Global Administrator

Description

Can manage all aspects of Microsoft Entra ID and Microsoft services that use Microsoft Entra identities.

Details

Users with this role have access to all administrative features in Microsoft Entra ID, as well as services that federate to Microsoft Entra ID like Exchange Online, SharePoint Online, and Skype for Business Online. The person who signs up for the Microsoft Entra tenant becomes a global administrator. Only global administrators can assign other administrator roles. There can be more than one global administrator at your company. Global admins can reset the password for any user and all other administrators. Note: In Microsoft Graph API, Azure AD Graph API, and Azure AD PowerShell, this role is identified as "Company Administrator". It is "Global Administrator" in the Azure portal.

Directory Actions262

• microsoft.agentRegistry/allEntities/allProperties/allTasks
• microsoft.azure.advancedThreatProtection/allEntities/allTasks
• microsoft.azure.informationProtection/allEntities/allTasks
• microsoft.azure.serviceHealth/allEntities/allTasks
• microsoft.azure.supportTickets/allEntities/allTasks
• microsoft.backup/allEntities/allProperties/allTasks
• microsoft.cloudPC/allEntities/allProperties/allTasks
• microsoft.commerce.billing/allEntities/allProperties/allTasks
• microsoft.commerce.billing/purchases/standard/read
• microsoft.commerce.tenantRelationships/customerDelegatedAdminPrivileges/allProperties/allTasks
• microsoft.directory/accessReviews/allProperties/allTasks
• microsoft.directory/accessReviews/definitions/allProperties/allTasks
• microsoft.directory/adminConsentRequestPolicy/allProperties/allTasks
• microsoft.directory/administrativeUnits/allProperties/allTasks
• microsoft.directory/agentIdentities/allProperties/read
• microsoft.directory/agentIdentities/appRoleAssignedTo/update
• microsoft.directory/agentIdentities/authentication/update
• microsoft.directory/agentIdentities/basic/update
• microsoft.directory/agentIdentities/create
• microsoft.directory/agentIdentities/delete
• microsoft.directory/agentIdentities/disable
• microsoft.directory/agentIdentities/enable
• microsoft.directory/agentIdentities/owners/update
• microsoft.directory/agentIdentities/tag/update
• microsoft.directory/agentIdentityBlueprintPrincipals/allProperties/read
• microsoft.directory/agentIdentityBlueprintPrincipals/appRoleAssignedTo/update
• microsoft.directory/agentIdentityBlueprintPrincipals/authentication/update
• microsoft.directory/agentIdentityBlueprintPrincipals/basic/update
• microsoft.directory/agentIdentityBlueprintPrincipals/create
• microsoft.directory/agentIdentityBlueprintPrincipals/delete
• microsoft.directory/agentIdentityBlueprintPrincipals/disable
• microsoft.directory/agentIdentityBlueprintPrincipals/enable
• microsoft.directory/agentIdentityBlueprintPrincipals/owners/update
• microsoft.directory/agentIdentityBlueprintPrincipals/tag/update
• microsoft.directory/agentIdentityBlueprints/allProperties/read
• microsoft.directory/agentIdentityBlueprints/allProperties/update
• microsoft.directory/agentIdentityBlueprints/appRoles/update
• microsoft.directory/agentIdentityBlueprints/audience/update
• microsoft.directory/agentIdentityBlueprints/authentication/update
• microsoft.directory/agentIdentityBlueprints/basic/update
• microsoft.directory/agentIdentityBlueprints/create
• microsoft.directory/agentIdentityBlueprints/credentials/update
• microsoft.directory/agentIdentityBlueprints/delete
• microsoft.directory/agentIdentityBlueprints/owners/update
• microsoft.directory/agentIdentityBlueprints/permissions/update
