← All Roles

Password Administrator

PrivilegedEnabled
Versionv1
Date Added2026-06-21
Categoryidentity
Assignment Modeallowed
Built-inYes
Template ID966707d0-3269-4727-9be2-8c3a10f19b9d

Attack path

Password Administrator can reset passwords for non-administrative users. An attacker could target an ordinary account that owns a privileged application registration, administers a sensitive external service, or can approve access that leads to elevated privileges. After taking over that account, they may be able to add credentials to an application and authenticate with its existing permissions. The path is indirect and depends on privileged ownership or access having been assigned to an otherwise unprotected user.

Description

Can reset passwords for non-administrators and Password Administrators.

Details

Users with this role have limited ability to manage passwords. This role does not grant the ability to manage service requests or monitor service health. Password administrators can reset passwords of other users who are non-administrators or members of the following roles only:

  • Directory readers
  • Guest inviter
  • Password administrator

Directory Actions2

ActionCondition
microsoft.directory/users/password/updatenull
microsoft.office365.webPortal/allEntities/standard/readnull

Graph API Permissions26

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

  • Directory.Read.All
  • LicenseAssignment.Read.All
  • LicenseAssignment.ReadWrite.All
  • SignInIdentifier.Read.All
  • SignInIdentifier.ReadWrite.All
  • User-ConvertToInternal.ReadWrite.All
  • User-LifeCycleInfo.Read.All
  • User-LifeCycleInfo.ReadWrite.All
  • User-Mail.ReadWrite.All
  • User-OnPremisesSyncBehavior.ReadWrite.All
  • User-PasswordProfile.ReadWrite.All
  • User.Create
  • User.DeleteRestore.All
  • User.EnableDisableAccount.All
  • User.Export.All
  • User.Invite.All
  • User.ManageIdentities.All
  • User.Read.All
  • User.ReadBasic.All
  • User.ReadWrite.All
  • User.RevokeSessions.All
  • UserAuthenticationMethod.Read.All
  • UserAuthenticationMethod.ReadWrite.All
  • UserAuthMethod-External.ReadWrite.All
  • UserAuthMethod-HardwareOATH.ReadWrite.All
  • UserAuthMethod-TAP.ReadWrite.All