Security Administrator

Description

Can read security information and reports, and manage configuration in Microsoft Entra ID and Office 365.

Details

Users with this role have all of the read-only permissions of the Security reader role, plus the ability to manage configuration for security-related services: Microsoft Entra ID Protection, Azure Information Protection, Privileged Identity Management, and Office 365 Security & Compliance Center.

Directory Actions82

• microsoft.agentRegistry/allEntities/allProperties/read
• microsoft.azure.serviceHealth/allEntities/allTasks
• microsoft.azure.supportTickets/allEntities/allTasks
• microsoft.directory/applications/policies/update
• microsoft.directory/auditLogs/allProperties/read
• microsoft.directory/authorizationPolicy/standard/read
• microsoft.directory/bitlockerKeys/key/read
• microsoft.directory/bulkJobs/standard/read
• microsoft.directory/conditionalAccessPolicies/basic/update
• microsoft.directory/conditionalAccessPolicies/create
• microsoft.directory/conditionalAccessPolicies/delete
• microsoft.directory/conditionalAccessPolicies/owners/read
• microsoft.directory/conditionalAccessPolicies/owners/update
• microsoft.directory/conditionalAccessPolicies/policyAppliedTo/read
• microsoft.directory/conditionalAccessPolicies/standard/read
• microsoft.directory/conditionalAccessPolicies/tenantDefault/update
• microsoft.directory/crossTenantAccessPolicy/allowedCloudEndpoints/update
• microsoft.directory/crossTenantAccessPolicy/basic/update
• microsoft.directory/crossTenantAccessPolicy/default/b2bCollaboration/update
• microsoft.directory/crossTenantAccessPolicy/default/b2bDirectConnect/update
• microsoft.directory/crossTenantAccessPolicy/default/crossCloudMeetings/update
• microsoft.directory/crossTenantAccessPolicy/default/standard/read
• microsoft.directory/crossTenantAccessPolicy/default/tenantRestrictions/update
• microsoft.directory/crossTenantAccessPolicy/partners/b2bCollaboration/update
• microsoft.directory/crossTenantAccessPolicy/partners/b2bDirectConnect/update
• microsoft.directory/crossTenantAccessPolicy/partners/create
• microsoft.directory/crossTenantAccessPolicy/partners/crossCloudMeetings/update
• microsoft.directory/crossTenantAccessPolicy/partners/delete
• microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/basic/update
• microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/create
• microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/standard/read
• microsoft.directory/crossTenantAccessPolicy/partners/standard/read
• microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/basic/update
• microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/resetToDefaultSettings
• microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/standard/read
• microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/basic/update
• microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/resetToDefaultSettings
• microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/standard/read
• microsoft.directory/crossTenantAccessPolicy/partners/tenantRestrictions/update
• microsoft.directory/crossTenantAccessPolicy/standard/read
• microsoft.directory/deviceLocalCredentials/standard/read
• microsoft.directory/domains/federationConfiguration/basic/update
• microsoft.directory/domains/federationConfiguration/create
• microsoft.directory/domains/federationConfiguration/delete
• microsoft.directory/domains/federationConfiguration/standard/read
• microsoft.directory/domains/federation/update
• microsoft.directory/entitlementManagement/allProperties/read
• microsoft.directory/identityProtection/allProperties/read
• microsoft.directory/identityProtection/allProperties/update
• microsoft.directory/multiTenantOrganization/basic/update
• microsoft.directory/multiTenantOrganization/create
• microsoft.directory/multiTenantOrganization/joinRequest/organizationDetails/update
• microsoft.directory/multiTenantOrganization/joinRequest/standard/read
• microsoft.directory/multiTenantOrganization/standard/read
• microsoft.directory/multiTenantOrganization/tenants/create
• microsoft.directory/multiTenantOrganization/tenants/delete
• microsoft.directory/multiTenantOrganization/tenants/organizationDetails/read
• microsoft.directory/multiTenantOrganization/tenants/organizationDetails/update
• microsoft.directory/multiTenantOrganization/tenants/standard/read
• microsoft.directory/namedLocations/basic/update
• microsoft.directory/namedLocations/create
• microsoft.directory/namedLocations/delete
• microsoft.directory/namedLocations/standard/read
• microsoft.directory/policies/basic/update
• microsoft.directory/policies/create
• microsoft.directory/policies/delete
• microsoft.directory/policies/owners/update
• microsoft.directory/policies/tenantDefault/update
• microsoft.directory/privilegedIdentityManagement/allProperties/read
• microsoft.directory/provisioningLogs/allProperties/read
• microsoft.directory/resourceNamespaces/resourceActions/authenticationContext/update
• microsoft.directory/servicePrincipals/policies/update
• microsoft.directory/signInReports/allProperties/read
• microsoft.networkAccess/allEntities/allProperties/allTasks
• microsoft.office365.protectionCenter/allEntities/basic/update
• microsoft.office365.protectionCenter/allEntities/standard/read
• microsoft.office365.protectionCenter/attackSimulator/payload/allProperties/allTasks
• microsoft.office365.protectionCenter/attackSimulator/reports/allProperties/read
• microsoft.office365.protectionCenter/attackSimulator/simulation/allProperties/allTasks
• microsoft.office365.serviceHealth/allEntities/allTasks
• microsoft.office365.supportTickets/allEntities/allTasks
• microsoft.office365.webPortal/allEntities/standard/read

