User | MS Admin Roles

← All Roles

Versionv1

Date Added2026-06-21

Categoryidentity

Assignment ModesystemAssigned

Built-inYes

Template IDa0b1b346-4d3e-4e8b-98f8-753987be4970

Description

Default role for member users. Can read all and write a limited set of directory information.

Directory Actions172

Action	Condition
`microsoft.directory/administrativeUnits/members/read`	`null`
`microsoft.directory/administrativeUnits/standard/read`	`null`
`microsoft.directory/agentIdentities/createAsOwner`	`null`
`microsoft.directory/agentIdentities/standard/read`	`null`
`microsoft.directory/agentIdentityBlueprintPrincipals/createAsOwner`	`null`
`microsoft.directory/agentIdentityBlueprintPrincipals/standard/read`	`null`
`microsoft.directory/agentIdentityBlueprints/standard/read`	`null`
`microsoft.directory/applicationPolicies/createAsOwner`	`null`
`microsoft.directory/applicationPolicies/standard/read`	`null`
`microsoft.directory/applications/createAsOwner`	`null`
`microsoft.directory/applications/owners/read`	`null`
`microsoft.directory/applications/policies/read`	`null`
`microsoft.directory/applications/standard/read`	`null`
`microsoft.directory/authorizationPolicy/standard/read`	`null`
`microsoft.directory/contacts/memberOf/read`	`null`
`microsoft.directory/contacts/standard/read`	`null`
`microsoft.directory/contracts/standard/read`	`null`
`microsoft.directory/devices/memberOf/read`	`null`
`microsoft.directory/devices/registeredOwners/read`	`null`
`microsoft.directory/devices/registeredUsers/read`	`null`
`microsoft.directory/devices/standard/read`	`null`
`microsoft.directory/directoryRoles/eligibleMembers/read`	`null`
`microsoft.directory/directoryRoles/members/read`	`null`
`microsoft.directory/directoryRoles/standard/read`	`null`
`microsoft.directory/directoryRoleTemplates/allProperties/read`	`null`
`microsoft.directory/domains/standard/read`	`null`
`microsoft.directory/groups/appRoleAssignments/read`	`null`
`microsoft.directory/groups/createAsOwner`	`null`
`microsoft.directory/groups/memberOf/read`	`null`
`microsoft.directory/groups/members/read`	`null`
`microsoft.directory/groups/owners/read`	`null`
`microsoft.directory/groups/standard/read`	`null`
`microsoft.directory/multiTenantOrganization/standard/read`	`null`
`microsoft.directory/multiTenantOrganization/tenants/standard/read`	`null`
`microsoft.directory/oAuth2PermissionGrants/standard/read`	`null`
`microsoft.directory/organization/standard/read`	`null`
`microsoft.directory/policies/owners/read`	`null`
`microsoft.directory/policies/policyAppliedTo/read`	`null`
`microsoft.directory/policies/standard/read`	`null`
`microsoft.directory/roleAssignments/standard/read`	`null`
`microsoft.directory/roleDefinitions/standard/read`	`null`
`microsoft.directory/servicePrincipals/appRoleAssignedTo/read`	`null`
`microsoft.directory/servicePrincipals/appRoleAssignments/read`	`null`
`microsoft.directory/servicePrincipals/authentication/read`	`null`
`microsoft.directory/servicePrincipals/createAsOwner`	`null`
`microsoft.directory/servicePrincipals/memberOf/read`	`null`
`microsoft.directory/servicePrincipals/oAuth2PermissionGrants/read`	`null`
`microsoft.directory/servicePrincipals/ownedObjects/read`	`null`
`microsoft.directory/servicePrincipals/owners/read`	`null`
`microsoft.directory/servicePrincipals/policies/read`	`null`
`microsoft.directory/servicePrincipals/standard/read`	`null`
`microsoft.directory/subscribedSkus/standard/read`	`null`
`microsoft.directory/tenantManagement/tenants/create`	`null`
`microsoft.directory/users/activateServicePlan`	`null`
`microsoft.directory/users/appRoleAssignments/read`	`null`
`microsoft.directory/users/deviceForResourceAccount/read`	`null`
`microsoft.directory/users/directReports/read`	`null`
`microsoft.directory/users/inviteGuest`	`null`
`microsoft.directory/users/licenseDetails/read`	`null`
`microsoft.directory/users/manager/read`	`null`
`microsoft.directory/users/memberOf/read`	`null`