• microsoft.directory/agentIdentityBlueprints/tag/update
• microsoft.directory/appConsent/appConsentRequests/allProperties/read
• microsoft.directory/applications/allProperties/allTasks
• microsoft.directory/applications/disablement/update
• microsoft.directory/applications/synchronization/standard/read
• microsoft.directory/applicationTemplates/instantiate
• microsoft.directory/auditLogs/allProperties/read
• microsoft.directory/authorizationPolicy/allProperties/allTasks
• microsoft.directory/backup/preview/cancel
• microsoft.directory/backup/preview/create
• microsoft.directory/backup/recovery/cancel
• microsoft.directory/backup/recovery/create
• microsoft.directory/backup/standard/read
• microsoft.directory/bitlockerKeys/key/read
• microsoft.directory/bulkJobs/basic/update
• microsoft.directory/bulkJobs/create
• microsoft.directory/bulkJobs/standard/read
• microsoft.directory/cloudAppSecurity/allProperties/allTasks
• microsoft.directory/conditionalAccessPolicies/allProperties/allTasks
• microsoft.directory/connectorGroups/allProperties/read
• microsoft.directory/connectorGroups/allProperties/update
• microsoft.directory/connectorGroups/create
• microsoft.directory/connectorGroups/delete
• microsoft.directory/connectors/allProperties/read
• microsoft.directory/connectors/create
• microsoft.directory/contacts/allProperties/allTasks
• microsoft.directory/contracts/allProperties/allTasks
• microsoft.directory/crossTenantAccessPolicy/allowedCloudEndpoints/update
• microsoft.directory/crossTenantAccessPolicy/basic/update
• microsoft.directory/crossTenantAccessPolicy/default/b2bCollaboration/update
• microsoft.directory/crossTenantAccessPolicy/default/b2bDirectConnect/update
• microsoft.directory/crossTenantAccessPolicy/default/crossCloudMeetings/update
• microsoft.directory/crossTenantAccessPolicy/default/standard/read
• microsoft.directory/crossTenantAccessPolicy/default/tenantRestrictions/update
• microsoft.directory/crossTenantAccessPolicy/partners/b2bCollaboration/update
• microsoft.directory/crossTenantAccessPolicy/partners/b2bDirectConnect/update
• microsoft.directory/crossTenantAccessPolicy/partners/create
• microsoft.directory/crossTenantAccessPolicy/partners/crossCloudMeetings/update
• microsoft.directory/crossTenantAccessPolicy/partners/delete
• microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/basic/update
• microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/create
• microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/standard/read
• microsoft.directory/crossTenantAccessPolicy/partners/standard/read
• microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/basic/update
• microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/resetToDefaultSettings
• microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/standard/read
• microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/basic/update
• microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/resetToDefaultSettings
• microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/standard/read
• microsoft.directory/crossTenantAccessPolicy/partners/tenantRestrictions/update
• microsoft.directory/crossTenantAccessPolicy/standard/read
• microsoft.directory/customAuthenticationExtensions/allProperties/allTasks
• microsoft.directory/deletedItems/delete
• microsoft.directory/deletedItems/restore
• microsoft.directory/deviceLocalCredentials/password/read
• microsoft.directory/deviceManagementPolicies/basic/update
• microsoft.directory/deviceManagementPolicies/standard/read
• microsoft.directory/deviceRegistrationPolicy/basic/update
