← All Roles

License Administrator

Enabled
Versionv1
Date Added2026-06-21
Categoryidentity
Assignment Modeallowed
Built-inYes
Template ID4d6ac14f-3453-41d0-bef9-a3e0c569773a

Description

Can manage product licenses on users and groups.

Details

Users in this role can assign licenses, remove licenses and manage group license assignments.

Directory Actions9

ActionCondition
microsoft.azure.serviceHealth/allEntities/allTasksnull
microsoft.directory/authorizationPolicy/standard/readnull
microsoft.directory/groups/assignLicensenull
microsoft.directory/groups/reprocessLicenseAssignmentnull
microsoft.directory/users/assignLicensenull
microsoft.directory/users/reprocessLicenseAssignmentnull
microsoft.directory/users/usageLocation/updatenull
microsoft.office365.serviceHealth/allEntities/allTasksnull
microsoft.office365.webPortal/allEntities/standard/readnull

Graph API Permissions38

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

  • ChangeManagement.Read.All
  • Directory.Read.All
  • Group.Read.All
  • GroupMember.Read.All
  • GroupSettings.Read.All
  • LicenseAssignment.Read.All
  • LicenseAssignment.ReadWrite.All
  • Policy.Read.All
  • ServiceActivity-Exchange.Read.All
  • ServiceActivity-Microsoft365Web.Read.All
  • ServiceActivity-OneDrive.Read.All
  • ServiceActivity-Teams.Read.All
  • ServiceHealth.Read.All
  • ServiceMessage.Read.All
  • ServiceMessageViewpoint.Write
  • SignInIdentifier.Read.All
  • SignInIdentifier.ReadWrite.All
  • User-ConvertToInternal.ReadWrite.All
  • User-LifeCycleInfo.Read.All
  • User-LifeCycleInfo.ReadWrite.All
  • User-Mail.ReadWrite.All
  • User-OnPremisesSyncBehavior.ReadWrite.All
  • User-PasswordProfile.ReadWrite.All
  • User.Create
  • User.DeleteRestore.All
  • User.EnableDisableAccount.All
  • User.Export.All
  • User.Invite.All
  • User.ManageIdentities.All
  • User.Read.All
  • User.ReadBasic.All
  • User.ReadWrite.All
  • User.RevokeSessions.All
  • UserAuthenticationMethod.Read.All
  • UserAuthenticationMethod.ReadWrite.All
  • UserAuthMethod-External.ReadWrite.All
  • UserAuthMethod-HardwareOATH.ReadWrite.All
  • UserAuthMethod-TAP.ReadWrite.All