Administrator role permissions in Azure Active Directory

Using Azure Active Directory (Azure AD), you can designate limited administrators to manage identity tasks in less-privileged roles. Administrators can be assigned for such purposes as adding or changing users, assigning administrative roles, resetting user passwords, managing user licenses, and managing domain names. The default user permissions can be changed only in user settings in Azure AD.

Limit the use of Global administrator

Users who are assigned to the Global administrator role can read and modify every administrative setting in your Azure AD organization. By default, the person who signs up for an Azure subscription is assigned the Global administrator role for the Azure AD organization. Only Global administrators and Privileged Role administrators can delegate administrator roles. To reduce the risk to your business, we recommend that you assign this role to the fewest possible people in your organization.

As a best practice, we recommend that you assign this role to fewer than 5 people in your organization. If you have over five users assigned to the Global Administrator role in your organization, here are some ways to reduce its use.

Find the role you need

If it's frustrating for you to find the role you need out of a list of many roles, Azure AD can show you subsets of the roles based on role categories. Check out our new Type filter for Azure AD Roles and administrators to show you only the roles in the selected type.

A role exists now that didn’t exist when you assigned the Global administrator role

It's possible that a role or roles were added to Azure AD that provide more granular permissions that were not an option when you elevated some users to Global administrator. Over time, we are rolling out additional roles that accomplish tasks that only the Global administrator role could do before. You can see these reflected in the following Available roles.

Assign or remove administrator roles

To learn how to assign administrative roles to a user in Azure Active Directory, see View and assign administrator roles in Azure Active Directory.

Available roles

The following administrator roles are available:

Application Administrator

Users in this role can create and manage all aspects of enterprise applications, application registrations, and application proxy settings. This role also grants the ability to consent to delegated permissions, and application permissions excluding Microsoft Graph and Azure AD Graph. Users assigned to this role are not added as owners when creating new application registrations or enterprise applications.

 Important

This role grants the ability to manage application credentials. Users assigned this role can add credentials to an application, and use those credentials to impersonate the application’s identity. If the application’s identity has been granted access to Azure Active Directory, such as the ability to create or update User or other objects, then a user assigned to this role could perform those actions while impersonating the application. This ability to impersonate the application’s identity may be an elevation of privilege over what the user can do via their role assignments in Azure AD. It is important to understand that assigning a user to the Application Administrator role gives them the ability to impersonate an application’s identity.

Application Developer

Users in this role can create application registrations when the "Users can register applications" setting is set to No. This role also grants permission to consent on one's own behalf when the "Users can consent to apps accessing company data on their behalf" setting is set to No. Users assigned to this role are added as owners when creating new application registrations or enterprise applications.

Authentication Administrator

Users with this role can set or reset non-password credentials and can update passwords for all users. Authentication Administrators can require users to re-register against existing non-password credential (for example, MFA or FIDO) and revoke remember MFA on the device, which prompts for MFA on the next sign-in of users who are non-administrators or assigned the following roles only:

• Authentication Administrator
• Directory Readers
• Guest Inviter
• Message Center Reader
• Reports Reader

The Authentication administrator role is currently in public preview. This preview version is provided without a service level agreement, and it's not recommended for production workloads. Certain features might not be supported or might have constrained capabilities. For more information, see Supplemental Terms of Use for Microsoft Azure Previews.

 Important

Users with this role can change credentials for people who may have access to sensitive or private information or critical configuration inside and outside of Azure Active Directory. Changing the credentials of a user may mean the ability to assume that user's identity and permissions. For example:

• Application Registration and Enterprise Application owners, who can manage credentials of apps they own. Those apps may have privileged permissions in Azure AD and elsewhere not granted to Authentication Administrators. Through this path an Authentication Administrator may be able to assume the identity of an application owner and then further assume the identity of a privileged application by updating the credentials for the application.
• Azure subscription owners, who may have access to sensitive or private information or critical configuration in Azure.
• Security Group and Office 365 Group owners, who can manage group membership. Those groups may grant access to sensitive or private information or critical configuration in Azure AD and elsewhere.
• Administrators in other services outside of Azure AD like Exchange Online, Office Security and Compliance Center, and human resources systems.
• Non-administrators like executives, legal counsel, and human resources employees who may have access to sensitive or private information.

Azure Information Protection Administrator

Users with this role have all permissions in the Azure Information Protection service. This role allows configuring labels for the Azure Information Protection policy, managing protection templates, and activating protection. This role does not grant any permissions in Identity Protection Center, Privileged Identity Management, Monitor Office 365 Service Health, or Office 365 Security & Compliance Center.

B2C User Flow Administrator

Users with this role can create and manage B2C User Flows (also called "built-in" policies) in the Azure portal. By creating or editing user flows, these users can change the html/CSS/javascript content of the user experience, change MFA requirements per user flow, change claims in the token and adjust session settings for all policies in the tenant. On the other hand, this role does not include the ability to review user data, or make changes to the attributes that are included in the tenant schema. Changes to Identity Experience Framework (also known as Custom) policies is also outside the scope of this role.

B2C User Flow Attribute Administrator

Users with this role add or delete custom attributes available to all user flows in the tenant. As such, users with this role can change or add new elements to the end user schema and impact the behavior of all user flows and indirectly result in changes to what data may be asked of end users and ultimately sent as claims to applications. This role cannot edit user flows.

B2C IEF Keyset Administrator

User can create and manage policy keys and secrets for token encryption, token signatures, and claim encryption/decryption. By adding new keys to existing key containers, this limited administrator can rollover secrets as needed without impacting existing applications. This user can see the full content of these secrets and their expiration dates even after their creation.

 Important

This is a sensitive role. The keyset administrator role should be carefully audited and assigned with care during pre-production and production.

B2C IEF Policy Administrator

Users in this role have the ability to create, read, update, and delete all custom policies in Azure AD B2C and therefore have full control over the Identity Experience Framework in the relevant Azure AD B2C tenant. By editing policies, this user can establish direct federation with external identity providers, change the directory schema, change all user-facing content (HTML, CSS, JavaScript), change the requirements to complete an authentication, create new users, send user data to external systems including full migrations, and edit all user information including sensitive fields like passwords and phone numbers. Conversely, this role cannot change the encryption keys or edit the secrets used for federation in the tenant.

 Important

The B2 IEF Policy Administrator is a highly sensitive role which should be assigned on a very limited basis for tenants in production. Activities by these users should be closely audited, especially for tenants in production.

Billing Administrator

Makes purchases, manages subscriptions, manages support tickets, and monitors service health.

Cloud Application Administrator

Users in this role have the same permissions as the Application Administrator role, excluding the ability to manage application proxy. This role grants the ability to create and manage all aspects of enterprise applications and application registrations. This role also grants the ability to consent to delegated permissions, and application permissions excluding Microsoft Graph and Azure AD Graph. Users assigned to this role are not added as owners when creating new application registrations or enterprise applications.

 Important

This role grants the ability to manage application credentials. Users assigned this role can add credentials to an application, and use those credentials to impersonate the application’s identity. If the application’s identity has been granted access to Azure Active Directory, such as the ability to create or update User or other objects, then a user assigned to this role could perform those actions while impersonating the application. This ability to impersonate the application’s identity may be an elevation of privilege over what the user can do via their role assignments in Azure AD. It is important to understand that assigning a user to the Cloud Application Administrator role gives them the ability to impersonate an application’s identity.

Cloud Device Administrator

Users in this role can enable, disable, and delete devices in Azure AD and read Windows 10 BitLocker keys (if present) in the Azure portal. The role does not grant permissions to manage any other properties on the device.

Compliance Administrator

Users with this role have permissions to manage compliance-related features in the Microsoft 365 compliance center, Microsoft 365 admin center, Azure, and Office 365 Security & Compliance Center. Assignees can also manage all features within the Exchange admin center and Teams & Skype for Business admin centers and create support tickets for Azure and Microsoft 365. More information is available at About Office 365 admin roles.

In	Can do
Microsoft 365 compliance center	Protect and manage your organization’s data across Microsoft 365 services Manage compliance alerts
Compliance Manager	Track, assign, and verify your organization's regulatory compliance activities
Office 365 Security & Compliance Center	Manage data governance Perform legal and data investigation Manage Data Subject Request
Intune	View all Intune audit data
Cloud App Security	Has read-only permissions and can manage alerts Can create and modify file policies and allow file governance actions Can view all the built-in reports under Data Management

Compliance Data Administrator

Users with this role have permissions to track data in the Microsoft 365 compliance center, Microsoft 365 admin center, and Azure. Users can also track compliance data within the Exchange admin center, Compliance Manager, and Teams & Skype for Business admin center and create support tickets for Azure and Microsoft 365.

In	Can do
Microsoft 365 compliance center	Monitor compliance-related policies across Microsoft 365 services Manage compliance alerts
Compliance Manager	Track, assign, and verify your organization's regulatory compliance activities
Office 365 Security & Compliance Center	Manage data governance Perform legal and data investigation Manage Data Subject Request
Intune	View all Intune audit data
Cloud App Security	Has read-only permissions and can manage alerts Can create and modify file policies and allow file governance actions Can view all the built-in reports under Data Management

Conditional Access Administrator

Users with this role have the ability to manage Azure Active Directory Conditional Access settings.

 Note

To deploy Exchange ActiveSync Conditional Access policy in Azure, the user must also be a Global Administrator.

Customer Lockbox access approver

Manages Customer Lockbox requests in your organization. They receive email notifications for Customer Lockbox requests and can approve and deny requests from the Microsoft 365 admin center. They can also turn the Customer Lockbox feature on or off. Only global admins can reset the passwords of people assigned to this role.

Desktop Analytics Administrator

Users in this role can manage the Desktop Analytics and Office Customization & Policy services. For Desktop Analytics, this includes the ability to view asset inventory, create deployment plans, view deployment and health status. For Office Customization & Policy service, this role enables users to manage Office policies.

Device Administrator

This role is available for assignment only as an additional local administrator in Device settings. Users with this role become local machine administrators on all Windows 10 devices that are joined to Azure Active Directory. They do not have the ability to manage devices objects in Azure Active Directory.

Directory Readers

This is a role that should be assigned only to legacy applications that do not support the Consent Framework. Don't assign it to users.

Directory Synchronization Accounts

Do not use. This role is automatically assigned to the Azure AD Connect service, and is not intended or supported for any other use.

Directory Writers

This is a legacy role that is to be assigned to applications that do not support the Consent Framework. It should not be assigned to any users.

Dynamics 365 administrator / CRM Administrator

Users with this role have global permissions within Microsoft Dynamics 365 Online, when the service is present, as well as the ability to manage support tickets and monitor service health. More information at Use the service admin role to manage your tenant.

 Note

In Microsoft Graph API, Azure AD Graph API, and Azure AD PowerShell, this role is identified as "Dynamics 365 Service Administrator." It is "Dynamics 365 Administrator" in the Azure portal.

Exchange Administrator

Users with this role have global permissions within Microsoft Exchange Online, when the service is present. Also has the ability to create and manage all Office 365 Groups, manage support tickets, and monitor service health. More information at About Office 365 admin roles.

 Note

In Microsoft Graph API, Azure AD Graph API, and Azure AD PowerShell, this role is identified as "Exchange Service Administrator." It is "Exchange Administrator" in the Azure portal. It is "Exchange Online administrator" in the Exchange admin center.

