/update`	`null`
`microsoft.directory/crossTenantAccessPolicy/basic/update`	`null`
`microsoft.directory/crossTenantAccessPolicy/default/b2bCollaboration/update`	`null`
`microsoft.directory/crossTenantAccessPolicy/default/b2bDirectConnect/update`	`null`
`microsoft.directory/crossTenantAccessPolicy/default/crossCloudMeetings/update`	`null`
`microsoft.directory/crossTenantAccessPolicy/default/standard/read`	`null`
`microsoft.directory/crossTenantAccessPolicy/default/tenantRestrictions/update`	`null`
`microsoft.directory/crossTenantAccessPolicy/partners/b2bCollaboration/update`	`null`
`microsoft.directory/crossTenantAccessPolicy/partners/b2bDirectConnect/update`	`null`
`microsoft.directory/crossTenantAccessPolicy/partners/create`	`null`
`microsoft.directory/crossTenantAccessPolicy/partners/crossCloudMeetings/update`	`null`
`microsoft.directory/crossTenantAccessPolicy/partners/delete`	`null`
`microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/basic/update`	`null`
`microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/create`	`null`
`microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/standard/read`	`null`
`microsoft.directory/crossTenantAccessPolicy/partners/standard/read`	`null`
`microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/basic/update`	`null`
`microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/resetToDefaultSettings`	`null`
`microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/standard/read`	`null`
`microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/basic/update`	`null`
`microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/resetToDefaultSettings`	`null`
`microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/standard/read`	`null`
`microsoft.directory/crossTenantAccessPolicy/partners/tenantRestrictions/update`	`null`
`microsoft.directory/crossTenantAccessPolicy/standard/read`	`null`
`microsoft.directory/customAuthenticationExtensions/allProperties/allTasks`	`null`
`microsoft.directory/deletedItems/delete`	`null`
`microsoft.directory/deletedItems/restore`	`null`
`microsoft.directory/deviceLocalCredentials/password/read`	`null`
`microsoft.directory/deviceManagementPolicies/basic/update`	`null`
`microsoft.directory/deviceManagementPolicies/standard/read`	`null`
`microsoft.directory/deviceRegistrationPolicy/basic/update`	`null`
`microsoft.directory/deviceRegistrationPolicy/standard/read`	`null`
`microsoft.directory/devices/allProperties/allTasks`	`null`
`microsoft.directory/devices/permissions/update`	`null`
`microsoft.directory/deviceTemplates/owners/read`	`null`
`microsoft.directory/deviceTemplates/owners/update`	`null`
`microsoft.directory/directoryRoles/allProperties/allTasks`	`null`
`microsoft.directory/directoryRoleTemplates/allProperties/allTasks`	`null`
`microsoft.directory/domains/allProperties/allTasks`	`null`
`microsoft.directory/domains/federationConfiguration/basic/update`	`null`
`microsoft.directory/domains/federationConfiguration/create`	`null`
`microsoft.directory/domains/federationConfiguration/delete`	`null`
`microsoft.directory/domains/federationConfiguration/standard/read`	`null`
`microsoft.directory/entitlementManagement/allProperties/allTasks`	`null`
`microsoft.directory/externalUserProfiles/basic/update`	`null`
`microsoft.directory/externalUserProfiles/delete`	`null`
`microsoft.directory/externalUserProfiles/standard/read`	`null`
`microsoft.directory/groups/allProperties/allTasks`	`null`
`microsoft.directory/groupsAssignableToRoles/allProperties/update`	`null`
