← All Roles

Partner Tier2 Support

PrivilegedEnabled
Versionv1
Date Added2026-06-21
Categoryother
Assignment Modeallowed
Built-inYes
Template IDe00e864a-17c5-4a4b-9c06-f5b95a8d5bd8

Description

Do not use - not intended for general use.

Directory Actions46

ActionCondition
microsoft.azure.serviceHealth/allEntities/allTasksnull
microsoft.azure.supportTickets/allEntities/allTasksnull
microsoft.directory/applications/appRoles/updatenull
microsoft.directory/applications/audience/updatenull
microsoft.directory/applications/authentication/updatenull
microsoft.directory/applications/basic/updatenull
microsoft.directory/applications/credentials/updatenull
microsoft.directory/applications/notes/updatenull
microsoft.directory/applications/owners/updatenull
microsoft.directory/applications/permissions/updatenull
microsoft.directory/applications/policies/updatenull
microsoft.directory/applications/tag/updatenull
microsoft.directory/contacts/basic/updatenull
microsoft.directory/contacts/createnull
microsoft.directory/contacts/deletenull
microsoft.directory/deletedItems.groups/restorenull
microsoft.directory/deletedItems.users/restorenull
microsoft.directory/domains/allProperties/allTasksnull
microsoft.directory/groups/createnull
microsoft.directory/groups/deletenull
microsoft.directory/groups/members/updatenull
microsoft.directory/groups/owners/updatenull
microsoft.directory/groups/restorenull
microsoft.directory/groups.unified/assignedLabels/updatenull
microsoft.directory/oAuth2PermissionGrants/allProperties/allTasksnull
microsoft.directory/organization/basic/updatenull
microsoft.directory/roleAssignments/allProperties/allTasksnull
microsoft.directory/roleDefinitions/allProperties/allTasksnull
microsoft.directory/scopedRoleMemberships/allProperties/allTasksnull
microsoft.directory/servicePrincipals/appRoleAssignedTo/updatenull
microsoft.directory/subscribedSkus/standard/readnull
microsoft.directory/users/assignLicensenull
microsoft.directory/users/basic/updatenull
microsoft.directory/users/createnull
microsoft.directory/users/deletenull
microsoft.directory/users/disablenull
microsoft.directory/users/enablenull
microsoft.directory/users/invalidateAllRefreshTokensnull
microsoft.directory/users/manager/updatenull
microsoft.directory/users/password/updatenull
microsoft.directory/users/photo/updatenull
microsoft.directory/users/restorenull
microsoft.directory/users/userPrincipalName/updatenull
microsoft.office365.serviceHealth/allEntities/allTasksnull
microsoft.office365.supportTickets/allEntities/allTasksnull
microsoft.office365.webPortal/allEntities/standard/readnull

Graph API Permissions61

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

  • AdministrativeUnit.Read.All
  • AdministrativeUnit.ReadWrite.All
  • Application.Read.All
  • Application.ReadUpdate.All
  • Application.ReadWrite.All
  • AppRoleAssignment.ReadWrite.All
  • ChangeManagement.Read.All
  • DelegatedPermissionGrant.Read.All
  • DelegatedPermissionGrant.ReadWrite.All
  • Directory.Read.All
  • Domain-InternalFederation.ReadWrite.All
  • Domain.Read.All
  • Domain.ReadWrite.All
  • Group.Read.All
  • Group.ReadWrite.All
  • GroupMember.Read.All
  • GroupMember.ReadWrite.All
  • GroupSettings.Read.All
  • GroupSettings.ReadWrite.All
  • LicenseAssignment.Read.All
  • LicenseAssignment.ReadWrite.All
  • Organization.Read.All
  • Organization.ReadWrite.All
  • OrgContact.Read.All
  • Policy.Read.PermissionGrant
  • Policy.ReadWrite.PermissionGrant
  • RoleManagement.Read.All
  • RoleManagement.Read.Directory
  • RoleManagement.ReadWrite.Directory
  • ServiceActivity-Exchange.Read.All
  • ServiceActivity-Microsoft365Web.Read.All
  • ServiceActivity-OneDrive.Read.All
  • ServiceActivity-Teams.Read.All
  • ServiceHealth.Read.All
  • ServiceMessage.Read.All
  • ServiceMessageViewpoint.Write
  • ServicePrincipalEndpoint.Read.All
  • ServicePrincipalEndpoint.ReadWrite.All
  • SignInIdentifier.Read.All
  • SignInIdentifier.ReadWrite.All
  • User-ConvertToInternal.ReadWrite.All
  • User-LifeCycleInfo.Read.All
  • User-LifeCycleInfo.ReadWrite.All
  • User-Mail.ReadWrite.All
  • User-OnPremisesSyncBehavior.ReadWrite.All
  • User-PasswordProfile.ReadWrite.All
  • User.Create
  • User.DeleteRestore.All
  • User.EnableDisableAccount.All
  • User.Export.All
  • User.Invite.All
  • User.ManageIdentities.All
  • User.Read.All
  • User.ReadBasic.All
  • User.ReadWrite.All
  • User.RevokeSessions.All
  • UserAuthenticationMethod.Read.All
  • UserAuthenticationMethod.ReadWrite.All
  • UserAuthMethod-External.ReadWrite.All
  • UserAuthMethod-HardwareOATH.ReadWrite.All
  • UserAuthMethod-TAP.ReadWrite.All