Graph API Permissions107

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

• AgentCard.Read.All
• AgentCardManifest.Read.All
• AgentCollection.Read.All
• AgentInstance.Read.All
• AgentRegistration.Read.All
• Application.Read.All
• Application.ReadUpdate.All
• Application.ReadWrite.All
• AppRoleAssignment.ReadWrite.All
• AttackSimulation.Read.All
• AttackSimulation.ReadWrite.All
• AuditLog.Read.All
• AuditLogsQuery-Entra.Read.All
• AuditLogsQuery.Read.All
• BitlockerKey.ReadBasic.All
• ChangeManagement.Read.All
• CrossTenantInformation.ReadBasic.All
• CustomDetection.Read.All
• CustomDetection.ReadWrite.All
• DeviceLocalCredential.ReadBasic.All
• Directory.Read.All
• Domain-InternalFederation.ReadWrite.All
• Domain.Read.All
• Domain.ReadWrite.All
• EntitlementManagement.Read.All
• IdentityRiskEvent.Read.All
• IdentityRiskEvent.ReadWrite.All
• IdentityRiskyAgent.Read.All
• IdentityRiskyAgent.ReadWrite.All
• IdentityRiskyServicePrincipal.Read.All
• IdentityRiskyServicePrincipal.ReadWrite.All
• IdentityRiskyUser.Read.All
• IdentityRiskyUser.ReadWrite.All
• MultiTenantOrganization.Read.All
• MultiTenantOrganization.ReadBasic.All
• MultiTenantOrganization.ReadWrite.All
• NetworkAccess-Reports.Read.All
• NetworkAccess.Read.All
• NetworkAccess.ReadWrite.All
• NetworkAccessBranch.Read.All
• NetworkAccessBranch.ReadWrite.All
• NetworkAccessPolicy.Read.All
• NetworkAccessPolicy.ReadWrite.All
• Policy.Read.All
• Policy.Read.AuthenticationMethod
• Policy.Read.B2BManagementPolicy
• Policy.Read.ConditionalAccess
• Policy.Read.DeviceConfiguration
• Policy.Read.IdentityProtection
• Policy.Read.PermissionGrant
• Policy.ReadWrite.AccessReview
• Policy.ReadWrite.ApplicationConfiguration
• Policy.ReadWrite.AuthenticationFlows
• Policy.ReadWrite.AuthenticationMethod
• Policy.ReadWrite.Authorization
• Policy.ReadWrite.B2BManagementPolicy
• Policy.ReadWrite.ConditionalAccess
• Policy.ReadWrite.ConsentRequest
• Policy.ReadWrite.CrossTenantAccess
• Policy.ReadWrite.CrossTenantCapability
• Policy.ReadWrite.DeviceConfiguration
• Policy.ReadWrite.ExternalIdentities
• Policy.ReadWrite.FeatureRollout
• Policy.ReadWrite.FedTokenValidation
• Policy.ReadWrite.IdentityProtection
• Policy.ReadWrite.MobilityManagement
• Policy.ReadWrite.PermissionGrant
• Policy.ReadWrite.SecurityDefaults
• Policy.ReadWrite.TrustFramework
• PrivilegedAccess-CustomExt.Read.All
• PrivilegedAccess.Read.AzureAD
• PrivilegedAccess.Read.AzureADGroup
• PrivilegedAssignmentSchedule.Read.AzureADGroup
• PrivilegedAssignmentSchedule.Read.EntraAppRole
• PrivilegedEligibilitySchedule.Read.AzureADGroup
• PrivilegedEligibilitySchedule.Read.EntraAppRole
• ProvisioningLog.Read.All
• RiskPreventionProviders.Read.All
• RiskPreventionProviders.ReadWrite.All
• RoleManagement.Read.Directory
• RoleManagement.ReadWrite.Directory
• RoleManagementAlert.Read.Directory
• RoleManagementPolicy.Read.AzureADGroup
• RoleManagementPolicy.Read.Directory
• RoleManagementPolicy.Read.EntraAppRole
• SecurityAlert.Read.All
• SecurityAlert.ReadWrite.All
• SecurityAnalyzedMessage.Read.All
• SecurityAnalyzedMessage.ReadWrite.All
• SecurityEvents.Read.All
• SecurityEvents.ReadWrite.All
• SecurityIncident.Read.All
• SecurityIncident.ReadWrite.All
• ServiceActivity-Exchange.Read.All
• ServiceActivity-Microsoft365Web.Read.All
• ServiceActivity-OneDrive.Read.All
• ServiceActivity-Teams.Read.All
• ServiceHealth.Read.All
• ServiceMessage.Read.All
• ServiceMessageViewpoint.Write
• ServicePrincipalEndpoint.Read.All
• ServicePrincipalEndpoint.ReadWrite.All
• ThreatHunting.Read.All
• ThreatIntelligence.Read.All
• ThreatSubmission.Read.All
• ThreatSubmission.ReadWrite.All
• ThreatSubmissionPolicy.ReadWrite.All