User

Description

Default role for member users. Can read all and write a limited set of directory information.

Directory Actions172

• microsoft.directory/administrativeUnits/members/read
• microsoft.directory/administrativeUnits/standard/read
• microsoft.directory/agentIdentities/createAsOwner
• microsoft.directory/agentIdentities/standard/read
• microsoft.directory/agentIdentityBlueprintPrincipals/createAsOwner
• microsoft.directory/agentIdentityBlueprintPrincipals/standard/read
• microsoft.directory/agentIdentityBlueprints/standard/read
• microsoft.directory/applicationPolicies/createAsOwner
• microsoft.directory/applicationPolicies/standard/read
• microsoft.directory/applications/createAsOwner
• microsoft.directory/applications/owners/read
• microsoft.directory/applications/policies/read
• microsoft.directory/applications/standard/read
• microsoft.directory/authorizationPolicy/standard/read
• microsoft.directory/contacts/memberOf/read
• microsoft.directory/contacts/standard/read
• microsoft.directory/contracts/standard/read
• microsoft.directory/devices/memberOf/read
• microsoft.directory/devices/registeredOwners/read
• microsoft.directory/devices/registeredUsers/read
• microsoft.directory/devices/standard/read
• microsoft.directory/directoryRoles/eligibleMembers/read
• microsoft.directory/directoryRoles/members/read
• microsoft.directory/directoryRoles/standard/read
• microsoft.directory/directoryRoleTemplates/allProperties/read
• microsoft.directory/domains/standard/read
• microsoft.directory/groups/appRoleAssignments/read
• microsoft.directory/groups/createAsOwner
• microsoft.directory/groups/memberOf/read
• microsoft.directory/groups/members/read
• microsoft.directory/groups/owners/read
• microsoft.directory/groups/standard/read
• microsoft.directory/multiTenantOrganization/standard/read
• microsoft.directory/multiTenantOrganization/tenants/standard/read
• microsoft.directory/oAuth2PermissionGrants/standard/read
• microsoft.directory/organization/standard/read
• microsoft.directory/policies/owners/read
• microsoft.directory/policies/policyAppliedTo/read
• microsoft.directory/policies/standard/read
• microsoft.directory/roleAssignments/standard/read
• microsoft.directory/roleDefinitions/standard/read
• microsoft.directory/servicePrincipals/appRoleAssignedTo/read
• microsoft.directory/servicePrincipals/appRoleAssignments/read
• microsoft.directory/servicePrincipals/authentication/read
• microsoft.directory/servicePrincipals/createAsOwner
• microsoft.directory/servicePrincipals/memberOf/read
• microsoft.directory/servicePrincipals/oAuth2PermissionGrants/read
• microsoft.directory/servicePrincipals/ownedObjects/read
• microsoft.directory/servicePrincipals/owners/read
• microsoft.directory/servicePrincipals/policies/read
• microsoft.directory/servicePrincipals/standard/read
• microsoft.directory/subscribedSkus/standard/read
• microsoft.directory/tenantManagement/tenants/create
• microsoft.directory/users/activateServicePlan
• microsoft.directory/users/appRoleAssignments/read
• microsoft.directory/users/deviceForResourceAccount/read
• microsoft.directory/users/directReports/read
• microsoft.directory/users/inviteGuest
• microsoft.directory/users/licenseDetails/read
• microsoft.directory/users/manager/read
• microsoft.directory/users/memberOf/read
• microsoft.directory/users/oAuth2PermissionGrants/read
• microsoft.directory/users/ownedDevices/read
• microsoft.directory/users/ownedObjects/read
• microsoft.directory/users/photo/read
• microsoft.directory/users/registeredDevices/read
• microsoft.directory/users/scopedRoleMemberOf/read
• microsoft.directory/users/sponsorOf/read
• microsoft.directory/users/sponsors/read
• microsoft.directory/users/standard/read
• microsoft.directory/agentIdentities/appRoleAssignedTo/update
• microsoft.directory/agentIdentities/authentication/update
• microsoft.directory/agentIdentities/basic/update
• microsoft.directory/agentIdentities/create
• microsoft.directory/agentIdentities/delete
• microsoft.directory/agentIdentities/disable
• microsoft.directory/agentIdentities/enable
• microsoft.directory/agentIdentities/owners/update
• microsoft.directory/agentIdentities/tag/update
• microsoft.directory/agentIdentityBlueprintPrincipals/appRoleAssignedTo/update
• microsoft.directory/agentIdentityBlueprintPrincipals/authentication/update
• microsoft.directory/agentIdentityBlueprintPrincipals/basic/update
• microsoft.directory/agentIdentityBlueprintPrincipals/create
• microsoft.directory/agentIdentityBlueprintPrincipals/delete
• microsoft.directory/agentIdentityBlueprintPrincipals/disable
• microsoft.directory/agentIdentityBlueprintPrincipals/enable