`microsoft.directory/groupsAssignableToRoles/assignLicense`	`null`
`microsoft.directory/groupsAssignableToRoles/create`	`null`
`microsoft.directory/groupsAssignableToRoles/delete`	`null`
`microsoft.directory/groupsAssignableToRoles/reprocessLicenseAssignment`	`null`
`microsoft.directory/groupsAssignableToRoles/restore`	`null`
`microsoft.directory/groupSettings/allProperties/allTasks`	`null`
`microsoft.directory/groupSettingTemplates/allProperties/allTasks`	`null`
`microsoft.directory/hybridAuthenticationPolicy/allProperties/allTasks`	`null`
`microsoft.directory/identityProtection/allProperties/allTasks`	`null`
`microsoft.directory/lifecycleWorkflows/workflows/allProperties/allTasks`	`null`
`microsoft.directory/lockbox/requests/update`	`null`
`microsoft.directory/loginOrganizationBranding/allProperties/allTasks`	`null`
`microsoft.directory/multiTenantOrganization/basic/update`	`null`
`microsoft.directory/multiTenantOrganization/create`	`null`
`microsoft.directory/multiTenantOrganization/joinRequest/organizationDetails/update`	`null`
`microsoft.directory/multiTenantOrganization/joinRequest/standard/read`	`null`
`microsoft.directory/multiTenantOrganization/standard/read`	`null`
`microsoft.directory/multiTenantOrganization/tenants/create`	`null`
`microsoft.directory/multiTenantOrganization/tenants/delete`	`null`
`microsoft.directory/multiTenantOrganization/tenants/organizationDetails/read`	`null`
`microsoft.directory/multiTenantOrganization/tenants/organizationDetails/update`	`null`
`microsoft.directory/multiTenantOrganization/tenants/standard/read`	`null`
`microsoft.directory/namedLocations/basic/update`	`null`
`microsoft.directory/namedLocations/create`	`null`
`microsoft.directory/namedLocations/delete`	`null`
`microsoft.directory/namedLocations/standard/read`	`null`
`microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks`	`null`
`microsoft.directory/onPremisesSynchronization/basic/update`	`null`
`microsoft.directory/onPremisesSynchronization/standard/read`	`null`
`microsoft.directory/organization/allProperties/allTasks`	`null`
`microsoft.directory/passwordHashSync/allProperties/allTasks`	`null`
`microsoft.directory/pendingExternalUserProfiles/basic/update`	`null`
`microsoft.directory/pendingExternalUserProfiles/create`	`null`
`microsoft.directory/pendingExternalUserProfiles/delete`	`null`
`microsoft.directory/pendingExternalUserProfiles/standard/read`	`null`
`microsoft.directory/permissionGrantPolicies/basic/update`	`null`
`microsoft.directory/permissionGrantPolicies/create`	`null`
`microsoft.directory/permissionGrantPolicies/delete`	`null`
`microsoft.directory/permissionGrantPolicies/standard/read`	`null`
`microsoft.directory/policies/allProperties/allTasks`	`null`
`microsoft.directory/privilegedIdentityManagement/allProperties/read`	`null`
`microsoft.directory/provisioningLogs/allProperties/read`	`null`
`microsoft.directory/resourceNamespaces/resourceActions/authenticationContext/update`	`null`
`microsoft.directory/roleAssignments/allProperties/allTasks`	`null`
`microsoft.directory/roleDefinitions/allProperties/allTasks`	`null`
`microsoft.directory/scopedRoleMemberships/allProperties/allTasks`	`null`
`microsoft.directory/serviceAction/activateService`	`null`
`microsoft.directory/serviceAction/disableDirectoryFeature`	`null`
`microsoft.directory/serviceAction/enableDirectoryFeature`	`null`
`microsoft.directory/serviceAction/getAvailableExtentionProperties`	`null`
`microsoft.directory/servicePrincipalCreationPolicies/basic/update`	`null`