• microsoft.directory/deviceRegistrationPolicy/standard/read
• microsoft.directory/devices/allProperties/allTasks
• microsoft.directory/devices/permissions/update
• microsoft.directory/deviceTemplates/owners/read
• microsoft.directory/deviceTemplates/owners/update
• microsoft.directory/directoryRoles/allProperties/allTasks
• microsoft.directory/directoryRoleTemplates/allProperties/allTasks
• microsoft.directory/domains/allProperties/allTasks
• microsoft.directory/domains/federationConfiguration/basic/update
• microsoft.directory/domains/federationConfiguration/create
• microsoft.directory/domains/federationConfiguration/delete
• microsoft.directory/domains/federationConfiguration/standard/read
• microsoft.directory/entitlementManagement/allProperties/allTasks
• microsoft.directory/externalUserProfiles/basic/update
• microsoft.directory/externalUserProfiles/delete
• microsoft.directory/externalUserProfiles/standard/read
• microsoft.directory/groups/allProperties/allTasks
• microsoft.directory/groupsAssignableToRoles/allProperties/update
• microsoft.directory/groupsAssignableToRoles/assignLicense
• microsoft.directory/groupsAssignableToRoles/create
• microsoft.directory/groupsAssignableToRoles/delete
• microsoft.directory/groupsAssignableToRoles/reprocessLicenseAssignment
• microsoft.directory/groupsAssignableToRoles/restore
• microsoft.directory/groupSettings/allProperties/allTasks
• microsoft.directory/groupSettingTemplates/allProperties/allTasks
• microsoft.directory/hybridAuthenticationPolicy/allProperties/allTasks
• microsoft.directory/identityProtection/allProperties/allTasks
• microsoft.directory/lifecycleWorkflows/workflows/allProperties/allTasks
• microsoft.directory/lockbox/requests/update
• microsoft.directory/loginOrganizationBranding/allProperties/allTasks
• microsoft.directory/multiTenantOrganization/basic/update
• microsoft.directory/multiTenantOrganization/create
• microsoft.directory/multiTenantOrganization/joinRequest/organizationDetails/update
• microsoft.directory/multiTenantOrganization/joinRequest/standard/read
• microsoft.directory/multiTenantOrganization/standard/read
• microsoft.directory/multiTenantOrganization/tenants/create
• microsoft.directory/multiTenantOrganization/tenants/delete
• microsoft.directory/multiTenantOrganization/tenants/organizationDetails/read
• microsoft.directory/multiTenantOrganization/tenants/organizationDetails/update
• microsoft.directory/multiTenantOrganization/tenants/standard/read
• microsoft.directory/namedLocations/basic/update
• microsoft.directory/namedLocations/create
• microsoft.directory/namedLocations/delete
• microsoft.directory/namedLocations/standard/read
• microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks
• microsoft.directory/onPremisesSynchronization/basic/update
• microsoft.directory/onPremisesSynchronization/standard/read
• microsoft.directory/organization/allProperties/allTasks
• microsoft.directory/passwordHashSync/allProperties/allTasks
• microsoft.directory/pendingExternalUserProfiles/basic/update
• microsoft.directory/pendingExternalUserProfiles/create
• microsoft.directory/pendingExternalUserProfiles/delete
• microsoft.directory/pendingExternalUserProfiles/standard/read
• microsoft.directory/permissionGrantPolicies/basic/update
• microsoft.directory/permissionGrantPolicies/create
• microsoft.directory/permissionGrantPolicies/delete
• microsoft.directory/permissionGrantPolicies/standard/read
• microsoft.directory/policies/allProperties/allTasks
• microsoft.directory/privilegedIdentityManagement/allProperties/read
• microsoft.directory/provisioningLogs/allProperties/read