• microsoft.directory/agentIdentityBlueprintPrincipals/owners/update
• microsoft.directory/agentIdentityBlueprintPrincipals/tag/update
• microsoft.directory/agentIdentityBlueprints/appRoles/update
• microsoft.directory/agentIdentityBlueprints/audience/update
• microsoft.directory/agentIdentityBlueprints/authentication/update
• microsoft.directory/agentIdentityBlueprints/basic/update
• microsoft.directory/agentIdentityBlueprints/credentials/update
• microsoft.directory/agentIdentityBlueprints/owners/update
• microsoft.directory/agentIdentityBlueprints/permissions/update
• microsoft.directory/agentIdentityBlueprints/tag/update
• microsoft.directory/applications/appRoles/update
• microsoft.directory/applications/audience/update
• microsoft.directory/applications/authentication/update
• microsoft.directory/applications/basic/update
• microsoft.directory/applications/credentials/update
• microsoft.directory/applications/delete
• microsoft.directory/applications/disablement/update
• microsoft.directory/applications/extensionProperties/update
• microsoft.directory/applications/notes/update
• microsoft.directory/applications/owners/update
• microsoft.directory/applications/permissions/update
• microsoft.directory/applications/policies/update
• microsoft.directory/applications/tag/update
• microsoft.directory/applications/verification/update
• microsoft.directory/auditLogs/allProperties/read
• microsoft.directory/deletedItems.agentIdentities/delete
• microsoft.directory/deletedItems.agentIdentities/restore
• microsoft.directory/deletedItems.agentIdentityBlueprintPrincipals/delete
• microsoft.directory/deletedItems.agentIdentityBlueprintPrincipals/restore
• microsoft.directory/deletedItems.agentIdentityBlueprints/delete
• microsoft.directory/deletedItems.agentIdentityBlueprints/restore
• microsoft.directory/deletedItems.applications/delete
• microsoft.directory/deletedItems.applications/restore
• microsoft.directory/deletedItems.groups/restore
• microsoft.directory/devices/disable
• microsoft.directory/groupsAssignableToRoles/allProperties/update
• microsoft.directory/groupsAssignableToRoles/assignLicense
• microsoft.directory/groupsAssignableToRoles/delete
• microsoft.directory/groupsAssignableToRoles/reprocessLicenseAssignment
• microsoft.directory/groupsAssignableToRoles/restore
• microsoft.directory/groups/assignedLabels/update
• microsoft.directory/groups/basic/update
• microsoft.directory/groups/classification/update
• microsoft.directory/groups/delete
• microsoft.directory/groups/groupType/update
• microsoft.directory/groups/members/update
• microsoft.directory/groups/owners/update
• microsoft.directory/groups/restore
• microsoft.directory/groups/settings/update
• microsoft.directory/groups/visibility/update
• microsoft.directory/policies/basic/update
• microsoft.directory/policies/delete
• microsoft.directory/policies/owners/update
• microsoft.directory/provisioningLogs/allProperties/read
• microsoft.directory/servicePrincipals/appRoleAssignedTo/update
• microsoft.directory/servicePrincipals/audience/update
• microsoft.directory/servicePrincipals/authentication/update
• microsoft.directory/servicePrincipals/basic/update
• microsoft.directory/servicePrincipals/credentials/update
• microsoft.directory/servicePrincipals/delete
• microsoft.directory/servicePrincipals/disable
• microsoft.directory/servicePrincipals/enable
• microsoft.directory/servicePrincipals/getPasswordSingleSignOnCredentials
• microsoft.directory/servicePrincipals/managePasswordSingleSignOnCredentials
• microsoft.directory/servicePrincipals/notes/update
• microsoft.directory/servicePrincipals/owners/update
• microsoft.directory/servicePrincipals/permissions/update
• microsoft.directory/servicePrincipals/policies/update
• microsoft.directory/servicePrincipals/tag/update
• microsoft.directory/signInReports/allProperties/read
• microsoft.directory/userInfos/address/read
• microsoft.directory/userInfos/email/read
• microsoft.directory/userInfos/openId/read
• microsoft.directory/userInfos/phone/read
• microsoft.directory/userInfos/profile/read
• microsoft.directory/users/authenticationMethods/basic/update
• microsoft.directory/users/authenticationMethods/create
• microsoft.directory/users/authenticationMethods/delete
• microsoft.directory/users/authenticationMethods/standard/read
• microsoft.directory/users/authenticationMethods/standard/restrictedRead
• microsoft.directory/users/basicProfile/update
• microsoft.directory/users/changePassword
• microsoft.directory/users/identities/update
• microsoft.directory/users/invalidateAllRefreshTokens
• microsoft.directory/users/mobile/update
• microsoft.directory/users/searchableDeviceKey/update