`microsoft.directory/servicePrincipalCreationPolicies/create`	`null`
`microsoft.directory/servicePrincipalCreationPolicies/delete`	`null`
`microsoft.directory/servicePrincipalCreationPolicies/standard/read`	`null`
`microsoft.directory/servicePrincipals/allProperties/allTasks`	`null`
`microsoft.directory/servicePrincipals/managePermissionGrantsForAll.microsoft-company-admin`	`null`
`microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/credentials/manage`	`null`
`microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/jobs/manage`	`null`
`microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/schema/manage`	`null`
`microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/credentials/manage`	`null`
`microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/jobs/manage`	`null`
`microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/schema/manage`	`null`
`microsoft.directory/servicePrincipals/synchronization/standard/read`	`null`
`microsoft.directory/signInReports/allProperties/read`	`null`
`microsoft.directory/subscribedSkus/allProperties/allTasks`	`null`
`microsoft.directory/tenantGovernance/policyTemplates/allProperties/update`	`null`
`microsoft.directory/tenantGovernance/policyTemplates/create`	`null`
`microsoft.directory/tenantGovernance/relationships/create`	`null`
`microsoft.directory/tenantGovernance/requests/allProperties/update`	`null`
`microsoft.directory/tenantGovernance/requests/create`	`null`
`microsoft.directory/tenantManagement/tenants/create`	`null`
`microsoft.directory/users/allProperties/allTasks`	`null`
`microsoft.directory/users/authenticationMethods/basic/update`	`null`
`microsoft.directory/users/authenticationMethods/create`	`null`
`microsoft.directory/users/authenticationMethods/delete`	`null`
`microsoft.directory/users/authenticationMethods/standard/read`	`null`
`microsoft.directory/users/convertExternalToInternalMemberUser`	`null`
`microsoft.directory/verifiableCredentials/configuration/allProperties/read`	`null`
`microsoft.directory/verifiableCredentials/configuration/allProperties/update`	`null`
`microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/read`	`null`
`microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/update`	`null`
`microsoft.directory/verifiableCredentials/configuration/contracts/cards/allProperties/read`	`null`
`microsoft.directory/verifiableCredentials/configuration/contracts/cards/revoke`	`null`
`microsoft.directory/verifiableCredentials/configuration/contracts/create`	`null`
`microsoft.directory/verifiableCredentials/configuration/create`	`null`
`microsoft.directory/verifiableCredentials/configuration/delete`	`null`
`microsoft.dynamics365/allEntities/allTasks`	`null`
`microsoft.edge/allEntities/allProperties/allTasks`	`null`
`microsoft.flow/allEntities/allTasks`	`null`
`microsoft.graph.dataConnect/allEntities/allProperties/allTasks`	`null`
`microsoft.hardware.support/shippingAddress/allProperties/allTasks`	`null`
`microsoft.hardware.support/shippingStatus/allProperties/read`	`null`
`microsoft.hardware.support/warrantyClaims/allProperties/allTasks`	`null`
`microsoft.healthPlatform/allEntities/allProperties/allTasks`	`null`
`microsoft.insights/allEntities/allProperties/allTasks`	`null`
`microsoft.intune/allEntities/allTasks`	`null`
`microsoft.microsoft365.organizationalData/allEntities/allProperties/allTasks`	`null`
`microsoft.networkAccess/allEntities/allProperties/allTasks`	`null`
`microsoft.networkAccess/trafficLogs/standard/read`	`null`