• microsoft.directory/resourceNamespaces/resourceActions/authenticationContext/update
• microsoft.directory/roleAssignments/allProperties/allTasks
• microsoft.directory/roleDefinitions/allProperties/allTasks
• microsoft.directory/scopedRoleMemberships/allProperties/allTasks
• microsoft.directory/serviceAction/activateService
• microsoft.directory/serviceAction/disableDirectoryFeature
• microsoft.directory/serviceAction/enableDirectoryFeature
• microsoft.directory/serviceAction/getAvailableExtentionProperties
• microsoft.directory/servicePrincipalCreationPolicies/basic/update
• microsoft.directory/servicePrincipalCreationPolicies/create
• microsoft.directory/servicePrincipalCreationPolicies/delete
• microsoft.directory/servicePrincipalCreationPolicies/standard/read
• microsoft.directory/servicePrincipals/allProperties/allTasks
• microsoft.directory/servicePrincipals/managePermissionGrantsForAll.microsoft-company-admin
• microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/credentials/manage
• microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/jobs/manage
• microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/schema/manage
• microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/credentials/manage
• microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/jobs/manage
• microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/schema/manage
• microsoft.directory/servicePrincipals/synchronization/standard/read
• microsoft.directory/signInReports/allProperties/read
• microsoft.directory/subscribedSkus/allProperties/allTasks
• microsoft.directory/tenantGovernance/policyTemplates/allProperties/update
• microsoft.directory/tenantGovernance/policyTemplates/create
• microsoft.directory/tenantGovernance/relationships/create
• microsoft.directory/tenantGovernance/requests/allProperties/update
• microsoft.directory/tenantGovernance/requests/create
• microsoft.directory/tenantManagement/tenants/create
• microsoft.directory/users/allProperties/allTasks
• microsoft.directory/users/authenticationMethods/basic/update
• microsoft.directory/users/authenticationMethods/create
• microsoft.directory/users/authenticationMethods/delete
• microsoft.directory/users/authenticationMethods/standard/read
• microsoft.directory/users/convertExternalToInternalMemberUser
• microsoft.directory/verifiableCredentials/configuration/allProperties/read
• microsoft.directory/verifiableCredentials/configuration/allProperties/update
• microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/read
• microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/update
• microsoft.directory/verifiableCredentials/configuration/contracts/cards/allProperties/read
• microsoft.directory/verifiableCredentials/configuration/contracts/cards/revoke
• microsoft.directory/verifiableCredentials/configuration/contracts/create
• microsoft.directory/verifiableCredentials/configuration/create
• microsoft.directory/verifiableCredentials/configuration/delete
• microsoft.dynamics365/allEntities/allTasks
• microsoft.edge/allEntities/allProperties/allTasks
• microsoft.flow/allEntities/allTasks
• microsoft.graph.dataConnect/allEntities/allProperties/allTasks
• microsoft.hardware.support/shippingAddress/allProperties/allTasks
• microsoft.hardware.support/shippingStatus/allProperties/read
• microsoft.hardware.support/warrantyClaims/allProperties/allTasks
• microsoft.healthPlatform/allEntities/allProperties/allTasks
• microsoft.insights/allEntities/allProperties/allTasks
• microsoft.intune/allEntities/allTasks
• microsoft.microsoft365.organizationalData/allEntities/allProperties/allTasks
