← All Roles

Security Administrator

PrivilegedEnabled
Versionv4
Last Updated2026-08-19
CategorysecurityAndCompliance
Assignment Modeallowed
Built-inYes
Template ID194ae4cb-b126-40b2-bd5b-6091b380977d

Description

Can read security information and reports, and manage configuration in Microsoft Entra ID and Office 365.

Details

Users with this role have all of the read-only permissions of the Security reader role, plus the ability to manage configuration for security-related services: Microsoft Entra ID Protection, Azure Information Protection, Privileged Identity Management, and Office 365 Security & Compliance Center.

Directory Actions86

ActionCondition
microsoft.agentRegistry/allEntities/allProperties/readnull
microsoft.azure.serviceHealth/allEntities/allTasksnull
microsoft.azure.supportTickets/allEntities/allTasksnull
microsoft.directory/applications/policies/updatenull
microsoft.directory/auditLogs/allProperties/readnull
microsoft.directory/authorizationPolicy/standard/readnull
microsoft.directory/bitlockerKeys/key/readnull
microsoft.directory/bulkJobs/standard/readnull
microsoft.directory/conditionalAccessPolicies/basic/updatenull
microsoft.directory/conditionalAccessPolicies/createnull
microsoft.directory/conditionalAccessPolicies/deletenull
microsoft.directory/conditionalAccessPolicies/owners/readnull
microsoft.directory/conditionalAccessPolicies/owners/updatenull
microsoft.directory/conditionalAccessPolicies/policyAppliedTo/readnull
microsoft.directory/conditionalAccessPolicies/standard/readnull
microsoft.directory/conditionalAccessPolicies/tenantDefault/updatenull
microsoft.directory/crossTenantAccessPolicy/allowedCloudEndpoints/updatenull
microsoft.directory/crossTenantAccessPolicy/basic/updatenull
microsoft.directory/crossTenantAccessPolicy/default/b2bCollaboration/updatenull
microsoft.directory/crossTenantAccessPolicy/default/b2bDirectConnect/updatenull
microsoft.directory/crossTenantAccessPolicy/default/crossCloudMeetings/updatenull
microsoft.directory/crossTenantAccessPolicy/default/standard/readnull
microsoft.directory/crossTenantAccessPolicy/default/tenantRestrictions/updatenull
microsoft.directory/crossTenantAccessPolicy/partners/b2bCollaboration/updatenull
microsoft.directory/crossTenantAccessPolicy/partners/b2bDirectConnect/updatenull
microsoft.directory/crossTenantAccessPolicy/partners/createnull
microsoft.directory/crossTenantAccessPolicy/partners/crossCloudMeetings/updatenull
microsoft.directory/crossTenantAccessPolicy/partners/deletenull
microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/basic/updatenull
microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/createnull
microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/standard/readnull
microsoft.directory/crossTenantAccessPolicy/partners/standard/readnull
microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/basic/updatenull
microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/resetToDefaultSettingsnull
microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/standard/readnull
microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/basic/updatenull
microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/resetToDefaultSettingsnull
microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/standard/readnull
microsoft.directory/crossTenantAccessPolicy/partners/tenantRestrictions/updatenull
microsoft.directory/crossTenantAccessPolicy/standard/readnull
microsoft.directory/deviceLocalCredentials/standard/readnull
microsoft.directory/domains/federationConfiguration/basic/updatenull
microsoft.directory/domains/federationConfiguration/createnull
microsoft.directory/domains/federationConfiguration/deletenull
microsoft.directory/domains/federationConfiguration/standard/readnull
microsoft.directory/domains/federation/updatenull
microsoft.directory/entitlementManagement/allProperties/readnull
microsoft.directory/identityProtection/allProperties/readnull
microsoft.directory/identityProtection/allProperties/updatenull
microsoft.directory/multiTenantOrganization/basic/updatenull
microsoft.directory/multiTenantOrganization/createnull
microsoft.directory/multiTenantOrganization/joinRequest/organizationDetails/updatenull
microsoft.directory/multiTenantOrganization/joinRequest/standard/readnull
microsoft.directory/multiTenantOrganization/standard/readnull
microsoft.directory/multiTenantOrganization/tenants/createnull
microsoft.directory/multiTenantOrganization/tenants/deletenull
microsoft.directory/multiTenantOrganization/tenants/organizationDetails/readnull
microsoft.directory/multiTenantOrganization/tenants/organizationDetails/updatenull
microsoft.directory/multiTenantOrganization/tenants/standard/readnull
microsoft.directory/namedLocations/basic/updatenull
microsoft.directory/namedLocations/createnull
microsoft.directory/namedLocations/deletenull
microsoft.directory/namedLocations/standard/readnull
microsoft.directory/policies/basic/updatenull
microsoft.directory/policies/createnull
microsoft.directory/policies/deletenull
microsoft.directory/policies/owners/updatenull
microsoft.directory/policies/tenantDefault/updatenull
microsoft.directory/privilegedIdentityManagement/allProperties/readnull
microsoft.directory/provisioningLogs/allProperties/readnull
microsoft.directory/resourceNamespaces/resourceActions/authenticationContext/updatenull
microsoft.directory/servicePrincipals/policies/updatenull
microsoft.directory/signInReports/allProperties/readnull
microsoft.directory/users/disablenull
microsoft.directory/users/enablenull
microsoft.directory/users/invalidateAllRefreshTokensnull
microsoft.directory/users/password/updatenull
microsoft.networkAccess/allEntities/allProperties/allTasksnull
microsoft.office365.protectionCenter/allEntities/basic/updatenull
microsoft.office365.protectionCenter/allEntities/standard/readnull
microsoft.office365.protectionCenter/attackSimulator/payload/allProperties/allTasksnull
microsoft.office365.protectionCenter/attackSimulator/reports/allProperties/readnull
microsoft.office365.protectionCenter/attackSimulator/simulation/allProperties/allTasksnull
microsoft.office365.serviceHealth/allEntities/allTasksnull
microsoft.office365.supportTickets/allEntities/allTasksnull
microsoft.office365.webPortal/allEntities/standard/readnull

