Global Secure Access Administrator

Description

Create and manage all aspects of Global Secure Internet Access and Microsoft Global Secure Private Access, including managing access to public and private endpoints.

Details

Users with this role have global permissions within Microsoft Global Secure network access solutions, including full read-write access to the admin portal for Global Secure Internet Access and Global Secure Private Access. This role does not grant the ability to manage enterprise applications, application registrations, and application proxy settings.

Directory Actions20

• microsoft.azure.supportTickets/allEntities/allTasks
• microsoft.directory/applicationPolicies/standard/read
• microsoft.directory/applications/applicationProxy/read
• microsoft.directory/applications/owners/read
• microsoft.directory/applications/policies/read
• microsoft.directory/applications/standard/read
• microsoft.directory/auditLogs/allProperties/read
• microsoft.directory/conditionalAccessPolicies/standard/read
• microsoft.directory/connectorGroups/allProperties/read
• microsoft.directory/connectors/allProperties/read
• microsoft.directory/crossTenantAccessPolicy/default/standard/read
• microsoft.directory/crossTenantAccessPolicy/partners/standard/read
• microsoft.directory/crossTenantAccessPolicy/standard/read
• microsoft.directory/namedLocations/standard/read
• microsoft.directory/signInReports/allProperties/read
• microsoft.networkAccess/allEntities/allProperties/allTasks
• microsoft.office365.messageCenter/messages/read
• microsoft.office365.serviceHealth/allEntities/allTasks
• microsoft.office365.supportTickets/allEntities/allTasks
• microsoft.office365.webPortal/allEntities/standard/read

Graph API Permissions20

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

• Application.Read.All
• AuditLog.Read.All
• AuditLogsQuery-Entra.Read.All
• AuditLogsQuery.Read.All
• ChangeManagement.Read.All
• CrossTenantInformation.ReadBasic.All
• Directory.Read.All
• NetworkAccess-Reports.Read.All
• NetworkAccess.Read.All
• NetworkAccess.ReadWrite.All
• NetworkAccessBranch.Read.All
• NetworkAccessBranch.ReadWrite.All
• NetworkAccessPolicy.Read.All
• NetworkAccessPolicy.ReadWrite.All
• Policy.Read.All
• Policy.Read.ConditionalAccess
• ServiceHealth.Read.All
• ServiceMessage.Read.All
• ServiceMessageViewpoint.Write
• ServicePrincipalEndpoint.Read.All