• microsoft.networkAccess/allEntities/allProperties/allTasks
• microsoft.networkAccess/trafficLogs/standard/read
• microsoft.office365.complianceManager/allEntities/allTasks
• microsoft.office365.copilot/allEntities/allProperties/allTasks
• microsoft.office365.desktopAnalytics/allEntities/allTasks
• microsoft.office365.exchange/allEntities/basic/allTasks
• microsoft.office365.fileStorageContainers/allEntities/allProperties/allTasks
• microsoft.office365.knowledge/contentUnderstanding/allProperties/allTasks
• microsoft.office365.knowledge/contentUnderstanding/analytics/allProperties/read
• microsoft.office365.knowledge/knowledgeNetwork/allProperties/allTasks
• microsoft.office365.knowledge/knowledgeNetwork/topicVisibility/allProperties/allTasks
• microsoft.office365.knowledge/learningSources/allProperties/allTasks
• microsoft.office365.lockbox/allEntities/allTasks
• microsoft.office365.messageCenter/messages/read
• microsoft.office365.messageCenter/securityMessages/read
• microsoft.office365.migrations/allEntities/allProperties/allTasks
• microsoft.office365.network/performance/allProperties/read
• microsoft.office365.organizationalMessages/allEntities/allProperties/allTasks
• microsoft.office365.protectionCenter/allEntities/allProperties/allTasks
• microsoft.office365.search/content/manage
• microsoft.office365.securityComplianceCenter/allEntities/allTasks
• microsoft.office365.serviceHealth/allEntities/allTasks
• microsoft.office365.sharePointAdvancedManagement/allEntities/allProperties/allTasks
• microsoft.office365.sharePoint/allEntities/allTasks
• microsoft.office365.skypeForBusiness/allEntities/allTasks
• microsoft.office365.supportTickets/allEntities/allTasks
• microsoft.office365.usageReports/allEntities/allProperties/read
• microsoft.office365.userCommunication/allEntities/allTasks
• microsoft.office365.webPortal/allEntities/standard/read
• microsoft.office365.yammer/allEntities/allProperties/allTasks
• microsoft.peopleAdmin/organization/allProperties/read
• microsoft.peopleAdmin/organization/allProperties/update
• microsoft.people/users/photo/read
• microsoft.people/users/photo/update
• microsoft.permissionsManagement/allEntities/allProperties/allTasks
• microsoft.powerApps/allEntities/allTasks
• microsoft.powerApps.powerBI/allEntities/allTasks
• microsoft.teams/allEntities/allProperties/allTasks
• microsoft.virtualVisits/allEntities/allProperties/allTasks
• microsoft.viva.glint/allEntities/allProperties/allTasks
• microsoft.viva.goals/allEntities/allProperties/allTasks
• microsoft.viva.pulse/allEntities/allProperties/allTasks
• microsoft.windows.defenderAdvancedThreatProtection/allEntities/allTasks
• microsoft.windows.updatesDeployments/allEntities/allProperties/allTasks

Graph API Permissions357

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

• AccessReview.Read.All
• AccessReview.ReadWrite.All
• AccessReview.ReadWrite.Membership
• AdministrativeUnit.Read.All
• AdministrativeUnit.ReadWrite.All
• AgentCard.Read.All
• AgentCard.ReadWrite.All
• AgentCardManifest.Read.All
• AgentCardManifest.ReadWrite.All
• AgentCollection.Read.All
• AgentCollection.ReadWrite.All
• AgentCollection.ReadWrite.Global
• AgentIdentity.Create.All
• AgentIdentity.DeleteRestore.All
• AgentIdentity.EnableDisable.All
• AgentIdentity.Read.All
• AgentIdentity.ReadWrite.All
• AgentIdentityBlueprint.AddRemoveCreds.All
• AgentIdentityBlueprint.Create
• AgentIdentityBlueprint.DeleteRestore.All
• AgentIdentityBlueprint.Read.All
• AgentIdentityBlueprint.ReadWrite.All
• AgentIdentityBlueprintPrincipal.Create
• AgentIdentityBlueprintPrincipal.DeleteRestore.All
• AgentIdentityBlueprintPrincipal.EnableDisable.All