Graph API Permissions132

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

  • AgentCard.Read.All
  • AgentCardManifest.Read.All
  • AgentCollection.Read.All
  • AgentInstance.Read.All
  • AgentRegistration.Read.All
  • Application.Read.All
  • Application.ReadUpdate.All
  • Application.ReadWrite.All
  • AppRoleAssignment.ReadWrite.All
  • AttackSimulation.Read.All
  • AttackSimulation.ReadWrite.All
  • AuditLog.Read.All
  • AuditLogsQuery-Entra.Read.All
  • AuditLogsQuery.Read.All
  • BitlockerKey.ReadBasic.All
  • ChangeManagement.Read.All
  • CrossTenantInformation.ReadBasic.All
  • CustomDetection.Read.All
  • CustomDetection.ReadWrite.All
  • DeviceLocalCredential.ReadBasic.All
  • Directory.Read.All
  • Domain-InternalFederation.ReadWrite.All
  • Domain.Read.All
  • Domain.ReadWrite.All
  • EntitlementManagement.Read.All
  • IdentityRiskEvent.Read.All
  • IdentityRiskEvent.ReadWrite.All
  • IdentityRiskyAgent.Read.All
  • IdentityRiskyAgent.ReadWrite.All
  • IdentityRiskyServicePrincipal.Read.All
  • IdentityRiskyServicePrincipal.ReadWrite.All
  • IdentityRiskyUser.Read.All
  • IdentityRiskyUser.ReadWrite.All
  • LicenseAssignment.Read.All
  • LicenseAssignment.ReadWrite.All
  • MultiTenantOrganization.Read.All
  • MultiTenantOrganization.ReadBasic.All
  • MultiTenantOrganization.ReadWrite.All
  • NetworkAccess-Reports.Read.All
  • NetworkAccess.Read.All
  • NetworkAccess.ReadWrite.All
  • NetworkAccessBranch.Read.All
  • NetworkAccessBranch.ReadWrite.All
  • NetworkAccessPolicy.Read.All
  • NetworkAccessPolicy.ReadWrite.All
  • Policy.Read.All
  • Policy.Read.AuthenticationMethod
  • Policy.Read.B2BManagementPolicy
  • Policy.Read.ConditionalAccess
  • Policy.Read.DeviceConfiguration
  • Policy.Read.IdentityProtection
  • Policy.Read.PermissionGrant
  • Policy.ReadWrite.AccessReview
  • Policy.ReadWrite.ApplicationConfiguration
  • Policy.ReadWrite.AuthenticationFlows
  • Policy.ReadWrite.AuthenticationMethod
  • Policy.ReadWrite.Authorization
  • Policy.ReadWrite.B2BManagementPolicy
  • Policy.ReadWrite.ConditionalAccess
  • Policy.ReadWrite.ConsentRequest
  • Policy.ReadWrite.CrossTenantAccess
  • Policy.ReadWrite.CrossTenantCapability
  • Policy.ReadWrite.DeviceConfiguration
  • Policy.ReadWrite.ExternalIdentities
  • Policy.ReadWrite.FeatureRollout
  • Policy.ReadWrite.FedTokenValidation
