← All Roles

Tenant Governance Administrator

PrivilegedEnabled
Versionv8
Last Updated2026-09-12
Categoryidentity
Assignment Modeallowed
Built-inYes
Template ID1981f584-96e9-4a6f-95b0-f522373f8fae

Description

Manage Tenant Governance, service principals, application role assignments, and permission grants through the approved Tenant Governance application.

Details

Can manage all aspects of tenant governance, including provisioning first-party and third-party service principals, managing application role assignments, and granting delegated permissions through the approved Tenant Governance application.

Directory Actions13

ActionCondition
microsoft.directory/crossTenantAccessPolicy/basic/updatenull
microsoft.directory/crossTenantAccessPolicy/default/standard/readnull
microsoft.directory/crossTenantAccessPolicy/partners/createnull
microsoft.directory/crossTenantAccessPolicy/partners/deletenull
microsoft.directory/crossTenantAccessPolicy/partners/standard/readnull
microsoft.directory/crossTenantAccessPolicy/standard/readnull
microsoft.directory/signInReports/allProperties/readnull
microsoft.directory/tenantGovernance/policyTemplates/allProperties/updatenull
microsoft.directory/tenantGovernance/policyTemplates/createnull
microsoft.directory/tenantGovernance/relationships/createnull
microsoft.directory/tenantGovernance/requests/allProperties/updatenull
microsoft.directory/tenantGovernance/requests/createnull
microsoft.office365.webPortal/allEntities/standard/readnull

Graph API Permissions6

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

  • AuditLog.Read.All
  • CrossTenantInformation.ReadBasic.All
  • Directory.Read.All
  • Policy.Read.All
  • Policy.ReadWrite.CrossTenantAccess
  • Policy.ReadWrite.CrossTenantCapability