• AgentIdentityBlueprintPrincipal.Read.All
• AgentIdentityBlueprintPrincipal.ReadWrite.All
• AgentIdUser.ReadWrite.All
• AgentIdUser.ReadWrite.IdentityParentedBy
• AgentInstance.Read.All
• AgentInstance.ReadWrite.All
• AgentRegistration.Read.All
• AgentRegistration.ReadWrite.All
• Application.Read.All
• Application.ReadUpdate.All
• Application.ReadWrite.All
• AppRoleAssignment.ReadWrite.All
• AttackSimulation.Read.All
• AttackSimulation.ReadWrite.All
• AuditLog.Read.All
• AuditLogsQuery-Entra.Read.All
• AuditLogsQuery.Read.All
• BackupRestore-Monitor.Read.All
• BackupRestore-Restore.Read.All
• BitlockerKey.ReadBasic.All
• Bookings.Manage.All
• Bookings.Read.All
• Bookings.ReadWrite.All
• BookingsAppointment.ReadWrite.All
• Calendars.Read
• Calendars.ReadWrite
• ChangeManagement.Read.All
• Channel.Create
• Channel.Delete.All
• Channel.ReadBasic.All
• ChannelMember.Read.All
• ChannelMember.ReadWrite.All
• ChannelMessage.Read.All
• ChannelSettings.Read.All
• ChannelSettings.ReadWrite.All
• CloudApp-Discovery.Read.All
• CloudPC.Read.All
• CloudPC.ReadWrite.All
• ConsentRequest.Read.All
• ConsentRequest.ReadWrite.All
• Contacts.Read
• Contacts.ReadWrite
• ContentActivity.Read
• ContentActivity.Write
• CrossTenantInformation.ReadBasic.All
• CustomAuthenticationExtension.Read.All
• CustomAuthenticationExtension.ReadWrite.All
• CustomDetection.Read.All
• CustomDetection.ReadWrite.All
• DelegatedPermissionGrant.Read.All
• DelegatedPermissionGrant.ReadWrite.All
• Device.CreateFromOwnedTemplate
• Device.Read.All
• DeviceLocalCredential.ReadBasic.All
• DeviceManagementApps.Read.All
• DeviceManagementApps.ReadWrite.All
• DeviceManagementConfiguration.Read.All
• DeviceManagementConfiguration.ReadWrite.All
• DeviceManagementManagedDevices.Read.All
• DeviceManagementManagedDevices.ReadWrite.All
• DeviceManagementRBAC.Read.All
• DeviceManagementRBAC.ReadWrite.All
• DeviceManagementScripts.Read.All
• DeviceManagementScripts.ReadWrite.All
• DeviceManagementServiceConfig.Read.All
• DeviceManagementServiceConfig.ReadWrite.All
• DeviceTemplate.Read.All
• DeviceTemplate.ReadWrite.All
• Directory.Read.All
• Directory.ReadWrite.All
• Domain-InternalFederation.ReadWrite.All
• Domain.Read.All
• Domain.ReadWrite.All
• eDiscovery.Read.All
• eDiscovery.ReadWrite.All
• EntitlementManagement.Read.All
• EntitlementManagement.ReadWrite.All
• EntitlementMgmt-SubjectAccess.ReadWrite
• EntraBackup.Read.All
• EntraBackup.ReadWrite.Preview
• EntraBackup.ReadWrite.Recovery
• ExchangeMessageTrace.Read.All
• ExternalConnection.Read.All
• ExternalConnection.ReadWrite.All
• ExternalConnection.ReadWrite.OwnedBy
• ExternalItem.Read.All
• ExternalItem.ReadWrite.All
• ExternalItem.ReadWrite.OwnedBy
• ExternalUserProfile.Read.All
• ExternalUserProfile.ReadWrite.All
• Files.Read.All
• Files.ReadWrite.All
• FileStorageContainer.Selected
• Group.Read.All
• Group.ReadWrite.All
• GroupMember.Read.All
• GroupMember.ReadWrite.All
• GroupSettings.Read.All
• GroupSettings.ReadWrite.All
• HealthMonitoringAlert.Read.All
• HealthMonitoringAlert.ReadWrite.All
• HealthMonitoringAlertConfig.Read.All
• HealthMonitoringAlertConfig.ReadWrite.All
• IdentityRiskEvent.Read.All
• IdentityRiskEvent.ReadWrite.All
• IdentityRiskyAgent.Read.All
• IdentityRiskyAgent.ReadWrite.All
• IdentityRiskyServicePrincipal.Read.All
• IdentityRiskyServicePrincipal.ReadWrite.All
• IdentityRiskyUser.Read.All
• IdentityRiskyUser.ReadWrite.All
• IndustryData-DataConnector.Read.All
• IndustryData-DataConnector.ReadWrite.All
• IndustryData-InboundFlow.Read.All
• IndustryData-InboundFlow.ReadWrite.All
• IndustryData-OutboundFlow.Read.All