External Identity Provider Administrator

This administrator manages federation between Azure Active Directory tenants and external identity providers. With this role, users can add new identity providers and configure all available settings (e.g. authentication path, service ID, assigned key containers). This user can enable the tenant to trust authentications from external identity providers. The resulting impact on end user experiences depends on the type of tenant:

• Azure Active Directory tenants for employees and partners: The addition  of a federation (e.g. with Gmail) will immediately impact all guest invitations not yet redeemed. See Adding Google as an identity provider for B2B guest users.
• Azure Active Directory B2C tenants: The addition of a federation (for example, with Facebook, or with another Azure AD organization) does not immediately impact end user flows until the identity provider is added as an option in a user flow (also called a built-in policy). See Configuring a Microsoft account as an identity provider for an example. To change user flows, the limited role of "B2C User Flow Administrator" is required.

Global Administrator / Company Administrator

Users with this role have access to all administrative features in Azure Active Directory, as well as services that use Azure Active Directory identities like Microsoft 365 security center, Microsoft 365 compliance center, Exchange Online, SharePoint Online, and Skype for Business Online. The person who signs up for the Azure Active Directory tenant becomes a global administrator. Only global administrators can assign other administrator roles. There can be more than one global administrator at your company. Global admins can reset the password for any user and all other administrators.

 Note

In Microsoft Graph API, Azure AD Graph API, and Azure AD PowerShell, this role is identified as "Company Administrator". It is "Global Administrator" in the Azure portal.

Guest Inviter

Users in this role can manage Azure Active Directory B2B guest user invitations when the Members can invite user setting is set to No. More information about B2B collaboration at About Azure AD B2B collaboration. It does not include any other permissions.

Helpdesk Administrator

Users with this role can change passwords, invalidate refresh tokens, manage service requests, and monitor service health. Invalidating a refresh token forces the user to sign in again. Helpdesk administrators can reset passwords and invalidate refresh tokens of other users who are non-administrators or assigned the following roles only:

• Directory Readers
• Guest Inviter
• Helpdesk Administrator
• Message Center Reader
• Reports Reader

 Important

Users with this role can change passwords for people who may have access to sensitive or private information or critical configuration inside and outside of Azure Active Directory. Changing the password of a user may mean the ability to assume that user's identity and permissions. For example:

• Application Registration and Enterprise Application owners, who can manage credentials of apps they own. Those apps may have privileged permissions in Azure AD and elsewhere not granted to Helpdesk Administrators. Through this path a Helpdesk Administrator may be able to assume the identity of an application owner and then further assume the identity of a privileged application by updating the credentials for the application.
• Azure subscription owners, who may have access to sensitive or private information or critical configuration in Azure.
• Security Group and Office 365 Group owners, who can manage group membership. Those groups may grant access to sensitive or private information or critical configuration in Azure AD and elsewhere.
• Administrators in other services outside of Azure AD like Exchange Online, Office Security and Compliance Center, and human resources systems.
• Non-administrators like executives, legal counsel, and human resources employees who may have access to sensitive or private information.

 Note

Delegating administrative permissions over subsets of users and applying policies to a subset of users is possible with Administrative Units (preview).

This role was previously called "Password Administrator" in the Azure portal. We have changed its name to "Helpdesk Administrator" to match its name in Azure AD PowerShell, Azure AD Graph API and Microsoft Graph API.

Intune Administrator

Users with this role have global permissions within Microsoft Intune Online, when the service is present. Additionally, this role contains the ability to manage users and devices in order to associate policy, as well as create and manage groups. More information at Role-based administration control (RBAC) with Microsoft Intune

 Note

In Microsoft Graph API, Azure AD Graph API, and Azure AD PowerShell, this role is identified as "Intune Service Administrator ". It is "Intune Administrator" in the Azure portal.

Kaizala Administrator

Users with this role have global permissions to manage settings within Microsoft Kaizala, when the service is present, as well as the ability to manage support tickets and monitor service health. Additionally, the user can access reports related to adoption & usage of Kaizala by Organization members and business reports generated using the Kaizala actions.

License Administrator

Users in this role can add, remove, and update license assignments on users, groups (using group-based licensing), and manage the usage location on users. The role does not grant the ability to purchase or manage subscriptions, create or manage groups, or create or manage users beyond the usage location. This role has no access to view, create, or manage support tickets.

Message Center Privacy Reader

Users in this role can monitor all notifications in the Message Center, including data privacy messages. Message Center Privacy Readers get email notifications including those related to data privacy and they can unsubscribe using Message Center Preferences. Only the Global Administrator and the Message Center Privacy Reader can read data privacy messages. Additionally, this role contains the ability to view groups, domains, and subscriptions. This role has no permission to view, create, or manage service requests.

Message Center Reader

Users in this role can monitor notifications and advisory health updates in Office 365 Message center for their organization on configured services such as Exchange, Intune, and Microsoft Teams. Message Center Readers receive weekly email digests of posts, updates, and can share message center posts in Office 365. In Azure AD, users assigned to this role will only have read-only access on Azure AD services such as users and groups. This role has no access to view, create, or manage support tickets.

Partner Tier1 Support

Do not use. This role has been deprecated and will be removed from Azure AD in the future. This role is intended for use by a small number of Microsoft resale partners, and is not intended for general use.

Partner Tier2 Support

Do not use. This role has been deprecated and will be removed from Azure AD in the future. This role is intended for use by a small number of Microsoft resale partners, and is not intended for general use.

Password Administrator

Users with this role have limited ability to manage passwords. This role does not grant the ability to manage service requests or monitor service health. Password administrators can reset passwords of other users who are non-administrators or members of the following roles only:

• Directory Readers
• Guest Inviter
• Password Administrator

Power BI Administrator

Users with this role have global permissions within Microsoft Power BI, when the service is present, as well as the ability to manage support tickets and monitor service health. More information at Understanding the Power BI admin role.

 Note

In Microsoft Graph API, Azure AD Graph API, and Azure AD PowerShell, this role is identified as "Power BI Service Administrator ". It is "Power BI Administrator" in the Azure portal.

Privileged Authentication Administrator

Users with this role can set or reset non-password credentials for all users, including global administrators, and can update passwords for all users. Privileged Authentication Administrators can force users to re-register against existing non-password credential (e.g. MFA, FIDO) and revoke ‘remember MFA on the device’, prompting for MFA on the next login of all users.

Privileged Role Administrator

Users with this role can manage role assignments in Azure Active Directory, as well as within Azure AD Privileged Identity Management. In addition, this role allows management of all aspects of Privileged Identity Management and administrative units.

 Important

This role grants the ability to manage assignments for all Azure AD roles including the Global Administrator role. This role does not include any other privileged abilities in Azure AD like creating or updating users. However, users assigned to this role can grant themselves or others additional privilege by assigning additional roles.

Reports Reader

Users with this role can view usage reporting data and the reports dashboard in Microsoft 365 admin center and the adoption context pack in Power BI. Additionally, the role provides access to sign-in reports and activity in Azure AD and data returned by the Microsoft Graph reporting API. A user assigned to the Reports Reader role can access only relevant usage and adoption metrics. They don't have any admin permissions to configure settings or access the product-specific admin centers like Exchange. This role has no access to view, create, or manage support tickets.

Search Administrator

Users in this role have full access to all Microsoft Search management features in the Microsoft 365 admin center. Search Administrators can delegate the Search Administrators and Search Editor roles to users, and create and manage content, like bookmarks, Q&As, and locations. Additionally, these users can view the message center, monitor service health, and create service requests.

Search Editor

Users in this role can create, manage, and delete content for Microsoft Search in the Microsoft 365 admin center, including bookmarks, Q&As, and locations.

Security Administrator

Users with this role have permissions to manage security-related features in the Microsoft 365 security center, Azure Active Directory Identity Protection, Azure Information Protection, and Office 365 Security & Compliance Center. More information about Office 365 permissions is available at Permissions in the Office 365 Security & Compliance Center.

In	Can do
Microsoft 365 security center	Monitor security-related policies across Microsoft 365 services Manage security threats and alerts View reports
Identity Protection Center	All permissions of the Security Reader role Additionally, the ability to perform all Identity Protection Center operations except for resetting passwords
Privileged Identity Management	All permissions of the Security Reader role Cannot manage Azure AD role assignments or settings
Office 365 Security & Compliance Center	Manage security policies View, investigate, and respond to security threats View reports
Azure Advanced Threat Protection	Monitor and respond to suspicious security activity
Windows Defender ATP and EDR	Assign roles Manage machine groups Configure endpoint threat detection and automated remediation View, investigate, and respond to alerts
Intune	Views user, device, enrollment, configuration, and application information Cannot make changes to Intune
Cloud App Security	Add admins, add policies and settings, upload logs and perform governance actions
Azure Security Center	Can view security policies, view security states, edit security policies, view alerts and recommendations, dismiss alerts and recommendations
Office 365 service health	View the health of Office 365 services

Security operator

Users with this role can manage alerts and have global read-only access on security-related feature, including all information in Microsoft 365 security center, Azure Active Directory, Identity Protection, Privileged Identity Management and Office 365 Security & Compliance Center. More information about Office 365 permissions is available at Permissions in the Office 365 Security & Compliance Center.

In	Can do
Microsoft 365 security center	All permissions of the Security Reader role View, investigate, and respond to security threats alerts
Identity Protection Center	All permissions of the Security Reader role Additionally, the ability to perform all Identity Protection Center operations except for resetting passwords
Privileged Identity Management	All permissions of the Security Reader role
Office 365 Security & Compliance Center	All permissions of the Security Reader role View, investigate, and respond to security alerts
Windows Defender ATP and EDR	All permissions of the Security Reader role View, investigate, and respond to security alerts
Intune	All permissions of the Security Reader role
Cloud App Security	All permissions of the Security Reader role
Office 365 service health	View the health of Office 365 services

Security Reader

Users with this role have global read-only access on security-related feature, including all information in Microsoft 365 security center, Azure Active Directory, Identity Protection, Privileged Identity Management, as well as the ability to read Azure Active Directory sign-in reports and audit logs, and in Office 365 Security & Compliance Center. More information about Office 365 permissions is available at Permissions in the Office 365 Security & Compliance Center.

In	Can do
Microsoft 365 security center	View security-related policies across Microsoft 365 services View security threats and alerts View reports
Identity Protection Center	Read all security reports and settings information for security features Anti-spam Encryption Data loss prevention Anti-malware Advanced threat protection Anti-phishing Mailflow rules
Privileged Identity Management	Has read-only access to all information surfaced in Azure AD Privileged Identity Management: Policies and reports for Azure AD role assignments and security reviews. Cannot sign up for Azure AD Privileged Identity Management or make any changes to it. In the Privileged Identity Management portal or via PowerShell, someone in this role can activate additional roles (for example, Global Admin or Privileged Role Administrator), if the user is eligible for them.
Office 365 Security & Compliance Center	View security policies View and investigate security threats View reports
Windows Defender ATP and EDR	View and investigate alerts. When you turn on role-based access control in Windows Defender ATP, users with read-only permissions such as the Azure AD Security reader role lose access until they are assigned to a Windows Defender ATP role.
Intune	Views user, device, enrollment, configuration, and application information. Cannot make changes to Intune.
Cloud App Security	Has read-only permissions and can manage alerts
Azure Security Center	Can view recommendations and alerts, view security policies, view security states, but cannot make changes
Office 365 service health	View the health of Office 365 services

Service Support Administrator

Users with this role can open support requests with Microsoft for Azure and Office 365 services, and views the service dashboard and message center in the Azure portal and Microsoft 365 admin center. More information at About admin roles.

 Note

In Microsoft Graph API, Azure AD Graph API, and Azure AD PowerShell, this role is identified as "Service Support Administrator." It is "Service Administrator" in the Azure portal, the Microsoft 365 admin center, and the Intune portal.

SharePoint Administrator

Users with this role have global permissions within Microsoft SharePoint Online, when the service is present, as well as the ability to create and manage all Office 365 Groups, manage support tickets, and monitor service health. More information at About admin roles.

