Partner Tier1 Support

Description

Do not use - not intended for general use.

Directory Actions40

• microsoft.azure.serviceHealth/allEntities/allTasks
• microsoft.azure.supportTickets/allEntities/allTasks
• microsoft.directory/applications/appRoles/update
• microsoft.directory/applications/audience/update
• microsoft.directory/applications/authentication/update
• microsoft.directory/applications/basic/update
• microsoft.directory/applications/credentials/update
• microsoft.directory/applications/notes/update
• microsoft.directory/applications/owners/update
• microsoft.directory/applications/permissions/update
• microsoft.directory/applications/policies/update
• microsoft.directory/applications/tag/update
• microsoft.directory/contacts/basic/update
• microsoft.directory/contacts/create
• microsoft.directory/contacts/delete
• microsoft.directory/deletedItems.groups/restore
• microsoft.directory/deletedItems.users/restore
• microsoft.directory/groups/create
• microsoft.directory/groups/delete
• microsoft.directory/groups/members/update
• microsoft.directory/groups/owners/update
• microsoft.directory/groups/restore
• microsoft.directory/groups.unified/assignedLabels/update
• microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks
• microsoft.directory/servicePrincipals/appRoleAssignedTo/update
• microsoft.directory/users/assignLicense
• microsoft.directory/users/basic/update
• microsoft.directory/users/create
• microsoft.directory/users/delete
• microsoft.directory/users/disable
• microsoft.directory/users/enable
• microsoft.directory/users/invalidateAllRefreshTokens
• microsoft.directory/users/manager/update
• microsoft.directory/users/password/update
• microsoft.directory/users/photo/update
• microsoft.directory/users/restore
• microsoft.directory/users/userPrincipalName/update
• microsoft.office365.serviceHealth/allEntities/allTasks
• microsoft.office365.supportTickets/allEntities/allTasks
• microsoft.office365.webPortal/allEntities/standard/read

Graph API Permissions51

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

• Application.Read.All
• Application.ReadUpdate.All
• Application.ReadWrite.All
• AppRoleAssignment.ReadWrite.All
• ChangeManagement.Read.All
• DelegatedPermissionGrant.Read.All
• DelegatedPermissionGrant.ReadWrite.All
• Directory.Read.All
• Group.Read.All
• Group.ReadWrite.All
• GroupMember.Read.All
• GroupMember.ReadWrite.All
• GroupSettings.Read.All
• GroupSettings.ReadWrite.All
• LicenseAssignment.Read.All
• LicenseAssignment.ReadWrite.All
• OrgContact.Read.All
• Policy.Read.PermissionGrant
• Policy.ReadWrite.PermissionGrant
• ServiceActivity-Exchange.Read.All
• ServiceActivity-Microsoft365Web.Read.All
• ServiceActivity-OneDrive.Read.All
• ServiceActivity-Teams.Read.All
• ServiceHealth.Read.All
• ServiceMessage.Read.All
• ServiceMessageViewpoint.Write
• ServicePrincipalEndpoint.Read.All
• ServicePrincipalEndpoint.ReadWrite.All
• SignInIdentifier.Read.All
• SignInIdentifier.ReadWrite.All
• User-ConvertToInternal.ReadWrite.All
• User-LifeCycleInfo.Read.All
• User-LifeCycleInfo.ReadWrite.All
• User-Mail.ReadWrite.All
• User-OnPremisesSyncBehavior.ReadWrite.All
• User-PasswordProfile.ReadWrite.All
• User.Create
• User.DeleteRestore.All
• User.EnableDisableAccount.All
• User.Export.All
• User.Invite.All
• User.ManageIdentities.All
• User.Read.All
• User.ReadBasic.All
• User.ReadWrite.All
• User.RevokeSessions.All
• UserAuthenticationMethod.Read.All
• UserAuthenticationMethod.ReadWrite.All
• UserAuthMethod-External.ReadWrite.All
• UserAuthMethod-HardwareOATH.ReadWrite.All
• UserAuthMethod-TAP.ReadWrite.All