• IndustryData-OutboundFlow.ReadWrite.All
• IndustryData-ReferenceDefinition.Read.All
• IndustryData-SourceSystem.Read.All
• IndustryData-SourceSystem.ReadWrite.All
• IndustryData.ReadBasic.All
• LicenseAssignment.Read.All
• LicenseAssignment.ReadWrite.All
• LifecycleWorkflows-CustomExt.Read.All
• LifecycleWorkflows-CustomExt.ReadWrite.All
• LifecycleWorkflows-Reports.Read.All
• LifecycleWorkflows-Workflow.Activate
• LifecycleWorkflows-Workflow.Read.All
• LifecycleWorkflows-Workflow.ReadBasic.All
• LifecycleWorkflows-Workflow.ReadWrite.All
• LifecycleWorkflows.Read.All
• LifecycleWorkflows.ReadWrite.All
• Mail.Read
• Mail.ReadWrite
• MailboxSettings.Read
• MailboxSettings.ReadWrite
• MultiTenantOrganization.Read.All
• MultiTenantOrganization.ReadBasic.All
• MultiTenantOrganization.ReadWrite.All
• NetworkAccess-Reports.Read.All
• NetworkAccess.Read.All
• NetworkAccess.ReadWrite.All
• NetworkAccessBranch.Read.All
• NetworkAccessBranch.ReadWrite.All
• NetworkAccessPolicy.Read.All
• NetworkAccessPolicy.ReadWrite.All
• OnlineMeetingArtifact.Read.All
• OnPremDirectorySynchronization.Read.All
• OnPremDirectorySynchronization.ReadWrite.All
• Organization.Read.All
• Organization.ReadWrite.All
• OrganizationalBranding.Read.All
• OrganizationalBranding.ReadWrite.All
• OrgContact.Read.All
• OrgSettings-Forms.Read.All
• OrgSettings-Forms.ReadWrite.All
• OrgSettings-Microsoft365Install.Read.All
• OrgSettings-Microsoft365Install.ReadWrite.All
• OrgSettings-Todo.Read.All
• OrgSettings-Todo.ReadWrite.All
• PendingExternalUserProfile.Read.All
• PendingExternalUserProfile.ReadWrite.All
• People.Read.All
• PeopleSettings.Read.All
• PeopleSettings.ReadWrite.All
• Place.Read.All
• Place.ReadWrite.All
• Policy.Read.All
• Policy.Read.AuthenticationMethod
• Policy.Read.B2BManagementPolicy
• Policy.Read.ConditionalAccess
• Policy.Read.DeviceConfiguration
• Policy.Read.IdentityProtection
• Policy.Read.PermissionGrant
• Policy.ReadWrite.AccessReview
• Policy.ReadWrite.ApplicationConfiguration
• Policy.ReadWrite.AuthenticationFlows
• Policy.ReadWrite.AuthenticationMethod
• Policy.ReadWrite.Authorization
• Policy.ReadWrite.B2BManagementPolicy
• Policy.ReadWrite.ConditionalAccess
• Policy.ReadWrite.ConsentRequest
• Policy.ReadWrite.CrossTenantAccess
• Policy.ReadWrite.CrossTenantCapability
• Policy.ReadWrite.DeviceConfiguration
• Policy.ReadWrite.ExternalIdentities
• Policy.ReadWrite.FeatureRollout
• Policy.ReadWrite.FedTokenValidation
• Policy.ReadWrite.IdentityProtection
• Policy.ReadWrite.MobilityManagement
• Policy.ReadWrite.PermissionGrant
• Policy.ReadWrite.SecurityDefaults
• Policy.ReadWrite.TrustFramework
• PrivilegedAccess-CustomExt.Read.All
• PrivilegedAccess.Read.AzureAD
• PrivilegedAccess.Read.AzureADGroup
• PrivilegedAssignmentSchedule.Read.AzureADGroup
• PrivilegedAssignmentSchedule.Read.EntraAppRole
• PrivilegedEligibilitySchedule.Read.AzureADGroup
• PrivilegedEligibilitySchedule.Read.EntraAppRole
• ProgramControl.Read.All
• ProgramControl.ReadWrite.All
• ProvisioningLog.Read.All
• RecordsManagement.Read.All
• RecordsManagement.ReadWrite.All
• Reports.Read.All
• ReportSettings.Read.All
• RiskPreventionProviders.Read.All
• RiskPreventionProviders.ReadWrite.All
• RoleManagement.Read.All
• RoleManagement.Read.CloudPC
• RoleManagement.Read.Defender
• RoleManagement.Read.Directory
• RoleManagement.Read.Exchange
• RoleManagement.ReadWrite.CloudPC
• RoleManagement.ReadWrite.Defender
• RoleManagement.ReadWrite.Directory
• RoleManagement.ReadWrite.Exchange
• RoleManagementAlert.Read.Directory
• RoleManagementPolicy.Read.AzureADGroup
• RoleManagementPolicy.Read.Directory