`microsoft.directory/users/oAuth2PermissionGrants/read`	`null`
`microsoft.directory/users/ownedDevices/read`	`null`
`microsoft.directory/users/ownedObjects/read`	`null`
`microsoft.directory/users/photo/read`	`null`
`microsoft.directory/users/registeredDevices/read`	`null`
`microsoft.directory/users/scopedRoleMemberOf/read`	`null`
`microsoft.directory/users/sponsorOf/read`	`null`
`microsoft.directory/users/sponsors/read`	`null`
`microsoft.directory/users/standard/read`	`null`
`microsoft.directory/agentIdentities/appRoleAssignedTo/update`	`$SubjectIsOwner`
`microsoft.directory/agentIdentities/authentication/update`	`$SubjectIsOwner`
`microsoft.directory/agentIdentities/basic/update`	`$SubjectIsOwner`
`microsoft.directory/agentIdentities/create`	`$SubjectIsOwner`
`microsoft.directory/agentIdentities/delete`	`$SubjectIsOwner`
`microsoft.directory/agentIdentities/disable`	`$SubjectIsOwner`
`microsoft.directory/agentIdentities/enable`	`$SubjectIsOwner`
`microsoft.directory/agentIdentities/owners/update`	`$SubjectIsOwner`
`microsoft.directory/agentIdentities/tag/update`	`$SubjectIsOwner`
`microsoft.directory/agentIdentityBlueprintPrincipals/appRoleAssignedTo/update`	`$SubjectIsOwner`
`microsoft.directory/agentIdentityBlueprintPrincipals/authentication/update`	`$SubjectIsOwner`
`microsoft.directory/agentIdentityBlueprintPrincipals/basic/update`	`$SubjectIsOwner`
`microsoft.directory/agentIdentityBlueprintPrincipals/create`	`$SubjectIsOwner`
`microsoft.directory/agentIdentityBlueprintPrincipals/delete`	`$SubjectIsOwner`
`microsoft.directory/agentIdentityBlueprintPrincipals/disable`	`$SubjectIsOwner`
`microsoft.directory/agentIdentityBlueprintPrincipals/enable`	`$SubjectIsOwner`
`microsoft.directory/agentIdentityBlueprintPrincipals/owners/update`	`$SubjectIsOwner`
`microsoft.directory/agentIdentityBlueprintPrincipals/tag/update`	`$SubjectIsOwner`
`microsoft.directory/agentIdentityBlueprints/appRoles/update`	`$SubjectIsOwner`
`microsoft.directory/agentIdentityBlueprints/audience/update`	`$SubjectIsOwner`
`microsoft.directory/agentIdentityBlueprints/authentication/update`	`$SubjectIsOwner`
`microsoft.directory/agentIdentityBlueprints/basic/update`	`$SubjectIsOwner`
`microsoft.directory/agentIdentityBlueprints/credentials/update`	`$SubjectIsOwner`
`microsoft.directory/agentIdentityBlueprints/owners/update`	`$SubjectIsOwner`
`microsoft.directory/agentIdentityBlueprints/permissions/update`	`$SubjectIsOwner`
`microsoft.directory/agentIdentityBlueprints/tag/update`	`$SubjectIsOwner`
`microsoft.directory/applications/appRoles/update`	`$SubjectIsOwner`
`microsoft.directory/applications/audience/update`	`$SubjectIsOwner`
`microsoft.directory/applications/authentication/update`	`$SubjectIsOwner`
`microsoft.directory/applications/basic/update`	`$SubjectIsOwner`
`microsoft.directory/applications/credentials/update`	`$SubjectIsOwner`
`microsoft.directory/applications/delete`	`$SubjectIsOwner`
`microsoft.directory/applications/disablement/update`	`$SubjectIsOwner`
`microsoft.directory/applications/extensionProperties/update`	`$SubjectIsOwner`
`microsoft.directory/applications/notes/update`	`$SubjectIsOwner`
`microsoft.directory/applications/owners/update`	`$SubjectIsOwner`
`microsoft.directory/applications/permissions/update`	`$SubjectIsOwner`
`microsoft.directory/applications/policies/update`	`$SubjectIsOwner`
`microsoft.directory/applications/tag/update`	`$SubjectIsOwner`
`microsoft.directory/applications/verification/update`	`$SubjectIsOwner`
`microsoft.directory/auditLogs/allProperties/read`	`$SubjectIsOwner`
`microsoft.directory/deletedItems.agentIdentities/delete`	`$SubjectIsOwner`
`microsoft.directory/deletedItems.agentIdentities/restore`	`$SubjectIsOwner`
`microsoft.directory/deletedItems.agentIdentityBlueprintPrincipals/delete`	`$SubjectIsOwner`
`microsoft.directory/deletedItems.agentIdentityBlueprintPrincipals/restore`	`$SubjectIsOwner`
`microsoft.directory/deletedItems.agentIdentityBlueprints/delete`	`$SubjectIsOwner`
