← All Roles

Teams Administrator

Enabled
Versionv1
Date Added2026-06-21
Categorycollaboration
Assignment Modeallowed
Built-inYes
Template ID69091246-20e8-4a56-aa4d-066075b2a7a8

Description

Can manage the Microsoft Teams service.

Details

Users in this role can manage all aspects of the Microsoft Teams workload via the Microsoft Teams & Skype for Business admin center and the respective PowerShell modules. This includes, among other areas, all management tools related to telephony, messaging, meetings, and the teams themselves. This role also grants the ability to manage O365 groups.

Directory Actions33

  • microsoft.azure.serviceHealth/allEntities/allTasks
  • microsoft.azure.supportTickets/allEntities/allTasks
  • microsoft.directory/authorizationPolicy/standard/read
  • microsoft.directory/crossTenantAccessPolicy/allowedCloudEndpoints/update
  • microsoft.directory/crossTenantAccessPolicy/default/crossCloudMeetings/update
  • microsoft.directory/crossTenantAccessPolicy/default/standard/read
  • microsoft.directory/crossTenantAccessPolicy/partners/create
  • microsoft.directory/crossTenantAccessPolicy/partners/crossCloudMeetings/update
  • microsoft.directory/crossTenantAccessPolicy/partners/standard/read
  • microsoft.directory/crossTenantAccessPolicy/standard/read
  • microsoft.directory/externalUserProfiles/basic/update
  • microsoft.directory/externalUserProfiles/delete
  • microsoft.directory/externalUserProfiles/standard/read
  • microsoft.directory/groups/hiddenMembers/read
  • microsoft.directory/groups.unified/assignedLabels/update
  • microsoft.directory/groups.unified/basic/update
  • microsoft.directory/groups.unified/create
  • microsoft.directory/groups.unified/delete
  • microsoft.directory/groups.unified/members/update
  • microsoft.directory/groups.unified/owners/update
  • microsoft.directory/groups.unified/restore
  • microsoft.directory/pendingExternalUserProfiles/basic/update
  • microsoft.directory/pendingExternalUserProfiles/create
  • microsoft.directory/pendingExternalUserProfiles/delete
  • microsoft.directory/pendingExternalUserProfiles/standard/read
  • microsoft.directory/permissionGrantPolicies/standard/read
  • microsoft.office365.network/performance/allProperties/read
  • microsoft.office365.serviceHealth/allEntities/allTasks
  • microsoft.office365.skypeForBusiness/allEntities/allTasks
  • microsoft.office365.supportTickets/allEntities/allTasks
  • microsoft.office365.usageReports/allEntities/allProperties/read
  • microsoft.office365.webPortal/allEntities/standard/read
  • microsoft.teams/allEntities/allProperties/allTasks

Graph API Permissions59

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

  • Bookings.Manage.All
  • Bookings.Read.All
  • Bookings.ReadWrite.All
  • BookingsAppointment.ReadWrite.All
  • ChangeManagement.Read.All
  • Channel.Create
  • Channel.Delete.All
  • Channel.ReadBasic.All
  • ChannelMember.Read.All
  • ChannelMember.ReadWrite.All
  • ChannelMessage.Read.All
  • ChannelSettings.Read.All
  • ChannelSettings.ReadWrite.All
  • CrossTenantInformation.ReadBasic.All
  • Directory.Read.All
  • ExternalUserProfile.Read.All
  • ExternalUserProfile.ReadWrite.All
  • Group.Read.All
  • Group.ReadWrite.All
  • GroupMember.Read.All
  • GroupMember.ReadWrite.All
  • GroupSettings.Read.All
  • NetworkAccess-Reports.Read.All
  • PendingExternalUserProfile.Read.All
  • PendingExternalUserProfile.ReadWrite.All
  • Policy.Read.All
  • Policy.Read.PermissionGrant
  • Policy.ReadWrite.CrossTenantAccess
  • Policy.ReadWrite.CrossTenantCapability
  • Reports.Read.All
  • ReportSettings.Read.All
  • RoleManagement.Read.CloudPC
  • Schedule.Read.All
  • Schedule.ReadWrite.All
  • SchedulePermissions.ReadWrite.All
  • ServiceActivity-Exchange.Read.All
  • ServiceActivity-Microsoft365Web.Read.All
  • ServiceActivity-OneDrive.Read.All
  • ServiceActivity-Teams.Read.All
  • ServiceHealth.Read.All
  • ServiceMessage.Read.All
  • ServiceMessageViewpoint.Write
  • Team.Create
  • Team.ReadBasic.All
  • TeamMember.Read.All
  • TeamMember.ReadWrite.All
  • TeamsActivity.Read
  • TeamsActivity.Send
  • TeamsAppInstallation.ReadWriteAndConsentForTeam
  • TeamSettings.Read.All
  • TeamSettings.ReadWrite.All
  • TeamsPolicyUserAssign.ReadWrite.All
  • TeamsResourceAccount.Read.All
  • TeamsTab.Create
  • TeamsTab.Read.All
  • TeamsTab.ReadWrite.All
  • TeamsTelephoneNumber.Read.All
  • TeamsTelephoneNumber.ReadWrite.All
  • TeamsUserConfiguration.Read.All