 Note

In Microsoft Graph API, Azure AD Graph API, and Azure AD PowerShell, this role is identified as "SharePoint Service Administrator." It is "SharePoint Administrator" in the Azure portal.

Skype for Business / Lync Administrator

Users with this role have global permissions within Microsoft Skype for Business, when the service is present, as well as manage Skype-specific user attributes in Azure Active Directory. Additionally, this role grants the ability to manage support tickets and monitor service health, and to access the Teams and Skype for Business Admin Center. The account must also be licensed for Teams or it can't run Teams PowerShell cmdlets. More information at About the Skype for Business admin role and Teams licensing information at Skype for Business and Microsoft Teams add-on licensing

 Note

In Microsoft Graph API, Azure AD Graph API, and Azure AD PowerShell, this role is identified as "Lync Service Administrator." It is "Skype for Business Administrator" in the Azure portal.

Teams Administrator

Users in this role can manage all aspects of the Microsoft Teams workload via the Microsoft Teams & Skype for Business admin center and the respective PowerShell modules. This includes, among other areas, all management tools related to telephony, messaging, meetings, and the teams themselves. This role additionally grants the ability to create and manage all Office 365 Groups, manage support tickets, and monitor service health.

 Note

In Microsoft Graph API, Azure AD Graph API, and Azure AD PowerShell, this role is identified as "Teams Service Administrator ". It is "Teams Administrator" in the Azure portal.

Teams Communications Administrator

Users in this role can manage aspects of the Microsoft Teams workload related to voice & telephony. This includes the management tools for telephone number assignment, voice and meeting policies, and full access to the call analytics toolset.

Teams Communications Support Engineer

Users in this role can troubleshoot communication issues within Microsoft Teams & Skype for Business using the user call troubleshooting tools in the Microsoft Teams & Skype for Business admin center. Users in this role can view full call record information for all participants involved. This role has no access to view, create, or manage support tickets.

Teams Communications Support Specialist

Users in this role can troubleshoot communication issues within Microsoft Teams & Skype for Business using the user call troubleshooting tools in the Microsoft Teams & Skype for Business admin center. Users in this role can only view user details in the call for the specific user they have looked up. This role has no access to view, create, or manage support tickets.

User Administrator

Users with this role can create users, and manage all aspects of users with some restrictions (see below), and can update password expiration policies. Additionally, users with this role can create and manage all groups. This role also includes the ability to create and manage user views, manage support tickets, and monitor service health.

General permissions	Create users and groups Create and manage user views Manage Office support tickets Update password expiration policies
On all users, including all admins	Manage licenses Manage all user properties except User Principal Name
Only on users who are non-admins or in any of the following limited admin roles: Directory Readers Guest Inviter Helpdesk Administrator Message Center Reader Reports Reader User Administrator	Delete and restore Disable and enable Invalidate refresh Tokens Manage all user properties including User Principal Name Reset password Update (FIDO) device keys

 Important

Users with this role can change passwords for people who may have access to sensitive or private information or critical configuration inside and outside of Azure Active Directory. Changing the password of a user may mean the ability to assume that user's identity and permissions. For example:

• Application Registration and Enterprise Application owners, who can manage credentials of apps they own. Those apps may have privileged permissions in Azure AD and elsewhere not granted to User Administrators. Through this path a User Administrator may be able to assume the identity of an application owner and then further assume the identity of a privileged application by updating the credentials for the application.
• Azure subscription owners, who may have access to sensitive or private information or critical configuration in Azure.
• Security Group and Office 365 Group owners, who can manage group membership. Those groups may grant access to sensitive or private information or critical configuration in Azure AD and elsewhere.
• Administrators in other services outside of Azure AD like Exchange Online, Office Security and Compliance Center, and human resources systems.
• Non-administrators like executives, legal counsel, and human resources employees who may have access to sensitive or private information.

Role Permissions

The following tables describe the specific permissions in Azure Active Directory given to each role. Some roles may have additional permissions in Microsoft services outside of Azure Active Directory.

Application Administrator permissions

Can create and manage all aspects of app registrations and enterprise apps.

Actions	Description
microsoft.directory/Application/appProxyAuthentication/update	Update App Proxy authentication properties on service principals in Azure Active Directory.
microsoft.directory/Application/appProxyUrlSettings/update	Update application proxy internal and external URLS in Azure Active Directory.
microsoft.directory/applications/applicationProxy/read	Read all of App Proxy properties.
microsoft.directory/applications/applicationProxy/update	Update all of App Proxy properties.
microsoft.directory/applications/audience/update	Update applications.audience property in Azure Active Directory.
microsoft.directory/applications/authentication/update	Update applications.authentication property in Azure Active Directory.
microsoft.directory/applications/basic/update	Update basic properties on applications in Azure Active Directory.
microsoft.directory/applications/create	Create applications in Azure Active Directory.
microsoft.directory/applications/credentials/update	Update applications.credentials property in Azure Active Directory.
microsoft.directory/applications/delete	Delete applications in Azure Active Directory.
microsoft.directory/applications/owners/update	Update applications.owners property in Azure Active Directory.
microsoft.directory/applications/permissions/update	Update applications.permissions property in Azure Active Directory.
microsoft.directory/applications/policies/update	Update applications.policies property in Azure Active Directory.
microsoft.directory/appRoleAssignments/create	Create appRoleAssignments in Azure Active Directory.
microsoft.directory/appRoleAssignments/read	Read appRoleAssignments in Azure Active Directory.
microsoft.directory/appRoleAssignments/update	Update appRoleAssignments in Azure Active Directory.
microsoft.directory/appRoleAssignments/delete	Delete appRoleAssignments in Azure Active Directory.
microsoft.directory/auditLogs/allProperties/read	Read all properties (including privileged properties) on auditLogs in Azure Active Directory.
microsoft.directory/connectorGroups/everything/read	Read application proxy connector group properties in Azure Active Directory.
microsoft.directory/connectorGroups/everything/update	Update all application proxy connector group properties in Azure Active Directory.
microsoft.directory/connectorGroups/create	Create application proxy connector groups in Azure Active Directory.
microsoft.directory/connectorGroups/delete	Delete application proxy connector groups in Azure Active Directory.
microsoft.directory/connectors/everything/read	Read all application proxy connector properties in Azure Active Directory.
microsoft.directory/connectors/create	Create application proxy connectors in Azure Active Directory.
microsoft.directory/policies/applicationConfiguration/basic/read	Read policies.applicationConfiguration property in Azure Active Directory.
microsoft.directory/policies/applicationConfiguration/basic/update	Update policies.applicationConfiguration property in Azure Active Directory.
microsoft.directory/policies/applicationConfiguration/create	Create policies in Azure Active Directory.
microsoft.directory/policies/applicationConfiguration/delete	Delete policies in Azure Active Directory.
microsoft.directory/policies/applicationConfiguration/owners/read	Read policies.applicationConfiguration property in Azure Active Directory.
microsoft.directory/policies/applicationConfiguration/owners/update	Update policies.applicationConfiguration property in Azure Active Directory.
microsoft.directory/policies/applicationConfiguration/policyAppliedTo/read	Read policies.applicationConfiguration property in Azure Active Directory.
microsoft.directory/servicePrincipals/appRoleAssignedTo/update	Update servicePrincipals.appRoleAssignedTo property in Azure Active Directory.
microsoft.directory/servicePrincipals/appRoleAssignments/update	Update servicePrincipals.appRoleAssignments property in Azure Active Directory.
microsoft.directory/servicePrincipals/audience/update	Update servicePrincipals.audience property in Azure Active Directory.
microsoft.directory/servicePrincipals/authentication/update	Update servicePrincipals.authentication property in Azure Active Directory.
microsoft.directory/servicePrincipals/basic/update	Update basic properties on servicePrincipals in Azure Active Directory.
microsoft.directory/servicePrincipals/create	Create servicePrincipals in Azure Active Directory.
microsoft.directory/servicePrincipals/credentials/update	Update servicePrincipals.credentials property in Azure Active Directory.
microsoft.directory/servicePrincipals/delete	Delete servicePrincipals in Azure Active Directory.
microsoft.directory/servicePrincipals/owners/update	Update servicePrincipals.owners property in Azure Active Directory.
microsoft.directory/servicePrincipals/permissions/update	Update servicePrincipals.permissions property in Azure Active Directory.
microsoft.directory/servicePrincipals/policies/update	Update servicePrincipals.policies property in Azure Active Directory.
microsoft.directory/signInReports/allProperties/read	Read all properties (including privileged properties) on signInReports in Azure Active Directory.
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.azure.supportTickets/allEntities/allTasks	Create and manage Azure support tickets.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.
microsoft.office365.supportTickets/allEntities/allTasks	Create and manage Office 365 support tickets.

Application Developer permissions

Can create application registrations independent of the ‘Users can register applications’ setting.

Actions	Description
microsoft.directory/applications/createAsOwner	Create applications in Azure Active Directory. Creator is added as the first owner, and the created object counts against the creator's 250 created objects quota.
microsoft.directory/appRoleAssignments/createAsOwner	Create appRoleAssignments in Azure Active Directory. Creator is added as the first owner, and the created object counts against the creator's 250 created objects quota.
microsoft.directory/oAuth2PermissionGrants/createAsOwner	Create oAuth2PermissionGrants in Azure Active Directory. Creator is added as the first owner, and the created object counts against the creator's 250 created objects quota.
microsoft.directory/servicePrincipals/createAsOwner	Create servicePrincipals in Azure Active Directory. Creator is added as the first owner, and the created object counts against the creator's 250 created objects quota.

Authentication Administrator permissions

Allowed to view, set and reset authentication method information for any non-admin user.

Actions	Description
microsoft.directory/users/invalidateAllRefreshTokens	Invalidate all user refresh tokens in Azure Active Directory.
microsoft.directory/users/strongAuthentication/update	Update strong authentication properties like MFA credential information.
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.azure.supportTickets/allEntities/allTasks	Create and manage Azure support tickets.
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.
microsoft.office365.supportTickets/allEntities/allTasks	Create and manage Office 365 support tickets.
microsoft.directory/users/password/update	Update passwords for all users in the Office 365 organization. See online documentation for more detail.

Azure Information Protection Administrator permissions

Can manage all aspects of the Azure Information Protection service.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.azure.informationProtection/allEntities/allTasks	Manage all aspects of Azure Information Protection.
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.azure.supportTickets/allEntities/allTasks	Create and manage Azure support tickets.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.
microsoft.office365.supportTickets/allEntities/allTasks	Create and manage Office 365 support tickets.

B2C User Flow Administrator permissions

Create and manage all aspects of user flows.

Actions	Description
microsoft.aad.b2c/userFlows/allTasks	Read and configure user flows in  Azure Active Directory B2C.

B2C User Flow Attribute Administrator permissions

Create and manage the attribute schema available to all user flows.

Actions	Description
microsoft.aad.b2c/userAttributes/allTasks	Read and configure user attributes in  Azure Active Directory B2C.

B2C IEF Keyset Administrator permissions

Manage secrets for federation and encryption in the Identity Experience Framework.

Actions	Description
microsoft.aad.b2c/trustFramework/keySets/allTasks	Read and configure key sets in  Azure Active Directory B2C.

B2C IEF Policy Administrator permissions

Create and manage trust framework policies in the Identity Experience Framework.

Actions	Description
microsoft.aad.b2c/trustFramework/policies/allTasks	Read and configure custom policies in  Azure Active Directory B2C.

Billing Administrator permissions

Can perform common billing related tasks like updating payment information.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.directory/organization/basic/update	Update basic properties on organization in Azure Active Directory.
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.azure.supportTickets/allEntities/allTasks	Create and manage Azure support tickets.
microsoft.commerce.billing/allEntities/allTasks	Manage all aspects of Office 365 billing.
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.
microsoft.office365.supportTickets/allEntities/allTasks	Create and manage Office 365 support tickets.