`microsoft.office365.complianceManager/allEntities/allTasks`	`null`
`microsoft.office365.copilot/allEntities/allProperties/allTasks`	`null`
`microsoft.office365.desktopAnalytics/allEntities/allTasks`	`null`
`microsoft.office365.exchange/allEntities/basic/allTasks`	`null`
`microsoft.office365.fileStorageContainers/allEntities/allProperties/allTasks`	`null`
`microsoft.office365.knowledge/contentUnderstanding/allProperties/allTasks`	`null`
`microsoft.office365.knowledge/contentUnderstanding/analytics/allProperties/read`	`null`
`microsoft.office365.knowledge/knowledgeNetwork/allProperties/allTasks`	`null`
`microsoft.office365.knowledge/knowledgeNetwork/topicVisibility/allProperties/allTasks`	`null`
`microsoft.office365.knowledge/learningSources/allProperties/allTasks`	`null`
`microsoft.office365.lockbox/allEntities/allTasks`	`null`
`microsoft.office365.messageCenter/messages/read`	`null`
`microsoft.office365.messageCenter/securityMessages/read`	`null`
`microsoft.office365.migrations/allEntities/allProperties/allTasks`	`null`
`microsoft.office365.network/performance/allProperties/read`	`null`
`microsoft.office365.organizationalMessages/allEntities/allProperties/allTasks`	`null`
`microsoft.office365.protectionCenter/allEntities/allProperties/allTasks`	`null`
`microsoft.office365.search/content/manage`	`null`
`microsoft.office365.securityComplianceCenter/allEntities/allTasks`	`null`
`microsoft.office365.serviceHealth/allEntities/allTasks`	`null`
`microsoft.office365.sharePointAdvancedManagement/allEntities/allProperties/allTasks`	`null`
`microsoft.office365.sharePoint/allEntities/allTasks`	`null`
`microsoft.office365.skypeForBusiness/allEntities/allTasks`	`null`
`microsoft.office365.supportTickets/allEntities/allTasks`	`null`
`microsoft.office365.usageReports/allEntities/allProperties/read`	`null`
`microsoft.office365.userCommunication/allEntities/allTasks`	`null`
`microsoft.office365.webPortal/allEntities/standard/read`	`null`
`microsoft.office365.yammer/allEntities/allProperties/allTasks`	`null`
`microsoft.peopleAdmin/organization/allProperties/read`	`null`
`microsoft.peopleAdmin/organization/allProperties/update`	`null`
`microsoft.people/users/photo/read`	`null`
`microsoft.people/users/photo/update`	`null`
`microsoft.permissionsManagement/allEntities/allProperties/allTasks`	`null`
`microsoft.powerApps/allEntities/allTasks`	`null`
`microsoft.powerApps.powerBI/allEntities/allTasks`	`null`
`microsoft.teams/allEntities/allProperties/allTasks`	`null`
`microsoft.virtualVisits/allEntities/allProperties/allTasks`	`null`
`microsoft.viva.glint/allEntities/allProperties/allTasks`	`null`
`microsoft.viva.goals/allEntities/allProperties/allTasks`	`null`
`microsoft.viva.pulse/allEntities/allProperties/allTasks`	`null`
`microsoft.windows.defenderAdvancedThreatProtection/allEntities/allTasks`	`null`
`microsoft.windows.updatesDeployments/allEntities/allProperties/allTasks`	`null`

Graph API Permissions357

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

AccessReview.Read.All
AccessReview.ReadWrite.All
AccessReview.ReadWrite.Membership
AdministrativeUnit.Read.All
AdministrativeUnit.ReadWrite.All
AgentCard.Read.All
AgentCard.ReadWrite.All
AgentCardManifest.Read.All
AgentCardManifest.ReadWrite.All
AgentCollection.Read.All
AgentCollection.ReadWrite.All
AgentCollection.ReadWrite.Global
AgentIdentity.Create.All
AgentIdentity.DeleteRestore.All
AgentIdentity.EnableDisable.All
AgentIdentity.Read.All
AgentIdentity.ReadWrite.All
AgentIdentityBlueprint.AddRemoveCreds.All
