← All Roles

IoT Device Administrator

Enabled
Versionv1
Date Added2026-06-21
Categorydevices,identity
Assignment Modeallowed
Built-inYes
Template ID2ea5ce4c-b2d8-4668-bd81-3680bd2d227a

Description

Provision new IoT devices, manage their lifecycle, configure certificates, and manage device templates.

Details

Assign the IoT Device Administrator role to users who need to do the following tasks:

  • Provision new IoT devices using device templates
  • Manage the lifecycle of IoT devices
  • Configure certificates used for IoT device authentication
  • Manage the lifecycle of IoT device templates

Directory Actions10

  • microsoft.directory/certificateBasedDeviceAuthConfigurations/create
  • microsoft.directory/certificateBasedDeviceAuthConfigurations/credentials/update
  • microsoft.directory/certificateBasedDeviceAuthConfigurations/delete
  • microsoft.directory/certificateBasedDeviceAuthConfigurations/standard/read
  • microsoft.directory/deviceTemplates/create
  • microsoft.directory/deviceTemplates/createDeviceFromTemplate
  • microsoft.directory/deviceTemplates/delete
  • microsoft.directory/deviceTemplates/deviceInstances/read
  • microsoft.directory/deviceTemplates/owners/read
  • microsoft.directory/deviceTemplates/owners/update

Graph API Permissions4

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

  • DeviceTemplate.Read.All
  • DeviceTemplate.ReadWrite.All
  • Policy.Read.All
  • Policy.ReadWrite.AuthenticationMethod