`microsoft.directory/deletedItems.agentIdentityBlueprints/restore`	`$SubjectIsOwner`
`microsoft.directory/deletedItems.applications/delete`	`$SubjectIsOwner`
`microsoft.directory/deletedItems.applications/restore`	`$SubjectIsOwner`
`microsoft.directory/deletedItems.groups/restore`	`$SubjectIsOwner`
`microsoft.directory/devices/disable`	`$SubjectIsOwner`
`microsoft.directory/groupsAssignableToRoles/allProperties/update`	`$SubjectIsOwner`
`microsoft.directory/groupsAssignableToRoles/assignLicense`	`$SubjectIsOwner`
`microsoft.directory/groupsAssignableToRoles/delete`	`$SubjectIsOwner`
`microsoft.directory/groupsAssignableToRoles/reprocessLicenseAssignment`	`$SubjectIsOwner`
`microsoft.directory/groupsAssignableToRoles/restore`	`$SubjectIsOwner`
`microsoft.directory/groups/assignedLabels/update`	`$SubjectIsOwner`
`microsoft.directory/groups/basic/update`	`$SubjectIsOwner`
`microsoft.directory/groups/classification/update`	`$SubjectIsOwner`
`microsoft.directory/groups/delete`	`$SubjectIsOwner`
`microsoft.directory/groups/groupType/update`	`$SubjectIsOwner`
`microsoft.directory/groups/members/update`	`$SubjectIsOwner`
`microsoft.directory/groups/owners/update`	`$SubjectIsOwner`
`microsoft.directory/groups/restore`	`$SubjectIsOwner`
`microsoft.directory/groups/settings/update`	`$SubjectIsOwner`
`microsoft.directory/groups/visibility/update`	`$SubjectIsOwner`
`microsoft.directory/policies/basic/update`	`$SubjectIsOwner`
`microsoft.directory/policies/delete`	`$SubjectIsOwner`
`microsoft.directory/policies/owners/update`	`$SubjectIsOwner`
`microsoft.directory/provisioningLogs/allProperties/read`	`$SubjectIsOwner`
`microsoft.directory/servicePrincipals/appRoleAssignedTo/update`	`$SubjectIsOwner`
`microsoft.directory/servicePrincipals/audience/update`	`$SubjectIsOwner`
`microsoft.directory/servicePrincipals/authentication/update`	`$SubjectIsOwner`
`microsoft.directory/servicePrincipals/basic/update`	`$SubjectIsOwner`
`microsoft.directory/servicePrincipals/credentials/update`	`$SubjectIsOwner`
`microsoft.directory/servicePrincipals/delete`	`$SubjectIsOwner`
`microsoft.directory/servicePrincipals/disable`	`$SubjectIsOwner`
`microsoft.directory/servicePrincipals/enable`	`$SubjectIsOwner`
`microsoft.directory/servicePrincipals/getPasswordSingleSignOnCredentials`	`$SubjectIsOwner`
`microsoft.directory/servicePrincipals/managePasswordSingleSignOnCredentials`	`$SubjectIsOwner`
`microsoft.directory/servicePrincipals/notes/update`	`$SubjectIsOwner`
`microsoft.directory/servicePrincipals/owners/update`	`$SubjectIsOwner`
`microsoft.directory/servicePrincipals/permissions/update`	`$SubjectIsOwner`
`microsoft.directory/servicePrincipals/policies/update`	`$SubjectIsOwner`
`microsoft.directory/servicePrincipals/tag/update`	`$SubjectIsOwner`
`microsoft.directory/signInReports/allProperties/read`	`$SubjectIsOwner`
`microsoft.directory/userInfos/address/read`	`$ResourceIsSelf`
`microsoft.directory/userInfos/email/read`	`$ResourceIsSelf`
`microsoft.directory/userInfos/openId/read`	`$ResourceIsSelf`
`microsoft.directory/userInfos/phone/read`	`$ResourceIsSelf`
`microsoft.directory/userInfos/profile/read`	`$ResourceIsSelf`
`microsoft.directory/users/authenticationMethods/basic/update`	`$ResourceIsSelf`
`microsoft.directory/users/authenticationMethods/create`	`$ResourceIsSelf`
`microsoft.directory/users/authenticationMethods/delete`	`$ResourceIsSelf`
`microsoft.directory/users/authenticationMethods/standard/read`	`$ResourceIsSelf`
`microsoft.directory/users/authenticationMethods/standard/restrictedRead`	`$ResourceIsSelf`
`microsoft.directory/users/basicProfile/update`	`$ResourceIsSelf`
`microsoft.directory/users/changePassword`	`$ResourceIsSelf`
`microsoft.directory/users/identities/update`	`$ResourceIsSelf`
`microsoft.directory/users/invalidateAllRefreshTokens`	`$ResourceIsSelf`
`microsoft.directory/users/mobile/update`	`$ResourceIsSelf`
`microsoft.directory/users/searchableDeviceKey/update`	`$ResourceIsSelf`