Graph API Permissions102

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

• AdministrativeUnit.Read.All
• AgentIdentity.Create.All
• AgentIdentity.DeleteRestore.All
• AgentIdentity.EnableDisable.All
• AgentIdentity.Read.All
• AgentIdentity.ReadWrite.All
• AgentIdentityBlueprint.AddRemoveCreds.All
• AgentIdentityBlueprint.Create
• AgentIdentityBlueprint.DeleteRestore.All
• AgentIdentityBlueprint.Read.All
• AgentIdentityBlueprint.ReadWrite.All
• AgentIdentityBlueprintPrincipal.Create
• AgentIdentityBlueprintPrincipal.DeleteRestore.All
• AgentIdentityBlueprintPrincipal.EnableDisable.All
• AgentIdentityBlueprintPrincipal.Read.All
• AgentIdentityBlueprintPrincipal.ReadWrite.All
• AgentIdUser.ReadWrite.All
• AgentIdUser.ReadWrite.IdentityParentedBy
• Application.Read.All
• Application.ReadUpdate.All
• Application.ReadWrite.All
• AppRoleAssignment.ReadWrite.All
• AuditLog.Read.All
• AuditLogsQuery-Entra.Read.All
• AuditLogsQuery.Read.All
• CrossTenantInformation.ReadBasic.All
• DelegatedPermissionGrant.Read.All
• Device.CreateFromOwnedTemplate
• Device.Read.All
• DeviceLocalCredential.ReadBasic.All
• DeviceTemplate.Read.All
• DeviceTemplate.ReadWrite.All
• Directory.Read.All
• Domain.Read.All
• Group.Read.All
• Group.ReadWrite.All
• GroupMember.Read.All
• GroupMember.ReadWrite.All
• GroupSettings.Read.All
• GroupSettings.ReadWrite.All
• LicenseAssignment.Read.All
• LicenseAssignment.ReadWrite.All
• MultiTenantOrganization.Read.All
• MultiTenantOrganization.ReadBasic.All
• Organization.Read.All
• Organization.ReadWrite.All
• OrgContact.Read.All
• Policy.Read.All
• Policy.Read.AuthenticationMethod
• Policy.Read.B2BManagementPolicy
• Policy.Read.ConditionalAccess
• Policy.Read.DeviceConfiguration
• Policy.Read.IdentityProtection
• Policy.Read.PermissionGrant
• Policy.ReadWrite.AccessReview
• Policy.ReadWrite.ApplicationConfiguration
• Policy.ReadWrite.AuthenticationFlows
• Policy.ReadWrite.AuthenticationMethod
• Policy.ReadWrite.Authorization
• Policy.ReadWrite.B2BManagementPolicy
• Policy.ReadWrite.ConditionalAccess
• Policy.ReadWrite.ConsentRequest
• Policy.ReadWrite.CrossTenantAccess
• Policy.ReadWrite.CrossTenantCapability
• Policy.ReadWrite.DeviceConfiguration
• Policy.ReadWrite.ExternalIdentities
• Policy.ReadWrite.FeatureRollout
• Policy.ReadWrite.FedTokenValidation
• Policy.ReadWrite.IdentityProtection
• Policy.ReadWrite.MobilityManagement
• Policy.ReadWrite.PermissionGrant
• Policy.ReadWrite.SecurityDefaults
• Policy.ReadWrite.TrustFramework
• ProvisioningLog.Read.All
• RoleManagement.Read.All
• RoleManagement.Read.Directory
• RoleManagement.ReadWrite.Directory
• ServicePrincipalEndpoint.Read.All
• ServicePrincipalEndpoint.ReadWrite.All
• SignInIdentifier.Read.All
• SignInIdentifier.ReadWrite.All
• User-ConvertToInternal.ReadWrite.All
• User-LifeCycleInfo.Read.All
• User-LifeCycleInfo.ReadWrite.All
• User-Mail.ReadWrite.All
• User-OnPremisesSyncBehavior.ReadWrite.All
• User-PasswordProfile.ReadWrite.All
• User.Create
• User.DeleteRestore.All
• User.EnableDisableAccount.All
• User.Export.All
• User.Invite.All
• User.ManageIdentities.All
• User.Read.All
• User.ReadBasic.All
• User.ReadWrite.All
• User.RevokeSessions.All
• UserAuthenticationMethod.Read.All
• UserAuthenticationMethod.ReadWrite.All
• UserAuthMethod-External.ReadWrite.All
• UserAuthMethod-HardwareOATH.ReadWrite.All
• UserAuthMethod-TAP.ReadWrite.All