← All Roles

Hybrid Identity Administrator

PrivilegedEnabled
Versionv1
Date Added2026-06-21
Categoryidentity
Assignment Modeallowed
Built-inYes
Template ID8ac3fc64-6eca-42ea-9e69-59f4c7b60eb2

Attack path

A compromised Hybrid Identity Administrator can alter settings used to connect on-premises identity systems to Microsoft Entra ID. Depending on the organisation's federation, provisioning and synchronisation design, an attacker could redirect or weaken a trusted authentication flow, interfere with provisioning, or use stored connector information to pursue the on-premises synchronisation infrastructure. A successful attack against that trust boundary may allow forged or manipulated identities to be accepted in the cloud, making this role a route between the Entra tenant and Active Directory.

Description

Can manage Active Directory to Microsoft Entra cloud provisioning, Microsoft Entra Connect, and federation settings.

Details

Users in this role can create, manage, and deploy provisioning configuration setup from Active Directory to Microsoft Entra ID using Cloud Provisioning as well as manage federation settings. Users can also troubleshoot and monitor logs using this role.

Directory Actions61

ActionCondition
microsoft.azure.serviceHealth/allEntities/allTasksnull
microsoft.azure.supportTickets/allEntities/allTasksnull
microsoft.directory/applications/appRoles/updatenull
microsoft.directory/applications/audience/updatenull
microsoft.directory/applications/authentication/updatenull
microsoft.directory/applications/basic/updatenull
microsoft.directory/applications/createnull
microsoft.directory/applications/deletenull
microsoft.directory/applications/disablement/updatenull
microsoft.directory/applications/notes/updatenull
microsoft.directory/applications/owners/updatenull
microsoft.directory/applications/permissions/updatenull
microsoft.directory/applications/policies/updatenull
microsoft.directory/applications/synchronization/standard/readnull
microsoft.directory/applications/tag/updatenull
microsoft.directory/applicationTemplates/instantiatenull
microsoft.directory/auditLogs/allProperties/readnull
microsoft.directory/cloudProvisioning/allProperties/allTasksnull
microsoft.directory/deletedItems.applications/deletenull
microsoft.directory/deletedItems.applications/restorenull
microsoft.directory/domains/allProperties/readnull
microsoft.directory/domains/federationConfiguration/basic/updatenull
microsoft.directory/domains/federationConfiguration/createnull
microsoft.directory/domains/federationConfiguration/deletenull
microsoft.directory/domains/federationConfiguration/standard/readnull
microsoft.directory/domains/federation/updatenull
microsoft.directory/hybridAuthenticationPolicy/allProperties/allTasksnull
microsoft.directory/onPremisesSynchronization/basic/updatenull
microsoft.directory/onPremisesSynchronization/standard/readnull
microsoft.directory/organization/dirSync/updatenull
microsoft.directory/passwordHashSync/allProperties/allTasksnull
microsoft.directory/provisioningLogs/allProperties/readnull
microsoft.directory/servicePrincipals/appRoleAssignedTo/updatenull
microsoft.directory/servicePrincipals/audience/updatenull
microsoft.directory/servicePrincipals/authentication/updatenull
microsoft.directory/servicePrincipals/basic/updatenull
microsoft.directory/servicePrincipals/createnull
microsoft.directory/servicePrincipals/deletenull
microsoft.directory/servicePrincipals/disablenull
microsoft.directory/servicePrincipals/enablenull
microsoft.directory/servicePrincipals/notes/updatenull
microsoft.directory/servicePrincipals/owners/updatenull
microsoft.directory/servicePrincipals/permissions/updatenull
microsoft.directory/servicePrincipals/policies/updatenull
microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/credentials/managenull
microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/jobs/managenull
microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/schema/managenull
microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/credentials/managenull
microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/jobs/managenull
microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/schema/managenull
microsoft.directory/servicePrincipals/synchronizationCredentials/managenull
microsoft.directory/servicePrincipals/synchronizationJobs/managenull
microsoft.directory/servicePrincipals/synchronizationSchema/managenull
microsoft.directory/servicePrincipals/synchronization/standard/readnull
microsoft.directory/servicePrincipals/tag/updatenull
microsoft.directory/signInReports/allProperties/readnull
microsoft.directory/users/authorizationInfo/updatenull
microsoft.office365.messageCenter/messages/readnull
microsoft.office365.serviceHealth/allEntities/allTasksnull
microsoft.office365.supportTickets/allEntities/allTasksnull
microsoft.office365.webPortal/allEntities/standard/readnull

Graph API Permissions55

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

  • Application.Read.All
  • Application.ReadUpdate.All
  • Application.ReadWrite.All
  • AppRoleAssignment.ReadWrite.All
  • AuditLog.Read.All
  • AuditLogsQuery-Entra.Read.All
  • AuditLogsQuery.Read.All
  • ChangeManagement.Read.All
  • Directory.Read.All
  • Domain-InternalFederation.ReadWrite.All
  • Domain.Read.All
  • Domain.ReadWrite.All
  • LicenseAssignment.Read.All
  • LicenseAssignment.ReadWrite.All
  • OnPremDirectorySynchronization.Read.All
  • OnPremDirectorySynchronization.ReadWrite.All
  • Organization.Read.All
  • Organization.ReadWrite.All
  • Policy.Read.All
  • Policy.ReadWrite.AuthenticationMethod
  • ProvisioningLog.Read.All
  • ServiceActivity-Exchange.Read.All
  • ServiceActivity-Microsoft365Web.Read.All
  • ServiceActivity-OneDrive.Read.All
  • ServiceActivity-Teams.Read.All
  • ServiceHealth.Read.All
  • ServiceMessage.Read.All
  • ServiceMessageViewpoint.Write
  • ServicePrincipalEndpoint.Read.All
  • ServicePrincipalEndpoint.ReadWrite.All
  • SignInIdentifier.Read.All
  • SignInIdentifier.ReadWrite.All
  • Synchronization.Read.All
  • Synchronization.ReadWrite.All
  • User-ConvertToInternal.ReadWrite.All
  • User-LifeCycleInfo.Read.All
  • User-LifeCycleInfo.ReadWrite.All
  • User-Mail.ReadWrite.All
  • User-OnPremisesSyncBehavior.ReadWrite.All
  • User-PasswordProfile.ReadWrite.All
  • User.Create
  • User.DeleteRestore.All
  • User.EnableDisableAccount.All
  • User.Export.All
  • User.Invite.All
  • User.ManageIdentities.All
  • User.Read.All
  • User.ReadBasic.All
  • User.ReadWrite.All
  • User.RevokeSessions.All
  • UserAuthenticationMethod.Read.All
  • UserAuthenticationMethod.ReadWrite.All
  • UserAuthMethod-External.ReadWrite.All
  • UserAuthMethod-HardwareOATH.ReadWrite.All
  • UserAuthMethod-TAP.ReadWrite.All