Cloud Application Administrator permissions

Can create and manage all aspects of app registrations and enterprise apps except App Proxy.

Actions	Description
microsoft.directory/applications/audience/update	Update applications.audience property in Azure Active Directory.
microsoft.directory/applications/authentication/update	Update applications.authentication property in Azure Active Directory.
microsoft.directory/applications/basic/update	Update basic properties on applications in Azure Active Directory.
microsoft.directory/applications/create	Create applications in Azure Active Directory.
microsoft.directory/applications/credentials/update	Update applications.credentials property in Azure Active Directory.
microsoft.directory/applications/delete	Delete applications in Azure Active Directory.
microsoft.directory/applications/owners/update	Update applications.owners property in Azure Active Directory.
microsoft.directory/applications/permissions/update	Update applications.permissions property in Azure Active Directory.
microsoft.directory/applications/policies/update	Update applications.policies property in Azure Active Directory.
microsoft.directory/appRoleAssignments/create	Create appRoleAssignments in Azure Active Directory.
microsoft.directory/appRoleAssignments/update	Update appRoleAssignments in Azure Active Directory.
microsoft.directory/appRoleAssignments/delete	Delete appRoleAssignments in Azure Active Directory.
microsoft.directory/auditLogs/allProperties/read	Read all properties (including privileged properties) on auditLogs in Azure Active Directory.
microsoft.directory/policies/applicationConfiguration/create	Create policies in Azure Active Directory.
microsoft.directory/policies/applicationConfiguration/basic/read	Read policies.applicationConfiguration property in Azure Active Directory.
microsoft.directory/policies/applicationConfiguration/basic/update	Update policies.applicationConfiguration property in Azure Active Directory.
microsoft.directory/policies/applicationConfiguration/delete	Delete policies in Azure Active Directory.
microsoft.directory/policies/applicationConfiguration/owners/read	Read policies.applicationConfiguration property in Azure Active Directory.
microsoft.directory/policies/applicationConfiguration/owners/update	Update policies.applicationConfiguration property in Azure Active Directory.
microsoft.directory/policies/applicationConfiguration/policyAppliedTo/read	Read policies.applicationConfiguration property in Azure Active Directory.
microsoft.directory/servicePrincipals/appRoleAssignedTo/update	Update servicePrincipals.appRoleAssignedTo property in Azure Active Directory.
microsoft.directory/servicePrincipals/appRoleAssignments/update	Update servicePrincipals.appRoleAssignments property in Azure Active Directory.
microsoft.directory/servicePrincipals/audience/update	Update servicePrincipals.audience property in Azure Active Directory.
microsoft.directory/servicePrincipals/authentication/update	Update servicePrincipals.authentication property in Azure Active Directory.
microsoft.directory/servicePrincipals/basic/update	Update basic properties on servicePrincipals in Azure Active Directory.
microsoft.directory/servicePrincipals/create	Create servicePrincipals in Azure Active Directory.
microsoft.directory/servicePrincipals/credentials/update	Update servicePrincipals.credentials property in Azure Active Directory.
microsoft.directory/servicePrincipals/delete	Delete servicePrincipals in Azure Active Directory.
microsoft.directory/servicePrincipals/owners/update	Update servicePrincipals.owners property in Azure Active Directory.
microsoft.directory/servicePrincipals/permissions/update	Update servicePrincipals.permissions property in Azure Active Directory.
microsoft.directory/servicePrincipals/policies/update	Update servicePrincipals.policies property in Azure Active Directory.
microsoft.directory/signInReports/allProperties/read	Read all properties (including privileged properties) on signInReports in Azure Active Directory.
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.azure.supportTickets/allEntities/allTasks	Create and manage Azure support tickets.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.
microsoft.office365.supportTickets/allEntities/allTasks	Create and manage Office 365 support tickets.

Cloud Device Administrator permissions

Full access to manage devices in Azure AD.

Actions	Description
microsoft.directory/auditLogs/allProperties/read	Read all properties (including privileged properties) on auditLogs in Azure Active Directory.
microsoft.directory/devices/bitLockerRecoveryKeys/read	Read devices.bitLockerRecoveryKeys property in Azure Active Directory.
microsoft.directory/devices/delete	Delete devices in Azure Active Directory.
microsoft.directory/devices/disable	Disable devices in Azure Active Directory.
microsoft.directory/devices/enable	Enable devices in Azure Active Directory.
microsoft.directory/signInReports/allProperties/read	Read all properties (including privileged properties) on signInReports in Azure Active Directory.
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.

Company Administrator permissions

Can manage all aspects of Azure AD and Microsoft services that use Azure AD identities.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.aad.cloudAppSecurity/allEntities/allTasks	Create and delete all resources, and read and update standard properties in microsoft.aad.cloudAppSecurity.
microsoft.directory/administrativeUnits/allProperties/allTasks	Create and delete administrativeUnits, and read and update all properties in Azure Active Directory.
microsoft.directory/applications/allProperties/allTasks	Create and delete applications, and read and update all properties in Azure Active Directory.
microsoft.directory/appRoleAssignments/allProperties/allTasks	Create and delete appRoleAssignments, and read and update all properties in Azure Active Directory.
microsoft.directory/auditLogs/allProperties/read	Read all properties (including privileged properties) on auditLogs in Azure Active Directory.
microsoft.directory/contacts/allProperties/allTasks	Create and delete contacts, and read and update all properties in Azure Active Directory.
microsoft.directory/contracts/allProperties/allTasks	Create and delete contracts, and read and update all properties in Azure Active Directory.
microsoft.directory/devices/allProperties/allTasks	Create and delete devices, and read and update all properties in Azure Active Directory.
microsoft.directory/directoryRoles/allProperties/allTasks	Create and delete directoryRoles, and read and update all properties in Azure Active Directory.
microsoft.directory/directoryRoleTemplates/allProperties/allTasks	Create and delete directoryRoleTemplates, and read and update all properties in Azure Active Directory.
microsoft.directory/domains/allProperties/allTasks	Create and delete domains, and read and update all properties in Azure Active Directory.
microsoft.directory/groups/allProperties/allTasks	Create and delete groups, and read and update all properties in Azure Active Directory.
microsoft.directory/groupSettings/allProperties/allTasks	Create and delete groupSettings, and read and update all properties in Azure Active Directory.
microsoft.directory/groupSettingTemplates/allProperties/allTasks	Create and delete groupSettingTemplates, and read and update all properties in Azure Active Directory.
microsoft.directory/loginTenantBranding/allProperties/allTasks	Create and delete loginTenantBranding, and read and update all properties in Azure Active Directory.
microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks	Create and delete oAuth2PermissionGrants, and read and update all properties in Azure Active Directory.
microsoft.directory/organization/allProperties/allTasks	Create and delete organization, and read and update all properties in Azure Active Directory.
microsoft.directory/policies/allProperties/allTasks	Create and delete policies, and read and update all properties in Azure Active Directory.
microsoft.directory/roleAssignments/allProperties/allTasks	Create and delete roleAssignments, and read and update all properties in Azure Active Directory.
microsoft.directory/roleDefinitions/allProperties/allTasks	Create and delete roleDefinitions, and read and update all properties in Azure Active Directory.
microsoft.directory/scopedRoleMemberships/allProperties/allTasks	Create and delete scopedRoleMemberships, and read and update all properties in Azure Active Directory.
microsoft.directory/serviceAction/activateService	Can perform the Activateservice service action in Azure Active Directory
microsoft.directory/serviceAction/disableDirectoryFeature	Can perform the Disabledirectoryfeature service action in Azure Active Directory
microsoft.directory/serviceAction/enableDirectoryFeature	Can perform the Enabledirectoryfeature service action in Azure Active Directory
microsoft.directory/serviceAction/getAvailableExtentionProperties	Can perform the Getavailableextentionproperties service action in Azure Active Directory
microsoft.directory/servicePrincipals/allProperties/allTasks	Create and delete servicePrincipals, and read and update all properties in Azure Active Directory.
microsoft.directory/signInReports/allProperties/read	Read all properties (including privileged properties) on signInReports in Azure Active Directory.
microsoft.directory/subscribedSkus/allProperties/allTasks	Create and delete subscribedSkus, and read and update all properties in Azure Active Directory.
microsoft.directory/users/allProperties/allTasks	Create and delete users, and read and update all properties in Azure Active Directory.
microsoft.directorySync/allEntities/allTasks	Perform all actions in Azure AD Connect.
microsoft.aad.identityProtection/allEntities/allTasks	Create and delete all resources, and read and update standard properties in microsoft.aad.identityProtection.
microsoft.aad.privilegedIdentityManagement/allEntities/read	Read all resources in microsoft.aad.privilegedIdentityManagement.
microsoft.azure.advancedThreatProtection/allEntities/read	Read all resources in microsoft.azure.advancedThreatProtection.
microsoft.azure.informationProtection/allEntities/allTasks	Manage all aspects of Azure Information Protection.
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.azure.supportTickets/allEntities/allTasks	Create and manage Azure support tickets.
microsoft.commerce.billing/allEntities/allTasks	Manage all aspects of Office 365 billing.
microsoft.intune/allEntities/allTasks	Manage all aspects of Intune.
microsoft.office365.complianceManager/allEntities/allTasks	Manage all aspects of Office 365 Compliance Manager
microsoft.office365.desktopAnalytics/allEntities/allTasks	Manage all aspects of Desktop Analytics.
microsoft.office365.exchange/allEntities/allTasks	Manage all aspects of Exchange Online.
microsoft.office365.lockbox/allEntities/allTasks	Manage all aspects of Office 365 Customer Lockbox
microsoft.office365.messageCenter/messages/read	Read messages in microsoft.office365.messageCenter.
microsoft.office365.messageCenter/securityMessages/read	Read securityMessages in microsoft.office365.messageCenter.
microsoft.office365.protectionCenter/allEntities/allTasks	Manage all aspects of Office 365 Protection Center.
microsoft.office365.securityComplianceCenter/allEntities/allTasks	Create and delete all resources, and read and update standard properties in microsoft.office365.securityComplianceCenter.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.
microsoft.office365.sharepoint/allEntities/allTasks	Create and delete all resources, and read and update standard properties in microsoft.office365.sharepoint.
microsoft.office365.skypeForBusiness/allEntities/allTasks	Manage all aspects of Skype for Business Online.
microsoft.office365.supportTickets/allEntities/allTasks	Create and manage Office 365 support tickets.
microsoft.office365.usageReports/allEntities/read	Read Office 365 usage reports.
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.
microsoft.powerApps.dynamics365/allEntities/allTasks	Manage all aspects of Dynamics 365.
microsoft.powerApps.powerBI/allEntities/allTasks	Manage all aspects of Power BI.
microsoft.windows.defenderAdvancedThreatProtection/allEntities/read	Read all resources in microsoft.windows.defenderAdvancedThreatProtection.

Compliance Administrator permissions

Can read and manage compliance configuration and reports in Azure AD and Office 365.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.azure.supportTickets/allEntities/allTasks	Create and manage Azure support tickets.
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.
microsoft.office365.complianceManager/allEntities/allTasks	Manage all aspects of Office 365 Compliance Manager
microsoft.office365.exchange/allEntities/allTasks	Manage all aspects of Exchange Online.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.
microsoft.office365.sharepoint/allEntities/allTasks	Create and delete all resources, and read and update standard properties in microsoft.office365.sharepoint.
microsoft.office365.skypeForBusiness/allEntities/allTasks	Manage all aspects of Skype for Business Online.
microsoft.office365.supportTickets/allEntities/allTasks	Create and manage Office 365 support tickets.