AgentIdentityBlueprint.Create
AgentIdentityBlueprint.DeleteRestore.All
AgentIdentityBlueprint.Read.All
AgentIdentityBlueprint.ReadWrite.All
AgentIdentityBlueprintPrincipal.Create
AgentIdentityBlueprintPrincipal.DeleteRestore.All
AgentIdentityBlueprintPrincipal.EnableDisable.All
AgentIdentityBlueprintPrincipal.Read.All
AgentIdentityBlueprintPrincipal.ReadWrite.All
AgentIdUser.ReadWrite.All
AgentIdUser.ReadWrite.IdentityParentedBy
AgentInstance.Read.All
AgentInstance.ReadWrite.All
AgentRegistration.Read.All
AgentRegistration.ReadWrite.All
Application.Read.All
Application.ReadUpdate.All
Application.ReadWrite.All
AppRoleAssignment.ReadWrite.All
AttackSimulation.Read.All
AttackSimulation.ReadWrite.All
AuditLog.Read.All
AuditLogsQuery-Entra.Read.All
AuditLogsQuery.Read.All
BackupRestore-Monitor.Read.All
BackupRestore-Restore.Read.All
BitlockerKey.ReadBasic.All
Bookings.Manage.All
Bookings.Read.All
Bookings.ReadWrite.All
BookingsAppointment.ReadWrite.All
Calendars.Read
Calendars.ReadWrite
ChangeManagement.Read.All
Channel.Create
Channel.Delete.All
Channel.ReadBasic.All
ChannelMember.Read.All
ChannelMember.ReadWrite.All
ChannelMessage.Read.All
ChannelSettings.Read.All
ChannelSettings.ReadWrite.All
CloudApp-Discovery.Read.All
CloudPC.Read.All
CloudPC.ReadWrite.All
ConsentRequest.Read.All
ConsentRequest.ReadWrite.All
Contacts.Read
Contacts.ReadWrite
ContentActivity.Read
ContentActivity.Write
CrossTenantInformation.ReadBasic.All
CustomAuthenticationExtension.Read.All
CustomAuthenticationExtension.ReadWrite.All
CustomDetection.Read.All
CustomDetection.ReadWrite.All
DelegatedPermissionGrant.Read.All
DelegatedPermissionGrant.ReadWrite.All
Device.CreateFromOwnedTemplate
Device.Read.All
DeviceLocalCredential.ReadBasic.All
DeviceManagementApps.Read.All
DeviceManagementApps.ReadWrite.All
DeviceManagementConfiguration.Read.All
DeviceManagementConfiguration.ReadWrite.All
DeviceManagementManagedDevices.Read.All
DeviceManagementManagedDevices.ReadWrite.All
DeviceManagementRBAC.Read.All
DeviceManagementRBAC.ReadWrite.All
DeviceManagementScripts.Read.All
DeviceManagementScripts.ReadWrite.All
DeviceManagementServiceConfig.Read.All
DeviceManagementServiceConfig.ReadWrite.All
DeviceTemplate.Read.All
DeviceTemplate.ReadWrite.All
Directory.Read.All
Directory.ReadWrite.All
Domain-InternalFederation.ReadWrite.All
Domain.Read.All
Domain.ReadWrite.All
eDiscovery.Read.All
eDiscovery.ReadWrite.All
EntitlementManagement.Read.All
EntitlementManagement.ReadWrite.All
EntitlementMgmt-SubjectAccess.ReadWrite
EntraBackup.Read.All
EntraBackup.ReadWrite.Preview
EntraBackup.ReadWrite.Recovery
ExchangeMessageTrace.Read.All
ExternalConnection.Read.All
ExternalConnection.ReadWrite.All
ExternalConnection.ReadWrite.OwnedBy
ExternalItem.Read.All
ExternalItem.ReadWrite.All
ExternalItem.ReadWrite.OwnedBy
ExternalUserProfile.Read.All
ExternalUserProfile.ReadWrite.All
Files.Read.All
Files.ReadWrite.All
FileStorageContainer.Selected
Group.Read.All
Group.ReadWrite.All
GroupMember.Read.All
GroupMember.ReadWrite.All
GroupSettings.Read.All
GroupSettings.ReadWrite.All
HealthMonitoringAlert.Read.All
HealthMonitoringAlert.ReadWrite.All
HealthMonitoringAlertConfig.Read.All
HealthMonitoringAlertConfig.ReadWrite.All
IdentityRiskEvent.Read.All
IdentityRiskEvent.ReadWrite.All
IdentityRiskyAgent.Read.All
IdentityRiskyAgent.ReadWrite.All
IdentityRiskyServicePrincipal.Read.All
IdentityRiskyServicePrincipal.ReadWrite.All
IdentityRiskyUser.Read.All
IdentityRiskyUser.ReadWrite.All
