← All Roles

SharePoint Advanced Management Administrator

Enabled
Versionv1
Date Added2026-06-21
Categorycollaboration
Assignment Modeallowed
Built-inYes
Template ID99009c4a-3b3f-4957-82a9-9d35e12db77e

Description

Manage all aspects of SharePoint Advanced Management.

Details

Assign the SharePoint Advanced Management Administrator role to users who need to do the following tasks:

  • Perform all actions available to SharePoint Administrators, including global management of SharePoint Online, support ticket handling, and service health monitoring
  • View names, paths, and URLs of files, folders, libraries, documents, and lists within SharePoint sites, without accessing file or item content
  • Remove permissions from files, folders, libraries, documents, and lists within SharePoint sites

Directory Actions28

ActionCondition
microsoft.azure.serviceHealth/allEntities/allTasksnull
microsoft.azure.supportTickets/allEntities/allTasksnull
microsoft.backup/oneDriveForBusinessProtectionPolicies/allProperties/allTasksnull
microsoft.backup/oneDriveForBusinessRestoreSessions/allProperties/allTasksnull
microsoft.backup/restorePoints/sites/allProperties/allTasksnull
microsoft.backup/restorePoints/userDrives/allProperties/allTasksnull
microsoft.backup/sharePointProtectionPolicies/allProperties/allTasksnull
microsoft.backup/sharePointRestoreSessions/allProperties/allTasksnull
microsoft.backup/siteProtectionUnits/allProperties/allTasksnull
microsoft.backup/siteRestoreArtifacts/allProperties/allTasksnull
microsoft.backup/userDriveProtectionUnits/allProperties/allTasksnull
microsoft.backup/userDriveRestoreArtifacts/allProperties/allTasksnull
microsoft.directory/groups/hiddenMembers/readnull
microsoft.directory/groups.unified/assignedLabels/updatenull
microsoft.directory/groups.unified/basic/updatenull
microsoft.directory/groups.unified/createnull
microsoft.directory/groups.unified/deletenull
microsoft.directory/groups.unified/members/updatenull
microsoft.directory/groups.unified/owners/updatenull
microsoft.directory/groups.unified/restorenull
microsoft.office365.migrations/allEntities/allProperties/allTasksnull
microsoft.office365.network/performance/allProperties/readnull
microsoft.office365.serviceHealth/allEntities/allTasksnull
microsoft.office365.sharePointAdvancedManagement/allEntities/allProperties/allTasksnull
microsoft.office365.sharePoint/allEntities/allTasksnull
microsoft.office365.supportTickets/allEntities/allTasksnull
microsoft.office365.usageReports/allEntities/allProperties/readnull
microsoft.office365.webPortal/allEntities/standard/readnull

Graph API Permissions33

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

  • BackupRestore-Monitor.Read.All
  • BackupRestore-Restore.Read.All
  • ChangeManagement.Read.All
  • Directory.Read.All
  • EntraBackup.Read.All
  • EntraBackup.ReadWrite.Preview
  • EntraBackup.ReadWrite.Recovery
  • Files.Read.All
  • Files.ReadWrite.All
  • Group.Read.All
  • Group.ReadWrite.All
  • GroupMember.Read.All
  • GroupMember.ReadWrite.All
  • GroupSettings.Read.All
  • NetworkAccess-Reports.Read.All
  • Reports.Read.All
  • ReportSettings.Read.All
  • ServiceActivity-Exchange.Read.All
  • ServiceActivity-Microsoft365Web.Read.All
  • ServiceActivity-OneDrive.Read.All
  • ServiceActivity-Teams.Read.All
  • ServiceHealth.Read.All
  • ServiceMessage.Read.All
  • ServiceMessageViewpoint.Write
  • SharePointCrossTenantMigration.Manage.All
  • SharePointTenantSettings.Read.All
  • SharePointTenantSettings.ReadWrite.All
  • Sites.FullControl.All
  • Sites.Manage.All
  • Sites.Read.All
  • Sites.ReadWrite.All
  • TermStore.Read.All
  • TermStore.ReadWrite.All