Tenant Governance Administrator

Description

Manage all capabilities in the Microsoft Entra Tenant Governance service.

Details

Can manage all aspects of tenant governance.

Directory Actions13

• microsoft.directory/crossTenantAccessPolicy/basic/update
• microsoft.directory/crossTenantAccessPolicy/default/standard/read
• microsoft.directory/crossTenantAccessPolicy/partners/create
• microsoft.directory/crossTenantAccessPolicy/partners/delete
• microsoft.directory/crossTenantAccessPolicy/partners/standard/read
• microsoft.directory/crossTenantAccessPolicy/standard/read
• microsoft.directory/signInReports/allProperties/read
• microsoft.directory/tenantGovernance/policyTemplates/allProperties/update
• microsoft.directory/tenantGovernance/policyTemplates/create
• microsoft.directory/tenantGovernance/relationships/create
• microsoft.directory/tenantGovernance/requests/allProperties/update
• microsoft.directory/tenantGovernance/requests/create
• microsoft.office365.webPortal/allEntities/standard/read

Graph API Permissions6

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

• AuditLog.Read.All
• CrossTenantInformation.ReadBasic.All
• Directory.Read.All
• Policy.Read.All
• Policy.ReadWrite.CrossTenantAccess
• Policy.ReadWrite.CrossTenantCapability