IndustryData-DataConnector.Read.All
IndustryData-DataConnector.ReadWrite.All
IndustryData-InboundFlow.Read.All
IndustryData-InboundFlow.ReadWrite.All
IndustryData-OutboundFlow.Read.All
IndustryData-OutboundFlow.ReadWrite.All
IndustryData-ReferenceDefinition.Read.All
IndustryData-SourceSystem.Read.All
IndustryData-SourceSystem.ReadWrite.All
IndustryData.ReadBasic.All
LicenseAssignment.Read.All
LicenseAssignment.ReadWrite.All
LifecycleWorkflows-CustomExt.Read.All
LifecycleWorkflows-CustomExt.ReadWrite.All
LifecycleWorkflows-Reports.Read.All
LifecycleWorkflows-Workflow.Activate
LifecycleWorkflows-Workflow.Read.All
LifecycleWorkflows-Workflow.ReadBasic.All
LifecycleWorkflows-Workflow.ReadWrite.All
LifecycleWorkflows.Read.All
LifecycleWorkflows.ReadWrite.All
Mail.Read
Mail.ReadWrite
MailboxSettings.Read
MailboxSettings.ReadWrite
MultiTenantOrganization.Read.All
MultiTenantOrganization.ReadBasic.All
MultiTenantOrganization.ReadWrite.All
NetworkAccess-Reports.Read.All
NetworkAccess.Read.All
NetworkAccess.ReadWrite.All
NetworkAccessBranch.Read.All
NetworkAccessBranch.ReadWrite.All
NetworkAccessPolicy.Read.All
NetworkAccessPolicy.ReadWrite.All
OnlineMeetingArtifact.Read.All
OnPremDirectorySynchronization.Read.All
OnPremDirectorySynchronization.ReadWrite.All
Organization.Read.All
Organization.ReadWrite.All
OrganizationalBranding.Read.All
OrganizationalBranding.ReadWrite.All
OrgContact.Read.All
OrgSettings-Forms.Read.All
OrgSettings-Forms.ReadWrite.All
OrgSettings-Microsoft365Install.Read.All
OrgSettings-Microsoft365Install.ReadWrite.All
OrgSettings-Todo.Read.All
OrgSettings-Todo.ReadWrite.All
PendingExternalUserProfile.Read.All
PendingExternalUserProfile.ReadWrite.All
People.Read.All
PeopleSettings.Read.All
PeopleSettings.ReadWrite.All
Place.Read.All
Place.ReadWrite.All
Policy.Read.All
Policy.Read.AuthenticationMethod
Policy.Read.B2BManagementPolicy
Policy.Read.ConditionalAccess
Policy.Read.DeviceConfiguration
Policy.Read.IdentityProtection
Policy.Read.PermissionGrant
Policy.ReadWrite.AccessReview
Policy.ReadWrite.ApplicationConfiguration
Policy.ReadWrite.AuthenticationFlows
Policy.ReadWrite.AuthenticationMethod
Policy.ReadWrite.Authorization
Policy.ReadWrite.B2BManagementPolicy
Policy.ReadWrite.ConditionalAccess
Policy.ReadWrite.ConsentRequest
Policy.ReadWrite.CrossTenantAccess
Policy.ReadWrite.CrossTenantCapability
Policy.ReadWrite.DeviceConfiguration
Policy.ReadWrite.ExternalIdentities
Policy.ReadWrite.FeatureRollout
Policy.ReadWrite.FedTokenValidation
Policy.ReadWrite.IdentityProtection
Policy.ReadWrite.MobilityManagement
Policy.ReadWrite.PermissionGrant
Policy.ReadWrite.SecurityDefaults
Policy.ReadWrite.TrustFramework
PrivilegedAccess-CustomExt.Read.All
PrivilegedAccess.Read.AzureAD
PrivilegedAccess.Read.AzureADGroup
PrivilegedAssignmentSchedule.Read.AzureADGroup
PrivilegedAssignmentSchedule.Read.EntraAppRole
PrivilegedEligibilitySchedule.Read.AzureADGroup
PrivilegedEligibilitySchedule.Read.EntraAppRole
ProgramControl.Read.All
ProgramControl.ReadWrite.All
ProvisioningLog.Read.All
RecordsManagement.Read.All
RecordsManagement.ReadWrite.All
Reports.Read.All
ReportSettings.Read.All
RiskPreventionProviders.Read.All
RiskPreventionProviders.ReadWrite.All
RoleManagement.Read.All
RoleManagement.Read.CloudPC
RoleManagement.Read.Defender
RoleManagement.Read.Directory
RoleManagement.Read.Exchange
RoleManagement.ReadWrite.CloudPC
RoleManagement.ReadWrite.Defender
RoleManagement.ReadWrite.Directory
RoleManagement.ReadWrite.Exchange
RoleManagementAlert.Read.Directory