Compliance Data Administrator permissions

Creates and manages compliance content.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.aad.cloudAppSecurity/allEntities/allTasks	Read and configure Microsoft Cloud App Security.
microsoft.azure.informationProtection/allEntities/allTasks	Manage all aspects of Azure Information Protection.
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.azure.supportTickets/allEntities/allTasks	Create and manage Azure support tickets.
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.
microsoft.office365.complianceManager/allEntities/allTasks	Manage all aspects of Office 365 Compliance Manager
microsoft.office365.exchange/allEntities/allTasks	Manage all aspects of Exchange Online.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.
microsoft.office365.sharepoint/allEntities/allTasks	Create and delete all resources, and read and update standard properties in microsoft.office365.sharepoint.
microsoft.office365.skypeForBusiness/allEntities/allTasks	Manage all aspects of Skype for Business Online.
microsoft.office365.supportTickets/allEntities/allTasks	Create and manage Office 365 support tickets.

Conditional Access Administrator permissions

Can manage Conditional Access capabilities.

Actions	Description
microsoft.directory/policies/conditionalAccess/basic/read	Read policies.conditionalAccess property in Azure Active Directory.
microsoft.directory/policies/conditionalAccess/basic/update	Update policies.conditionalAccess property in Azure Active Directory.
microsoft.directory/policies/conditionalAccess/create	Create policies in Azure Active Directory.
microsoft.directory/policies/conditionalAccess/delete	Delete policies in Azure Active Directory.
microsoft.directory/policies/conditionalAccess/owners/read	Read policies.conditionalAccess property in Azure Active Directory.
microsoft.directory/policies/conditionalAccess/owners/update	Update policies.conditionalAccess property in Azure Active Directory.
microsoft.directory/policies/conditionalAccess/policiesAppliedTo/read	Read policies.conditionalAccess property in Azure Active Directory.
microsoft.directory/policies/conditionalAccess/tenantDefault/update	Update policies.conditionalAccess property in Azure Active Directory.

CRM Service Administrator permissions

Can manage all aspects of the Dynamics 365 product.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.azure.supportTickets/allEntities/allTasks	Create and manage Azure support tickets.
microsoft.powerApps.dynamics365/allEntities/allTasks	Manage all aspects of Dynamics 365.
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.
microsoft.office365.supportTickets/allEntities/allTasks	Create and manage Office 365 support tickets.

Customer LockBox Access Approver permissions

Can approve Microsoft support requests to access customer organizational data.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.
microsoft.office365.lockbox/allEntities/allTasks	Manage all aspects of Office 365 Customer Lockbox

Desktop Analytics Administrator permissions

Can manage the Desktop Analytics and Office Customization & Policy services. For Desktop Analytics, this includes the ability to view asset inventory, create deployment plans, view deployment and health status. For Office Customization & Policy service, this role enables users to manage Office policies.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.azure.supportTickets/allEntities/allTasks	Create and manage Azure support tickets.
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.
microsoft.office365.desktopAnalytics/allEntities/allTasks	Manage all aspects of Desktop Analytics.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.
microsoft.office365.supportTickets/allEntities/allTasks	Create and manage Office 365 support tickets.

Device Administrators permissions

Users assigned to this role are added to the local administrators group on Azure AD-joined devices.

Actions	Description
microsoft.directory/groupSettings/basic/read	Read basic properties on groupSettings in Azure Active Directory.
microsoft.directory/groupSettingTemplates/basic/read	Read basic properties on groupSettingTemplates in Azure Active Directory.

Directory Readers permissions

Can read basic directory information. For granting access to applications, not intended for users.

Actions	Description
microsoft.directory/administrativeUnits/basic/read	Read basic properties on administrativeUnits in Azure Active Directory.
microsoft.directory/administrativeUnits/members/read	Read administrativeUnits.members property in Azure Active Directory.
microsoft.directory/applications/basic/read	Read basic properties on applications in Azure Active Directory.
microsoft.directory/applications/owners/read	Read applications.owners property in Azure Active Directory.
microsoft.directory/applications/policies/read	Read applications.policies property in Azure Active Directory.
microsoft.directory/contacts/basic/read	Read basic properties on contacts in Azure Active Directory.
microsoft.directory/contacts/memberOf/read	Read contacts.memberOf property in Azure Active Directory.
microsoft.directory/contracts/basic/read	Read basic properties on contracts in Azure Active Directory.
microsoft.directory/devices/basic/read	Read basic properties on devices in Azure Active Directory.
microsoft.directory/devices/memberOf/read	Read devices.memberOf property in Azure Active Directory.
microsoft.directory/devices/registeredOwners/read	Read devices.registeredOwners property in Azure Active Directory.
microsoft.directory/devices/registeredUsers/read	Read devices.registeredUsers property in Azure Active Directory.
microsoft.directory/directoryRoles/basic/read	Read basic properties on directoryRoles in Azure Active Directory.
microsoft.directory/directoryRoles/eligibleMembers/read	Read directoryRoles.eligibleMembers property in Azure Active Directory.
microsoft.directory/directoryRoles/members/read	Read directoryRoles.members property in Azure Active Directory.
microsoft.directory/domains/basic/read	Read basic properties on domains in Azure Active Directory.
microsoft.directory/groups/appRoleAssignments/read	Read groups.appRoleAssignments property in Azure Active Directory.
microsoft.directory/groups/basic/read	Read basic properties on groups in Azure Active Directory.
microsoft.directory/groups/memberOf/read	Read groups.memberOf property in Azure Active Directory.
microsoft.directory/groups/members/read	Read groups.members property in Azure Active Directory.
microsoft.directory/groups/owners/read	Read groups.owners property in Azure Active Directory.
microsoft.directory/groups/settings/read	Read groups.settings property in Azure Active Directory.
microsoft.directory/groupSettings/basic/read	Read basic properties on groupSettings in Azure Active Directory.
microsoft.directory/groupSettingTemplates/basic/read	Read basic properties on groupSettingTemplates in Azure Active Directory.
microsoft.directory/oAuth2PermissionGrants/basic/read	Read basic properties on oAuth2PermissionGrants in Azure Active Directory.
microsoft.directory/organization/basic/read	Read basic properties on organization in Azure Active Directory.
microsoft.directory/organization/trustedCAsForPasswordlessAuth/read	Read organization.trustedCAsForPasswordlessAuth property in Azure Active Directory.
microsoft.directory/roleAssignments/basic/read	Read basic properties on roleAssignments in Azure Active Directory.
microsoft.directory/roleDefinitions/basic/read	Read basic properties on roleDefinitions in Azure Active Directory.
microsoft.directory/servicePrincipals/appRoleAssignedTo/read	Read servicePrincipals.appRoleAssignedTo property in Azure Active Directory.
microsoft.directory/servicePrincipals/appRoleAssignments/read	Read servicePrincipals.appRoleAssignments property in Azure Active Directory.
microsoft.directory/servicePrincipals/basic/read	Read basic properties on servicePrincipals in Azure Active Directory.
microsoft.directory/servicePrincipals/memberOf/read	Read servicePrincipals.memberOf property in Azure Active Directory.
microsoft.directory/servicePrincipals/oAuth2PermissionGrants/basic/read	Read servicePrincipals.oAuth2PermissionGrants property in Azure Active Directory.
microsoft.directory/servicePrincipals/ownedObjects/read	Read servicePrincipals.ownedObjects property in Azure Active Directory.
microsoft.directory/servicePrincipals/owners/read	Read servicePrincipals.owners property in Azure Active Directory.
microsoft.directory/servicePrincipals/policies/read	Read servicePrincipals.policies property in Azure Active Directory.
microsoft.directory/subscribedSkus/basic/read	Read basic properties on subscribedSkus in Azure Active Directory.
microsoft.directory/users/appRoleAssignments/read	Read users.appRoleAssignments property in Azure Active Directory.
microsoft.directory/users/basic/read	Read basic properties on users in Azure Active Directory.
microsoft.directory/users/directReports/read	Read users.directReports property in Azure Active Directory.
microsoft.directory/users/manager/read	Read users.manager property in Azure Active Directory.
microsoft.directory/users/memberOf/read	Read users.memberOf property in Azure Active Directory.
microsoft.directory/users/oAuth2PermissionGrants/basic/read	Read users.oAuth2PermissionGrants property in Azure Active Directory.
microsoft.directory/users/ownedDevices/read	Read users.ownedDevices property in Azure Active Directory.
microsoft.directory/users/ownedObjects/read	Read users.ownedObjects property in Azure Active Directory.
microsoft.directory/users/registeredDevices/read	Read users.registeredDevices property in Azure Active Directory.

Directory Synchronization Accounts permissions

Only used by Azure AD Connect service.

Actions	Description
microsoft.directory/organization/dirSync/update	Update organization.dirSync property in Azure Active Directory.
microsoft.directory/policies/create	Create policies in Azure Active Directory.
microsoft.directory/policies/delete	Delete policies in Azure Active Directory.
microsoft.directory/policies/basic/read	Read basic properties on policies in Azure Active Directory.
microsoft.directory/policies/basic/update	Update basic properties on policies in Azure Active Directory.
microsoft.directory/policies/owners/read	Read policies.owners property in Azure Active Directory.
microsoft.directory/policies/owners/update	Update policies.owners property in Azure Active Directory.
microsoft.directory/policies/policiesAppliedTo/read	Read policies.policiesAppliedTo property in Azure Active Directory.
microsoft.directory/policies/tenantDefault/update	Update policies.tenantDefault property in Azure Active Directory.
microsoft.directory/servicePrincipals/appRoleAssignedTo/read	Read servicePrincipals.appRoleAssignedTo property in Azure Active Directory.
microsoft.directory/servicePrincipals/appRoleAssignedTo/update	Update servicePrincipals.appRoleAssignedTo property in Azure Active Directory.
microsoft.directory/servicePrincipals/appRoleAssignments/read	Read servicePrincipals.appRoleAssignments property in Azure Active Directory.
microsoft.directory/servicePrincipals/appRoleAssignments/update	Update servicePrincipals.appRoleAssignments property in Azure Active Directory.
microsoft.directory/servicePrincipals/audience/update	Update servicePrincipals.audience property in Azure Active Directory.
microsoft.directory/servicePrincipals/authentication/update	Update servicePrincipals.authentication property in Azure Active Directory.
microsoft.directory/servicePrincipals/basic/read	Read basic properties on servicePrincipals in Azure Active Directory.
microsoft.directory/servicePrincipals/basic/update	Update basic properties on servicePrincipals in Azure Active Directory.
microsoft.directory/servicePrincipals/create	Create servicePrincipals in Azure Active Directory.
microsoft.directory/servicePrincipals/credentials/update	Update servicePrincipals.credentials property in Azure Active Directory.
microsoft.directory/servicePrincipals/memberOf/read	Read servicePrincipals.memberOf property in Azure Active Directory.
microsoft.directory/servicePrincipals/oAuth2PermissionGrants/basic/read	Read servicePrincipals.oAuth2PermissionGrants property in Azure Active Directory.
microsoft.directory/servicePrincipals/owners/read	Read servicePrincipals.owners property in Azure Active Directory.
microsoft.directory/servicePrincipals/owners/update	Update servicePrincipals.owners property in Azure Active Directory.
microsoft.directory/servicePrincipals/ownedObjects/read	Read servicePrincipals.ownedObjects property in Azure Active Directory.
microsoft.directory/servicePrincipals/permissions/update	Update servicePrincipals.permissions property in Azure Active Directory.
microsoft.directory/servicePrincipals/policies/read	Read servicePrincipals.policies property in Azure Active Directory.
microsoft.directory/servicePrincipals/policies/update	Update servicePrincipals.policies property in Azure Active Directory.
microsoft.directorySync/allEntities/allTasks	Perform all actions in Azure AD Connect.