Graph API Permissions102

Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.

AdministrativeUnit.Read.All
AgentIdentity.Create.All
AgentIdentity.DeleteRestore.All
AgentIdentity.EnableDisable.All
AgentIdentity.Read.All
AgentIdentity.ReadWrite.All
AgentIdentityBlueprint.AddRemoveCreds.All
AgentIdentityBlueprint.Create
AgentIdentityBlueprint.DeleteRestore.All
AgentIdentityBlueprint.Read.All
AgentIdentityBlueprint.ReadWrite.All
AgentIdentityBlueprintPrincipal.Create
AgentIdentityBlueprintPrincipal.DeleteRestore.All
AgentIdentityBlueprintPrincipal.EnableDisable.All
AgentIdentityBlueprintPrincipal.Read.All
AgentIdentityBlueprintPrincipal.ReadWrite.All
AgentIdUser.ReadWrite.All
AgentIdUser.ReadWrite.IdentityParentedBy
Application.Read.All
Application.ReadUpdate.All
Application.ReadWrite.All
AppRoleAssignment.ReadWrite.All
AuditLog.Read.All
AuditLogsQuery-Entra.Read.All
AuditLogsQuery.Read.All
CrossTenantInformation.ReadBasic.All
DelegatedPermissionGrant.Read.All
Device.CreateFromOwnedTemplate
Device.Read.All
DeviceLocalCredential.ReadBasic.All
DeviceTemplate.Read.All
DeviceTemplate.ReadWrite.All
Directory.Read.All
Domain.Read.All
Group.Read.All
Group.ReadWrite.All
GroupMember.Read.All
GroupMember.ReadWrite.All
GroupSettings.Read.All
GroupSettings.ReadWrite.All
LicenseAssignment.Read.All
LicenseAssignment.ReadWrite.All
MultiTenantOrganization.Read.All
MultiTenantOrganization.ReadBasic.All
Organization.Read.All
Organization.ReadWrite.All
OrgContact.Read.All
Policy.Read.All
Policy.Read.AuthenticationMethod
Policy.Read.B2BManagementPolicy
Policy.Read.ConditionalAccess
Policy.Read.DeviceConfiguration
Policy.Read.IdentityProtection
Policy.Read.PermissionGrant
Policy.ReadWrite.AccessReview
Policy.ReadWrite.ApplicationConfiguration
Policy.ReadWrite.AuthenticationFlows
Policy.ReadWrite.AuthenticationMethod
Policy.ReadWrite.Authorization
Policy.ReadWrite.B2BManagementPolicy
Policy.ReadWrite.ConditionalAccess
Policy.ReadWrite.ConsentRequest
Policy.ReadWrite.CrossTenantAccess
Policy.ReadWrite.CrossTenantCapability
Policy.ReadWrite.DeviceConfiguration
Policy.ReadWrite.ExternalIdentities
Policy.ReadWrite.FeatureRollout
Policy.ReadWrite.FedTokenValidation
Policy.ReadWrite.IdentityProtection
Policy.ReadWrite.MobilityManagement
Policy.ReadWrite.PermissionGrant
Policy.ReadWrite.SecurityDefaults
Policy.ReadWrite.TrustFramework
ProvisioningLog.Read.All
RoleManagement.Read.All
RoleManagement.Read.Directory
RoleManagement.ReadWrite.Directory
ServicePrincipalEndpoint.Read.All
ServicePrincipalEndpoint.ReadWrite.All
SignInIdentifier.Read.All
SignInIdentifier.ReadWrite.All
User-ConvertToInternal.ReadWrite.All
User-LifeCycleInfo.Read.All
User-LifeCycleInfo.ReadWrite.All
User-Mail.ReadWrite.All
User-OnPremisesSyncBehavior.ReadWrite.All
User-PasswordProfile.ReadWrite.All
User.Create
User.DeleteRestore.All
User.EnableDisableAccount.All
User.Export.All
User.Invite.All
User.ManageIdentities.All
User.Read.All
User.ReadBasic.All
User.ReadWrite.All
User.RevokeSessions.All
UserAuthenticationMethod.Read.All
UserAuthenticationMethod.ReadWrite.All
UserAuthMethod-External.ReadWrite.All
UserAuthMethod-HardwareOATH.ReadWrite.All
UserAuthMethod-TAP.ReadWrite.All

ShareLinkedIn X Reddit Facebook WhatsApp