RoleManagementPolicy.Read.AzureADGroup
RoleManagementPolicy.Read.Directory
RoleManagementPolicy.Read.EntraAppRole
Schedule.Read.All
Schedule.ReadWrite.All
SchedulePermissions.ReadWrite.All
SearchConfiguration.Read.All
SearchConfiguration.ReadWrite.All
SecurityAlert.Read.All
SecurityAlert.ReadWrite.All
SecurityAnalyzedMessage.Read.All
SecurityAnalyzedMessage.ReadWrite.All
SecurityEvents.Read.All
SecurityEvents.ReadWrite.All
SecurityIdentitiesAccount.Read.All
SecurityIdentitiesActions.ReadWrite.All
SecurityIdentitiesAutoConfig.Read.All
SecurityIdentitiesAutoConfig.ReadWrite.All
SecurityIdentitiesHealth.Read.All
SecurityIdentitiesHealth.ReadWrite.All
SecurityIdentitiesMigration.Read.All
SecurityIdentitiesMigration.ReadWrite.All
SecurityIdentitiesSensors.Read.All
SecurityIdentitiesSensors.ReadWrite.All
SecurityIdentitiesUserActions.Read.All
SecurityIdentitiesUserActions.ReadWrite.All
SecurityIncident.Read.All
SecurityIncident.ReadWrite.All
SensitivityLabel.Evaluate
SensitivityLabel.Evaluate.All
SensitivityLabel.Read
SensitivityLabels.Read.All
ServiceActivity-Exchange.Read.All
ServiceActivity-Microsoft365Web.Read.All
ServiceActivity-OneDrive.Read.All
ServiceActivity-Teams.Read.All
ServiceHealth.Read.All
ServiceMessage.Read.All
ServiceMessageViewpoint.Write
ServicePrincipalEndpoint.Read.All
ServicePrincipalEndpoint.ReadWrite.All
SharePointCrossTenantMigration.Manage.All
SharePointTenantSettings.Read.All
SharePointTenantSettings.ReadWrite.All
SignInIdentifier.Read.All
SignInIdentifier.ReadWrite.All
Sites.FullControl.All
Sites.Manage.All
Sites.Read.All
Sites.ReadWrite.All
SubjectRightsRequest.Read.All
SubjectRightsRequest.ReadWrite.All
Team.Create
Team.ReadBasic.All
TeamMember.Read.All
TeamMember.ReadWrite.All
TeamsActivity.Read
TeamsActivity.Send
TeamsAppInstallation.ReadWriteAndConsentForTeam
TeamSettings.Read.All
TeamSettings.ReadWrite.All
TeamsPolicyUserAssign.ReadWrite.All
TeamsResourceAccount.Read.All
TeamsTab.Create
TeamsTab.Read.All
TeamsTab.ReadWrite.All
TeamsTelephoneNumber.Read.All
TeamsTelephoneNumber.ReadWrite.All
TeamsUserConfiguration.Read.All
TenantGovernance-Invitation.Read.All
TenantGovernance-Invitation.ReadWrite.All
TenantGovernance-PolicyTemplate.Read.All
TenantGovernance-PolicyTemplate.ReadWrite.All
TenantGovernance-RelatedTenant.Read.All
TenantGovernance-RelatedTenant.ReadWrite.All
TenantGovernance-Relationship.Read.All
TenantGovernance-Relationship.ReadWrite.All
TenantGovernance-Request.Read.All
TenantGovernance-Request.ReadWrite.All
TenantGovernance-Setting.Read.All
TenantGovernance-Setting.ReadWrite.All
TermStore.Read.All
TermStore.ReadWrite.All
ThreatHunting.Read.All
ThreatIntelligence.Read.All
ThreatSubmission.Read.All
ThreatSubmission.ReadWrite.All
ThreatSubmissionPolicy.ReadWrite.All
User-ConvertToInternal.ReadWrite.All
User-LifeCycleInfo.Read.All
User-LifeCycleInfo.ReadWrite.All
User-Mail.ReadWrite.All
User-OnPremisesSyncBehavior.ReadWrite.All
User-PasswordProfile.ReadWrite.All
User.Create
User.DeleteRestore.All
User.EnableDisableAccount.All
User.Export.All
User.Invite.All
User.ManageIdentities.All
User.Read.All
User.ReadBasic.All
User.ReadWrite.All
User.RevokeSessions.All
UserAuthenticationMethod.Read.All
UserAuthenticationMethod.ReadWrite.All
UserAuthMethod-External.ReadWrite.All
UserAuthMethod-HardwareOATH.ReadWrite.All
UserAuthMethod-TAP.ReadWrite.All
VerifiedId-Profile.Read.All
VerifiedId-Profile.ReadWrite.All
WindowsUpdates.Read.All
WindowsUpdates.ReadWrite.All

ShareLinkedIn X Reddit Facebook WhatsApp