Directory Writers permissions

Can read & write basic directory information. For granting access to applications, not intended for users.

Actions	Description
microsoft.directory/groups/create	Create groups in Azure Active Directory.
microsoft.directory/groups/createAsOwner	Create groups in Azure Active Directory. Creator is added as the first owner, and the created object counts against the creator's 250 created objects quota.
microsoft.directory/groups/appRoleAssignments/update	Update groups.appRoleAssignments property in Azure Active Directory.
microsoft.directory/groups/basic/update	Update basic properties on groups in Azure Active Directory.
microsoft.directory/groups/members/update	Update groups.members property in Azure Active Directory.
microsoft.directory/groups/owners/update	Update groups.owners property in Azure Active Directory.
microsoft.directory/groups/settings/update	Update groups.settings property in Azure Active Directory.
microsoft.directory/groupSettings/basic/update	Update basic properties on groupSettings in Azure Active Directory.
microsoft.directory/groupSettings/create	Create groupSettings in Azure Active Directory.
microsoft.directory/groupSettings/delete	Delete groupSettings in Azure Active Directory.
microsoft.directory/users/appRoleAssignments/update	Update users.appRoleAssignments property in Azure Active Directory.
microsoft.directory/users/assignLicense	Manage licenses on users in Azure Active Directory.
microsoft.directory/users/basic/update	Update basic properties on users in Azure Active Directory.
microsoft.directory/users/invalidateAllRefreshTokens	Invalidate all user refresh tokens in Azure Active Directory.
microsoft.directory/users/manager/update	Update users.manager property in Azure Active Directory.
microsoft.directory/users/userPrincipalName/update	Update users.userPrincipalName property in Azure Active Directory.

Exchange Service Administrator permissions

Can manage all aspects of the Exchange product.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.directory/groups/unified/appRoleAssignments/update	Update groups.unified property in Azure Active Directory.
microsoft.directory/groups/unified/basic/update	Update basic properties of Office 365 Groups.
microsoft.directory/groups/unified/create	Create Office 365 Groups.
microsoft.directory/groups/unified/delete	Delete Office 365 Groups.
microsoft.directory/groups/unified/members/update	Update membership of Office 365 Groups.
microsoft.directory/groups/unified/owners/update	Update ownership of Office 365 Groups.
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.azure.supportTickets/allEntities/allTasks	Create and manage Azure support tickets.
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.
microsoft.office365.exchange/allEntities/allTasks	Manage all aspects of Exchange Online.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.
microsoft.office365.supportTickets/allEntities/allTasks	Create and manage Office 365 support tickets.

External Identity Provider Administrator permissions

Configure identity providers for use in direct federation.

Actions	Description
microsoft.aad.b2c/identityProviders/allTasks	Read and configure identity providers in  Azure Active Directory B2C.

Guest Inviter permissions

Can invite guest users independent of the ‘members can invite guests’ setting.

Actions	Description
microsoft.directory/users/appRoleAssignments/read	Read users.appRoleAssignments property in Azure Active Directory.
microsoft.directory/users/basic/read	Read basic properties on users in Azure Active Directory.
microsoft.directory/users/directReports/read	Read users.directReports property in Azure Active Directory.
microsoft.directory/users/inviteGuest	Invite guest users in Azure Active Directory.
microsoft.directory/users/manager/read	Read users.manager property in Azure Active Directory.
microsoft.directory/users/memberOf/read	Read users.memberOf property in Azure Active Directory.
microsoft.directory/users/oAuth2PermissionGrants/basic/read	Read users.oAuth2PermissionGrants property in Azure Active Directory.
microsoft.directory/users/ownedDevices/read	Read users.ownedDevices property in Azure Active Directory.
microsoft.directory/users/ownedObjects/read	Read users.ownedObjects property in Azure Active Directory.
microsoft.directory/users/registeredDevices/read	Read users.registeredDevices property in Azure Active Directory.

Helpdesk Administrator permissions

Can reset passwords for non-administrators and Helpdesk Administrators.

Actions	Description
microsoft.directory/devices/bitLockerRecoveryKeys/read	Read devices.bitLockerRecoveryKeys property in Azure Active Directory.
microsoft.directory/users/invalidateAllRefreshTokens	Invalidate all user refresh tokens in Azure Active Directory.
microsoft.directory/users/password/update	Update passwords for all users in Azure Active Directory. See online documentation for more detail.
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.azure.supportTickets/allEntities/allTasks	Create and manage Azure support tickets.
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.
microsoft.office365.supportTickets/allEntities/allTasks	Create and manage Office 365 support tickets.

Intune Service Administrator permissions

Can manage all aspects of the Intune product.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.directory/contacts/basic/update	Update basic properties on contacts in Azure Active Directory.
microsoft.directory/contacts/create	Create contacts in Azure Active Directory.
microsoft.directory/contacts/delete	Delete contacts in Azure Active Directory.
microsoft.directory/devices/basic/update	Update basic properties on devices in Azure Active Directory.
microsoft.directory/devices/bitLockerRecoveryKeys/read	Read devices.bitLockerRecoveryKeys property in Azure Active Directory.
microsoft.directory/devices/create	Create devices in Azure Active Directory.
microsoft.directory/devices/delete	Delete devices in Azure Active Directory.
microsoft.directory/devices/registeredOwners/update	Update devices.registeredOwners property in Azure Active Directory.
microsoft.directory/devices/registeredUsers/update	Update devices.registeredUsers property in Azure Active Directory.
microsoft.directory/groups/appRoleAssignments/update	Update groups.appRoleAssignments property in Azure Active Directory.
microsoft.directory/groups/basic/update	Update basic properties on groups in Azure Active Directory.
microsoft.directory/groups/create	Create groups in Azure Active Directory.
microsoft.directory/groups/createAsOwner	Create groups in Azure Active Directory. Creator is added as the first owner, and the created object counts against the creator's 250 created objects quota.
microsoft.directory/groups/delete	Delete groups in Azure Active Directory.
microsoft.directory/groups/hiddenMembers/read	Read groups.hiddenMembers property in Azure Active Directory.
microsoft.directory/groups/members/update	Update groups.members property in Azure Active Directory.
microsoft.directory/groups/owners/update	Update groups.owners property in Azure Active Directory.
microsoft.directory/groups/restore	Restore groups in Azure Active Directory.
microsoft.directory/groups/settings/update	Update groups.settings property in Azure Active Directory.
microsoft.directory/users/appRoleAssignments/update	Update users.appRoleAssignments property in Azure Active Directory.
microsoft.directory/users/basic/update	Update basic properties on users in Azure Active Directory.
microsoft.directory/users/manager/update	Update users.manager property in Azure Active Directory.
microsoft.azure.supportTickets/allEntities/allTasks	Create and manage Azure support tickets.
microsoft.intune/allEntities/allTasks	Manage all aspects of Intune.
microsoft.office365.supportTickets/allEntities/allTasks	Create and manage Office 365 support tickets.
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.

Kaizala Administrator permissions

Can manage settings for Microsoft Kaizala.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.
microsoft.office365.supportTickets/allEntities/allTasks	Create and manage Office 365 support tickets.
microsoft.office365.webPortal/allEntities/basic/read	Read Office 365 admin center.

License Administrator permissions

Can manage product licenses on users and groups.

Actions	Description
microsoft.directory/users/assignLicense	Manage licenses on users in Azure Active Directory.
microsoft.directory/users/usageLocation/update	Update users.usageLocation property in Azure Active Directory.
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.

Lync Service Administrator permissions

Can manage all aspects of the Skype for Business product.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.azure.supportTickets/allEntities/allTasks	Create and manage Azure support tickets.
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.
microsoft.office365.skypeForBusiness/allEntities/allTasks	Manage all aspects of Skype for Business Online.
microsoft.office365.supportTickets/allEntities/allTasks	Create and manage Office 365 support tickets.

Message Center Privacy Reader permissions

Can read Message Center posts, data privacy messages, groups, domains and subscriptions.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.
microsoft.office365.messageCenter/messages/read	Read messages in microsoft.office365.messageCenter.
microsoft.office365.messageCenter/securityMessages/read	Read securityMessages in microsoft.office365.messageCenter.

Message Center Reader permissions

Can read messages and updates for their organization in Office 365 Message Center only.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.
microsoft.office365.messageCenter/messages/read	Read messages in microsoft.office365.messageCenter.

Partner Tier1 Support permissions

Do not use - not intended for general use.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.directory/contacts/basic/update	Update basic properties on contacts in Azure Active Directory.
microsoft.directory/contacts/create	Create contacts in Azure Active Directory.
microsoft.directory/contacts/delete	Delete contacts in Azure Active Directory.
microsoft.directory/groups/create	Create groups in Azure Active Directory.
microsoft.directory/groups/createAsOwner	Create groups in Azure Active Directory. Creator is added as the first owner, and the created object counts against the creator's 250 created objects quota.
microsoft.directory/groups/members/update	Update groups.members property in Azure Active Directory.
microsoft.directory/groups/owners/update	Update groups.owners property in Azure Active Directory.
microsoft.directory/users/appRoleAssignments/update	Update users.appRoleAssignments property in Azure Active Directory.
microsoft.directory/users/assignLicense	Manage licenses on users in Azure Active Directory.
microsoft.directory/users/basic/update	Update basic properties on users in Azure Active Directory.
microsoft.directory/users/delete	Delete users in Azure Active Directory.
microsoft.directory/users/invalidateAllRefreshTokens	Invalidate all user refresh tokens in Azure Active Directory.
microsoft.directory/users/manager/update	Update users.manager property in Azure Active Directory.
microsoft.directory/users/password/update	Update passwords for all users in Azure Active Directory. See online documentation for more detail.
microsoft.directory/users/restore	Restore deleted users in Azure Active Directory.
microsoft.directory/users/userPrincipalName/update	Update users.userPrincipalName property in Azure Active Directory.
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.azure.supportTickets/allEntities/allTasks	Create and manage Azure support tickets.
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.
microsoft.office365.supportTickets/allEntities/allTasks	Create and manage Office 365 support tickets.

Partner Tier2 Support permissions

Do not use - not intended for general use.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.directory/contacts/basic/update	Update basic properties on contacts in Azure Active Directory.
microsoft.directory/contacts/create	Create contacts in Azure Active Directory.
microsoft.directory/contacts/delete	Delete contacts in Azure Active Directory.
microsoft.directory/domains/allTasks	Create and delete domains, and read and update standard properties in Azure Active Directory.
microsoft.directory/groups/create	Create groups in Azure Active Directory.
microsoft.directory/groups/delete	Delete groups in Azure Active Directory.
microsoft.directory/groups/members/update	Update groups.members property in Azure Active Directory.
microsoft.directory/groups/restore	Restore groups in Azure Active Directory.
microsoft.directory/organization/basic/update	Update basic properties on organization in Azure Active Directory.
microsoft.directory/users/appRoleAssignments/update	Update users.appRoleAssignments property in Azure Active Directory.
microsoft.directory/users/assignLicense	Manage licenses on users in Azure Active Directory.
microsoft.directory/users/basic/update	Update basic properties on users in Azure Active Directory.
microsoft.directory/users/delete	Delete users in Azure Active Directory.
microsoft.directory/users/invalidateAllRefreshTokens	Invalidate all user refresh tokens in Azure Active Directory.
microsoft.directory/users/manager/update	Update users.manager property in Azure Active Directory.
microsoft.directory/users/password/update	Update passwords for all users in Azure Active Directory. See online documentation for more detail.
microsoft.directory/users/restore	Restore deleted users in Azure Active Directory.
microsoft.directory/users/userPrincipalName/update	Update users.userPrincipalName property in Azure Active Directory.
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.azure.supportTickets/allEntities/allTasks	Create and manage Azure support tickets.
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.
microsoft.office365.supportTickets/allEntities/allTasks	Create and manage Office 365 support tickets.