  • Policy.ReadWrite.IdentityProtection
  • Policy.ReadWrite.MobilityManagement
  • Policy.ReadWrite.PermissionGrant
  • Policy.ReadWrite.SecurityDefaults
  • Policy.ReadWrite.TrustFramework
  • PrivilegedAccess-CustomExt.Read.All
  • PrivilegedAccess.Read.AzureAD
  • PrivilegedAccess.Read.AzureADGroup
  • PrivilegedAssignmentSchedule.Read.AzureADGroup
  • PrivilegedAssignmentSchedule.Read.EntraAppRole
  • PrivilegedEligibilitySchedule.Read.AzureADGroup
  • PrivilegedEligibilitySchedule.Read.EntraAppRole
  • ProvisioningLog.Read.All
  • RiskPreventionProviders.Read.All
  • RiskPreventionProviders.ReadWrite.All
  • RoleManagement.Read.Directory
  • RoleManagement.ReadWrite.Directory
  • RoleManagementAlert.Read.Directory
  • RoleManagementPolicy.Read.AzureADGroup
  • RoleManagementPolicy.Read.Directory
  • RoleManagementPolicy.Read.EntraAppRole
  • SecurityAlert.Read.All
  • SecurityAlert.ReadWrite.All
  • SecurityAnalyzedMessage.Read.All
  • SecurityAnalyzedMessage.ReadWrite.All
  • SecurityEvents.Read.All
  • SecurityEvents.ReadWrite.All
  • SecurityIncident.Read.All
  • SecurityIncident.ReadWrite.All
  • ServiceActivity-Exchange.Read.All
  • ServiceActivity-Microsoft365Web.Read.All
  • ServiceActivity-OneDrive.Read.All
  • ServiceActivity-Teams.Read.All
  • ServiceHealth.Read.All
  • ServiceMessage.Read.All
  • ServiceMessageViewpoint.Write
  • ServicePrincipalEndpoint.Read.All
  • ServicePrincipalEndpoint.ReadWrite.All
  • SignInIdentifier.Read.All
  • SignInIdentifier.ReadWrite.All
  • ThreatHunting.Read.All
  • ThreatIntelligence.Read.All
  • ThreatSubmission.Read.All
  • ThreatSubmission.ReadWrite.All
  • ThreatSubmissionPolicy.ReadWrite.All
  • User-ConvertToInternal.ReadWrite.All
  • User-LifeCycleInfo.Read.All
  • User-LifeCycleInfo.ReadWrite.All
  • User-Mail.ReadWrite.All
  • User-OnPremisesSyncBehavior.ReadWrite.All
  • User-PasswordProfile.ReadWrite.All
  • User.Create
  • User.DeleteRestore.All
  • User.EnableDisableAccount.All
  • User.Export.All
  • User.Invite.All
  • User.ManageIdentities.All
  • User.Read.All
  • User.ReadBasic.All
  • User.ReadWrite.All
  • User.RevokeSessions.All
  • UserAuthenticationMethod.Read.All
  • UserAuthenticationMethod.ReadWrite.All
  • UserAuthMethod-External.ReadWrite.All
  • UserAuthMethod-HardwareOATH.ReadWrite.All
  • UserAuthMethod-TAP.ReadWrite.All