User Administrator | MS Admin Roles

← All Roles

Compare with previous version (v3)

Versionv4

Last Updated2026-08-19

Categoryidentity

Assignment Modeallowed

Built-inYes

Template IDfe930be7-5e62-47db-91af-98c3a49a38b1

Attack path

A User Administrator can manage users and the membership of standard groups. If a Conditional Access policy excludes a standard group, an attacker with this role could add a controlled account to that group and bypass controls such as multifactor authentication or device requirements. The same weakness can arise where a standard group is trusted by an application or external service. Role-assignable groups are protected from this action, so the path depends on sensitive access having been granted through an ordinary group.

Description

Can manage all aspects of users and groups, including resetting passwords for limited admins.

Details

Users with this role can create and manage all aspects of users and groups. Additionally, this role includes the ability to manage support tickets and monitors service health. Some restrictions apply. For example, this role does not allow deleting a global administrator. User Account administrators can change passwords for users, Helpdesk administrators, and other User Account administrators only

Directory Actions55

Action	Condition
`microsoft.azure.serviceHealth/allEntities/allTasks`	`null`
`microsoft.azure.supportTickets/allEntities/allTasks`	`null`
`microsoft.directory/accessReviews/definitions.applications/allProperties/allTasks`	`null`
`microsoft.directory/accessReviews/definitions.directoryRoles/allProperties/read`	`null`
`microsoft.directory/accessReviews/definitions.entitlementManagement/allProperties/allTasks`	`null`
`microsoft.directory/accessReviews/definitions.groups/allProperties/read`	`null`
`microsoft.directory/accessReviews/definitions.groups/allProperties/update`	`null`
`microsoft.directory/accessReviews/definitions.groups/create`	`null`
`microsoft.directory/accessReviews/definitions.groups/delete`	`null`
`microsoft.directory/contacts/basic/update`	`null`
`microsoft.directory/contacts/create`	`null`
`microsoft.directory/contacts/delete`	`null`
`microsoft.directory/deletedItems.groups/restore`	`null`
`microsoft.directory/deletedItems.users/restore`	`null`
`microsoft.directory/groups/assignLicense`	`null`
`microsoft.directory/groups/basic/update`	`null`
`microsoft.directory/groups/classification/update`	`null`
`microsoft.directory/groups/create`	`null`
`microsoft.directory/groups/delete`	`null`
`microsoft.directory/groups/dynamicMembershipRule/update`	`null`
`microsoft.directory/groups/groupType/update`	`null`
`microsoft.directory/groups/hiddenMembers/read`	`null`
`microsoft.directory/groups/members/update`	`null`
`microsoft.directory/groups/onPremWriteBack/update`	`null`
`microsoft.directory/groups/owners/update`	`null`
`microsoft.directory/groups/reprocessLicenseAssignment`	`null`
`microsoft.directory/groups/restore`	`null`
`microsoft.directory/groups/settings/update`	`null`
`microsoft.directory/groups.unified/assignedLabels/update`	`null`
`microsoft.directory/groups/visibility/update`	`null`
`microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks`	`null`
`microsoft.directory/onPremisesSynchronization/standard/read`	`null`
`microsoft.directory/policies/standard/read`	`null`
`microsoft.directory/servicePrincipals/appRoleAssignedTo/update`	`null`
`microsoft.directory/users/assignLicense`	`null`
`microsoft.directory/users/basic/update`	`null`
`microsoft.directory/users/convertExternalToInternalMemberUser`	`null`
`microsoft.directory/users/create`	`null`
`microsoft.directory/users/delete`	`null`
`microsoft.directory/users/disable`	`null`
`microsoft.directory/users/enable`	`null`
`microsoft.directory/users/invalidateAllRefreshTokens`	`null`
`microsoft.directory/users/inviteGuest`	`null`
`microsoft.directory/users/lifeCycleInfo/read`	`null`
`microsoft.directory/users/manager/update`	`null`
`microsoft.directory/users/password/update`	`null`
`microsoft.directory/users/photo/update`	`null`
`microsoft.directory/users/reprocessLicenseAssignment`	`null`
`microsoft.directory/users/restore`	`null`
`microsoft.directory/users/sponsors/update`	`null`
`microsoft.directory/users/usageLocation/update`	`null`
`microsoft.directory/users/userPrincipalName/update`	`null`
`microsoft.office365.serviceHealth/allEntities/allTasks`	`null`
`microsoft.office365.supportTickets/allEntities/allTasks`	`null`
`microsoft.office365.webPortal/allEntities/standard/read`	`null`

Graph API Permissions63

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

AccessReview.Read.All
AccessReview.ReadWrite.All
AccessReview.ReadWrite.Membership
Application.Read.All
Application.ReadWrite.All
AppRoleAssignment.ReadWrite.All
ChangeManagement.Read.All
DelegatedPermissionGrant.Read.All
DelegatedPermissionGrant.ReadWrite.All
Directory.Read.All
Group.Read.All
Group.ReadWrite.All
GroupMember.Read.All
GroupMember.ReadWrite.All
GroupSettings.Read.All
GroupSettings.ReadWrite.All
LicenseAssignment.Read.All
LicenseAssignment.ReadWrite.All
OnPremDirectorySynchronization.Read.All
OrgContact.Read.All
Policy.Read.All
Policy.Read.AuthenticationMethod
Policy.Read.B2BManagementPolicy
Policy.Read.ConditionalAccess
Policy.Read.DeviceConfiguration
Policy.Read.IdentityProtection
Policy.Read.PermissionGrant
Policy.ReadWrite.AccessReview
Policy.ReadWrite.PermissionGrant
ProgramControl.Read.All
ProgramControl.ReadWrite.All
ServiceActivity-Exchange.Read.All
ServiceActivity-Microsoft365Web.Read.All
ServiceActivity-OneDrive.Read.All
ServiceActivity-Teams.Read.All
ServiceHealth.Read.All
ServiceMessage.Read.All
ServiceMessageViewpoint.Write
ServicePrincipalEndpoint.Read.All
ServicePrincipalEndpoint.ReadWrite.All
SignInIdentifier.Read.All
SignInIdentifier.ReadWrite.All
User-ConvertToInternal.ReadWrite.All
User-LifeCycleInfo.Read.All
User-LifeCycleInfo.ReadWrite.All
User-Mail.ReadWrite.All
User-OnPremisesSyncBehavior.ReadWrite.All
User-PasswordProfile.ReadWrite.All
User.Create
User.DeleteRestore.All
User.EnableDisableAccount.All
User.Export.All
User.Invite.All
User.ManageIdentities.All
User.Read.All
User.ReadBasic.All
User.ReadWrite.All
User.RevokeSessions.All
UserAuthenticationMethod.Read.All
UserAuthenticationMethod.ReadWrite.All
UserAuthMethod-External.ReadWrite.All
UserAuthMethod-HardwareOATH.ReadWrite.All
UserAuthMethod-TAP.ReadWrite.All

ShareLinkedIn X Reddit Facebook WhatsApp