Password Administrator permissions

Can reset passwords for non-administrators and Password administrators.

Actions	Description
microsoft.directory/users/password/update	Update passwords for all users in Azure Active Directory. See online documentation for more detail.
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.

Power BI Service Administrator permissions

Can manage all aspects of the Power BI product.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.azure.supportTickets/allEntities/allTasks	Create and manage Azure support tickets.
microsoft.powerApps.powerBI/allEntities/allTasks	Manage all aspects of Power BI.
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.
microsoft.office365.supportTickets/allEntities/allTasks	Create and manage Office 365 support tickets.

Privileged Authentication Administrator permissions

Allowed to view, set and reset authentication method information for any user (admin or non-admin).

Actions	Description
microsoft.directory/users/invalidateAllRefreshTokens	Invalidate all user refresh tokens in Azure Active Directory.
microsoft.directory/users/strongAuthentication/update	Update strong authentication properties like MFA credential information.
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.azure.supportTickets/allEntities/allTasks	Create and manage Azure support tickets.
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.
microsoft.office365.supportTickets/allEntities/allTasks	Create and manage Office 365 support tickets.
microsoft.directory/users/password/update	Update passwords for all users in the Office 365 organization. See online documentation for more detail.

Privileged Role Administrator permissions

Can manage role assignments in Azure AD,and all aspects of Privileged Identity Management.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.aad.privilegedIdentityManagement/allEntities/allTasks	Create and delete all resources, and read and update standard properties in microsoft.aad.privilegedIdentityManagement.
microsoft.directory/servicePrincipals/appRoleAssignedTo/allTasks	Read and configure servicePrincipals.appRoleAssignedTo property in Azure Active Directory.
microsoft.directory/servicePrincipals/oAuth2PermissionGrants/allTasks	Read and configure servicePrincipals.oAuth2PermissionGrants property in Azure Active Directory.
microsoft.directory/administrativeUnits/allProperties/allTasks	Create and manage administrative units (including members)
microsoft.directory/roleAssignments/allProperties/allTasks	Create and manage role assignments.
microsoft.directory/roleDefinitions/allProperties/allTasks	Create and manage role definitions.

Reports Reader permissions

Can read sign-in and audit reports.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.directory/auditLogs/allProperties/read	Read all properties (including privileged properties) on auditLogs in Azure Active Directory.
microsoft.directory/signInReports/allProperties/read	Read all properties (including privileged properties) on signInReports in Azure Active Directory.
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.office365.usageReports/allEntities/read	Read Office 365 usage reports.

Search Administrator permissions

Can create and manage all aspects of Microsoft Search settings.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.office365.messageCenter/messages/read	Read messages in microsoft.office365.messageCenter.
microsoft.office365.search/allEntities/allProperties/allTasks	Create and delete all resources, and read and update all properties in microsoft.office365.search.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.
microsoft.office365.supportTickets/allEntities/allTasks	Create and manage Office 365 support tickets.
microsoft.office365.usageReports/allEntities/read	Read Office 365 usage reports.
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.

Search Editor permissions

Can create and manage the editorial content such as bookmarks, Q and As, locations, floorplan.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.office365.messageCenter/messages/read	Read messages in microsoft.office365.messageCenter.
microsoft.office365.search/content/allProperties/allTasks	Create and delete content, and read and update all properties in microsoft.office365.search.
microsoft.office365.usageReports/allEntities/read	Read Office 365 usage reports.

Security Administrator permissions

Can read security information and reports,and manage configuration in Azure AD and Office 365.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.directory/applications/policies/update	Update applications.policies property in Azure Active Directory.
microsoft.directory/auditLogs/allProperties/read	Read all properties (including privileged properties) on auditLogs in Azure Active Directory.
microsoft.directory/devices/bitLockerRecoveryKeys/read	Read devices.bitLockerRecoveryKeys property in Azure Active Directory.
microsoft.directory/policies/basic/update	Update basic properties on policies in Azure Active Directory.
microsoft.directory/policies/create	Create policies in Azure Active Directory.
microsoft.directory/policies/delete	Delete policies in Azure Active Directory.
microsoft.directory/policies/owners/update	Update policies.owners property in Azure Active Directory.
microsoft.directory/policies/tenantDefault/update	Update policies.tenantDefault property in Azure Active Directory.
microsoft.directory/servicePrincipals/policies/update	Update servicePrincipals.policies property in Azure Active Directory.
microsoft.directory/signInReports/allProperties/read	Read all properties (including privileged properties) on signInReports in Azure Active Directory.
microsoft.aad.identityProtection/allEntities/read	Read all resources in microsoft.aad.identityProtection.
microsoft.aad.identityProtection/allEntities/update	Update all resources in microsoft.aad.identityProtection.
microsoft.aad.privilegedIdentityManagement/allEntities/read	Read all resources in microsoft.aad.privilegedIdentityManagement.
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.
microsoft.office365.protectionCenter/allEntities/read	Read all aspects of Office 365 Protection Center.
microsoft.office365.protectionCenter/allEntities/update	Update all resources in microsoft.office365.protectionCenter.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.

Security Operator permissions

Creates and manages security events.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.aad.cloudAppSecurity/allEntities/allTasks	Read and configure Microsoft Cloud App Security.
microsoft.aad.identityProtection/allEntities/read	Read all resources in microsoft.aad.identityProtection.
microsoft.aad.privilegedIdentityManagement/allEntities/read	Read all resources in microsoft.aad.privilegedIdentityManagement.
microsoft.azure.advancedThreatProtection/allEntities/read	Read and configure Azure AD Advanced Threat Protection.
microsoft.intune/allEntities/allTasks	Manage all aspects of Intune.
microsoft.office365.securityComplianceCenter/allEntities/allTasks	Read and configure Security & Compliance Center.
microsoft.office365.usageReports/allEntities/read	Read Office 365 usage reports.
microsoft.windows.defenderAdvancedThreatProtection/allEntities/read	Read and configure Windows Defender Advanced Threat Protection.

Security Reader permissions

Can read security information and reports in Azure AD and Office 365.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.directory/auditLogs/allProperties/read	Read all properties (including privileged properties) on auditLogs in Azure Active Directory.
microsoft.directory/devices/bitLockerRecoveryKeys/read	Read devices.bitLockerRecoveryKeys property in Azure Active Directory.
microsoft.directory/signInReports/allProperties/read	Read all properties (including privileged properties) on signInReports in Azure Active Directory.
microsoft.aad.identityProtection/allEntities/read	Read all resources in microsoft.aad.identityProtection.
microsoft.aad.privilegedIdentityManagement/allEntities/read	Read all resources in microsoft.aad.privilegedIdentityManagement.
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.
microsoft.office365.protectionCenter/allEntities/read	Read all aspects of Office 365 Protection Center.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.

Service Support Administrator permissions

Can read service health information and manage support tickets.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.azure.supportTickets/allEntities/allTasks	Create and manage Azure support tickets.
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.
microsoft.office365.supportTickets/allEntities/allTasks	Create and manage Office 365 support tickets.

SharePoint Service Administrator permissions

Can manage all aspects of the SharePoint service.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.directory/groups/unified/appRoleAssignments/update	Update groups.unified property in Azure Active Directory.
microsoft.directory/groups/unified/basic/update	Update basic properties of Office 365 Groups.
microsoft.directory/groups/unified/create	Create Office 365 Groups.
microsoft.directory/groups/unified/delete	Delete Office 365 Groups.
microsoft.directory/groups/unified/members/update	Update membership of Office 365 Groups.
microsoft.directory/groups/unified/owners/update	Update ownership of Office 365 Groups.
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.azure.supportTickets/allEntities/allTasks	Create and manage Azure support tickets.
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.
microsoft.office365.sharepoint/allEntities/allTasks	Create and delete all resources, and read and update standard properties in microsoft.office365.sharepoint.
microsoft.office365.supportTickets/allEntities/allTasks	Create and manage Office 365 support tickets.

Teams Communications Administrator permissions

Can manage calling and meetings features within the Microsoft Teams service.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.azure.supportTickets/allEntities/allTasks	Create and manage Azure support tickets.
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.
microsoft.office365.supportTickets/allEntities/allTasks	Create and manage Office 365 support tickets.
microsoft.office365.usageReports/allEntities/read	Read Office 365 usage reports.

Teams Communications Support Engineer permissions

Can troubleshoot communications issues within Teams using advanced tools.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.

Teams Communications Support Specialist permissions

Can troubleshoot communications issues within Teams using basic tools.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.

Teams Service Administrator permissions

Can manage the Microsoft Teams service.

 Note

This role has additional permissions outside of Azure Active Directory. For more information, see role description above.

Actions	Description
microsoft.directory/groups/hiddenMembers/read	Read groups.hiddenMembers property in Azure Active Directory.
microsoft.directory/groups/unified/appRoleAssignments/update	Update groups.unified property in Azure Active Directory.
microsoft.directory/groups/unified/basic/update	Update basic properties of Office 365 Groups.
microsoft.directory/groups/unified/create	Create Office 365 Groups.
microsoft.directory/groups/unified/delete	Delete Office 365 Groups.
microsoft.directory/groups/unified/members/update	Update membership of Office 365 Groups.
microsoft.directory/groups/unified/owners/update	Update ownership of Office 365 Groups.
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.azure.supportTickets/allEntities/allTasks	Create and manage Azure support tickets.
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.
microsoft.office365.supportTickets/allEntities/allTasks	Create and manage Office 365 support tickets.
microsoft.office365.usageReports/allEntities/read	Read Office 365 usage reports.

User Administrator permissions

Can manage all aspects of users and groups, including resetting passwords for limited admins.

Actions	Description
microsoft.directory/appRoleAssignments/create	Create appRoleAssignments in Azure Active Directory.
microsoft.directory/appRoleAssignments/delete	Delete appRoleAssignments in Azure Active Directory.
microsoft.directory/appRoleAssignments/update	Update appRoleAssignments in Azure Active Directory.
microsoft.directory/contacts/basic/update	Update basic properties on contacts in Azure Active Directory.
microsoft.directory/contacts/create	Create contacts in Azure Active Directory.
microsoft.directory/contacts/delete	Delete contacts in Azure Active Directory.
microsoft.directory/groups/appRoleAssignments/update	Update groups.appRoleAssignments property in Azure Active Directory.
microsoft.directory/groups/basic/update	Update basic properties on groups in Azure Active Directory.
microsoft.directory/groups/create	Create groups in Azure Active Directory.
microsoft.directory/groups/createAsOwner	Create groups in Azure Active Directory. Creator is added as the first owner, and the created object counts against the creator's 250 created objects quota.
microsoft.directory/groups/delete	Delete groups in Azure Active Directory.
microsoft.directory/groups/hiddenMembers/read	Read groups.hiddenMembers property in Azure Active Directory.
microsoft.directory/groups/members/update	Update groups.members property in Azure Active Directory.
microsoft.directory/groups/owners/update	Update groups.owners property in Azure Active Directory.
microsoft.directory/groups/restore	Restore groups in Azure Active Directory.
microsoft.directory/groups/settings/update	Update groups.settings property in Azure Active Directory.
microsoft.directory/users/appRoleAssignments/update	Update users.appRoleAssignments property in Azure Active Directory.
microsoft.directory/users/assignLicense	Manage licenses on users in Azure Active Directory.
microsoft.directory/users/basic/update	Update basic properties on users in Azure Active Directory.
microsoft.directory/users/create	Create users in Azure Active Directory.
microsoft.directory/users/delete	Delete users in Azure Active Directory.
microsoft.directory/users/invalidateAllRefreshTokens	Invalidate all user refresh tokens in Azure Active Directory.
microsoft.directory/users/manager/update	Update users.manager property in Azure Active Directory.
microsoft.directory/users/password/update	Update passwords for all users in Azure Active Directory. See online documentation for more detail.
microsoft.directory/users/restore	Restore deleted users in Azure Active Directory.
microsoft.directory/users/userPrincipalName/update	Update users.userPrincipalName property in Azure Active Directory.
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health.
microsoft.azure.supportTickets/allEntities/allTasks	Create and manage Azure support tickets.
microsoft.office365.webPortal/allEntities/basic/read	Read basic properties on all resources in microsoft.office365.webPortal.
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Office 365 Service Health.
microsoft.office365.supportTickets/allEntities/allTasks	Create and manage Office 365 support tickets.