• RoleManagementPolicy.Read.EntraAppRole
• Schedule.Read.All
• Schedule.ReadWrite.All
• SchedulePermissions.ReadWrite.All
• SearchConfiguration.Read.All
• SearchConfiguration.ReadWrite.All
• SecurityAlert.Read.All
• SecurityAlert.ReadWrite.All
• SecurityAnalyzedMessage.Read.All
• SecurityAnalyzedMessage.ReadWrite.All
• SecurityEvents.Read.All
• SecurityEvents.ReadWrite.All
• SecurityIdentitiesAccount.Read.All
• SecurityIdentitiesActions.ReadWrite.All
• SecurityIdentitiesAutoConfig.Read.All
• SecurityIdentitiesAutoConfig.ReadWrite.All
• SecurityIdentitiesHealth.Read.All
• SecurityIdentitiesHealth.ReadWrite.All
• SecurityIdentitiesMigration.Read.All
• SecurityIdentitiesMigration.ReadWrite.All
• SecurityIdentitiesSensors.Read.All
• SecurityIdentitiesSensors.ReadWrite.All
• SecurityIdentitiesUserActions.Read.All
• SecurityIdentitiesUserActions.ReadWrite.All
• SecurityIncident.Read.All
• SecurityIncident.ReadWrite.All
• SensitivityLabel.Evaluate
• SensitivityLabel.Evaluate.All
• SensitivityLabel.Read
• SensitivityLabels.Read.All
• ServiceActivity-Exchange.Read.All
• ServiceActivity-Microsoft365Web.Read.All
• ServiceActivity-OneDrive.Read.All
• ServiceActivity-Teams.Read.All
• ServiceHealth.Read.All
• ServiceMessage.Read.All
• ServiceMessageViewpoint.Write
• ServicePrincipalEndpoint.Read.All
• ServicePrincipalEndpoint.ReadWrite.All
• SharePointCrossTenantMigration.Manage.All
• SharePointTenantSettings.Read.All
• SharePointTenantSettings.ReadWrite.All
• SignInIdentifier.Read.All
• SignInIdentifier.ReadWrite.All
• Sites.FullControl.All
• Sites.Manage.All
• Sites.Read.All
• Sites.ReadWrite.All
• SubjectRightsRequest.Read.All
• SubjectRightsRequest.ReadWrite.All
• Team.Create
• Team.ReadBasic.All
• TeamMember.Read.All
• TeamMember.ReadWrite.All
• TeamsActivity.Read
• TeamsActivity.Send
• TeamsAppInstallation.ReadWriteAndConsentForTeam
• TeamSettings.Read.All
• TeamSettings.ReadWrite.All
• TeamsPolicyUserAssign.ReadWrite.All
• TeamsResourceAccount.Read.All
• TeamsTab.Create
• TeamsTab.Read.All
• TeamsTab.ReadWrite.All
• TeamsTelephoneNumber.Read.All
• TeamsTelephoneNumber.ReadWrite.All
• TeamsUserConfiguration.Read.All
• TenantGovernance-Invitation.Read.All
• TenantGovernance-Invitation.ReadWrite.All
• TenantGovernance-PolicyTemplate.Read.All
• TenantGovernance-PolicyTemplate.ReadWrite.All
• TenantGovernance-RelatedTenant.Read.All
• TenantGovernance-RelatedTenant.ReadWrite.All
• TenantGovernance-Relationship.Read.All
• TenantGovernance-Relationship.ReadWrite.All
• TenantGovernance-Request.Read.All
• TenantGovernance-Request.ReadWrite.All
• TenantGovernance-Setting.Read.All
• TenantGovernance-Setting.ReadWrite.All
• TermStore.Read.All
• TermStore.ReadWrite.All
• ThreatHunting.Read.All
• ThreatIntelligence.Read.All
• ThreatSubmission.Read.All
• ThreatSubmission.ReadWrite.All
• ThreatSubmissionPolicy.ReadWrite.All
• User-ConvertToInternal.ReadWrite.All
• User-LifeCycleInfo.Read.All
• User-LifeCycleInfo.ReadWrite.All
• User-Mail.ReadWrite.All
• User-OnPremisesSyncBehavior.ReadWrite.All
• User-PasswordProfile.ReadWrite.All
• User.Create
• User.DeleteRestore.All
• User.EnableDisableAccount.All
• User.Export.All
• User.Invite.All
• User.ManageIdentities.All
• User.Read.All
• User.ReadBasic.All
• User.ReadWrite.All
• User.RevokeSessions.All
• UserAuthenticationMethod.Read.All
• UserAuthenticationMethod.ReadWrite.All
• UserAuthMethod-External.ReadWrite.All
• UserAuthMethod-HardwareOATH.ReadWrite.All
• UserAuthMethod-TAP.ReadWrite.All
• VerifiedId-Profile.Read.All
• VerifiedId-Profile.ReadWrite.All
• WindowsUpdates.Read.All
• WindowsUpdates.ReadWrite.All