Role template IDs

Role template IDs are used mainly by Graph API or PowerShell users.

Graph displayName	Azure portal display name	directoryRoleTemplateId
Application Administrator	Application administrator	9B895D92-2CD3-44C7-9D02-A6AC2D5EA5C3
Application Developer	Application developer	CF1C38E5-3621-4004-A7CB-879624DCED7C
Authentication Administrator	Authentication administrator	c4e39bd9-1100-46d3-8c65-fb160da0071f
Azure Information Protection Administrator	Azure Information Protection administrator	7495fdc4-34c4-4d15-a289-98788ce399fd
B2C User flow Administrator	B2C User flow Administrator	6e591065-9bad-43ed-90f3-e9424366d2f0
B2C User Flow Attribute Administrator	B2C User Flow Attribute Administrator	0f971eea-41eb-4569-a71e-57bb8a3eff1e
B2C IEF Keyset Administrator	B2C IEF Keyset Administrator	aaf43236-0c0d-4d5f-883a-6955382ac081
B2C IEF Policy Administrator	B2C IEF Policy Administrator	3edaf663-341e-4475-9f94-5c398ef6c070
Billing Administrator	Billing administrator	b0f54661-2d74-4c50-afa3-1ec803f12efe
Cloud Application Administrator	Cloud application administrator	158c047a-c907-4556-b7ef-446551a6b5f7
Cloud Device Administrator	Cloud device administrator	7698a772-787b-4ac8-901f-60d6b08affd2
Company Administrator	Global administrator	62e90394-69f5-4237-9190-012177145e10
Compliance Administrator	Compliance administrator	17315797-102d-40b4-93e0-432062caca18
Compliance Data Administrator	Compliance data administrator	e6d1a23a-da11-4be4-9570-befc86d067a7
Conditional Access Administrator	Conditional Access administrator	b1be1c3e-b65d-4f19-8427-f6fa0d97feb9
CRM Service Administrator	Dynamics 365 administrator	44367163-eba1-44c3-98af-f5787879f96a
Customer LockBox Access Approver	Customer Lockbox access approver	5c4f9dcd-47dc-4cf7-8c9a-9e4207cbfc91
Desktop Analytics Administrator	Desktop Analytics Administrator	38a96431-2bdf-4b4c-8b6e-5d3d8abac1a4
Device Administrators	Device administrators	9f06204d-73c1-4d4c-880a-6edb90606fd8
Device Join	Device join	9c094953-4995-41c8-84c8-3ebb9b32c93f
Device Managers	Device managers	2b499bcd-da44-4968-8aec-78e1674fa64d
Device Users	Device users	d405c6df-0af8-4e3b-95e4-4d06e542189e
Directory Readers	Directory readers	88d8e3e3-8f55-4a1e-953a-9b9898b8876b
Directory Synchronization Accounts	Directory synchronization accounts	d29b2b05-8046-44ba-8758-1e26182fcf32
Directory Writers	Directory writers	9360feb5-f418-4baa-8175-e2a00bac4301
Exchange Service Administrator	Exchange administrator	29232cdf-9323-42fd-ade2-1d097af3e4de
External Identity Provider Administrator	External Identity Provider Administrator	be2f45a1-457d-42af-a067-6ec1fa63bc45
Guest Inviter	Guest inviter	95e79109-95c0-4d8e-aee3-d01accf2d47b
Helpdesk Administrator	Password administrator	729827e3-9c14-49f7-bb1b-9608f156bbb8
Intune Service Administrator	Intune administrator	3a2c62db-5318-420d-8d74-23affee5d9d5
Kaizala Administrator	Kaizala administrator	74ef975b-6605-40af-a5d2-b9539d836353
License Administrator	License administrator	4d6ac14f-3453-41d0-bef9-a3e0c569773a
Lync Service Administrator	Skype for Business administrator	75941009-915a-4869-abe7-691bff18279e
Message Center Privacy Reader	Message center privacy reader	ac16e43d-7b2d-40e0-ac05-243ff356ab5b
Message Center Reader	Message center reader	790c1fb9-7f7d-4f88-86a1-ef1f95c05c1b
Partner Tier1 Support	Partner tier1 support	4ba39ca4-527c-499a-b93d-d9b492c50246
Partner Tier2 Support	Partner tier2 support	e00e864a-17c5-4a4b-9c06-f5b95a8d5bd8
Password Administrator	Password administrator	966707d0-3269-4727-9be2-8c3a10f19b9d
Power BI Service Administrator	Power BI administrator	a9ea8996-122f-4c74-9520-8edcd192826c
Privileged Authentication Administrator	Privileged authentication administrator	7be44c8a-adaf-4e2a-84d6-ab2649e08a13
Privileged Role Administrator	Privileged role administrator	e8611ab8-c189-46e8-94e1-60213ab1f814
Reports Reader	Reports reader	4a5d8f65-41da-4de4-8968-e035b65339cf
Search Administrator	Search administrator	0964bb5e-9bdb-4d7b-ac29-58e794862a40
Search Editor	Search editor	8835291a-918c-4fd7-a9ce-faa49f0cf7d9
Security Administrator	Security administrator	194ae4cb-b126-40b2-bd5b-6091b380977d
Security Operator	Security operator	5f2222b1-57c3-48ba-8ad5-d4759f1fde6f
Security Reader	Security reader	5d6b6bb7-de71-4623-b4af-96380a352509
Service Support Administrator	Service administrator	f023fd81-a637-4b56-95fd-791ac0226033
SharePoint Service Administrator	SharePoint administrator	f28a1f50-f6e7-4571-818b-6a12f2af6b6c
Teams Communications Administrator	Teams Communications Administrator	baf37b3a-610e-45da-9e62-d9d1e5e8914b
Teams Communications Support Engineer	Teams Communications Support Engineer	f70938a0-fc10-4177-9e90-2178f8765737
Teams Communications Support Specialist	Teams Communications Support Specialist	fcf91098-03e3-41a9-b5ba-6f0ec8188a12
Teams Service Administrator	Teams Service Administrator	69091246-20e8-4a56-aa4d-066075b2a7a8
User	User	a0b1b346-4d3e-4e8b-98f8-753987be4970
User Account Administrator	User administrator	fe930be7-5e62-47db-91af-98c3a49a38b1
Workplace Device Join	Workplace device join	c34f683f-4d5a-4403-affd-6615e00e3a7f

Deprecated roles

The following roles should not be used. They have been deprecated and will be removed from Azure AD in the future.

• AdHoc License Administrator
• Device Join
• Device Managers
• Device Users
• Email Verified User Creator
• Mailbox Administrator

Add or change Azure subscription administrators

To manage access to Azure resources, you must have the appropriate administrator role. Azure has an authorization system called role-based access control (RBAC) with several built-in roles you can choose from. You can assign these roles at different scopes, such as management group, subscription, or resource group.

Microsoft recommends that you manage access to resources using RBAC. However, if you are still using the classic deployment model and managing the classic resources by using Azure Service Management PowerShell Module, you'll need to use a classic administrator.

 Tip

If you only use the Azure portal to manage the classic resources, you won’t need to use the classic administrator.

For more information, see Azure Resource Manager vs. classic deployment and Azure classic subscription administrators.

This article describes how add or change the administrator role for a user using RBAC at the subscription scope.

Assign a user as an administrator of a subscription

To make a user an administrator of an Azure subscription, assign them the Owner role (an RBAC role) at the subscription scope. The Owner role gives the user full access to all resources in the subscription, including the right to delegate access to others. These steps are the same as any other role assignment.

1. In the Azure portal, open Subscriptions.
2. Click the subscription where you want to grant access.
3. Click Access control (IAM).
4. Click the Role assignments tab to view all the role assignments for this subscription.
   
5. Click Add > Add role assignment to open the Add role assignment pane.
   If you don't have permissions to assign roles, the option will be disabled.
6. In the Role drop-down list, select the Owner role.
7. In the Select list, select a user. If you don't see the user in the list, you can type in the Select box to search the directory for display names and email addresses.
   
8. Click Save to assign the role.
   After a few moments, the user is assigned the Owner role at the subscription scope.

Best Cloud Computing Certificates

Microsoft Azure
Amazon Web Services (AWS)
Google  Cloud Architect (GPC)
Vmware
Citrix
CompTIA
Salesforce Certifications
Red Hat OpenStack
IBM Certified Cloud Solution Architect
CCNA Cloud Certification

Top 6 Cloud Certification – Complete Details of Cloud Computing Certificates

BY DATAFLAIR TEAM · PUBLISHED FEBRUARY 24, 2019 · UPDATED FEBRUARY 23, 2019

Cloud Computing is becoming a major area of interest among people. Along with the interest, the Cloud Computing industry has generated a lot of investment too. if you also want to enter this industry, you should be certified with the best Cloud Computing certification. These Cloud certifications will not only provide you successful growth but also a great position in a company.

List of Cloud Certificates

Below mentioned are a few Cloud Computing certification.

1. AWS Certified Solutions Architect
2. Certificate of Cloud Security Knowledge
3. Certified OpenStack Administrator (COA)
4. Certified System Administrator in Red Hat OpenStack
5. Cisco CCNA-Cloud
6. Cloud Certified Professional
7. Cloud Credential Council
8. CompTIA Cloud Essentials
9. Exin Cloud Computing Foundation
10. Google Certified Professional Cloud Architect
11. IBM Certified Cloud Solution Architect v2
12. CloudU
13. Microsoft Cloud Certifications
14. Red Hat Certified Architect: Cloud
15. Salesforce Certifications
16. VMware Certified Professional
17. Cloud Genius
18. Cloud Institute Certifications

Why Cloud Certifications Are Important?

Cloud computing is growing at 22.8% CAGR and will reach $127.5 billion in a few years. Following are the reasons to take up a cloud certification.

1. The Increment is Earning

The growth in cloud computing is integrating as the salary increases as per the skills and experience. The average salary of cloud architecture is $124, 406. Research by Forbes shows that professionals within AWS certification have a potential annual salary of $125,971. This clearly leads to the fact that cloud computing has a very fast growth.

2. Increase in Demand

It has been estimated that more than 25000 unfilled positions are available in the US which is related to Amazon Web Services alone. Moreover, the number of jobs in Microsoft Azure has increased over the years. The companies are just searching for professionals who are killed to work on the Microsoft Azure platform and certification of all these will help to get admitted in these jobs.

3. Proves Expertise and Enhances Credibility

Certifications along with knowledge are the best way to measure the skills of a person.

It has been estimated that three of the top four important attributes and organization looks for when hiring for a cloud-related position. This Cloud Computing certification implies that a person is capable and skilled to help an organization to reduce risk and cost in the project on different platforms. It also leads to the fact that a person can work on complex procedures and handle cloud deployment in an enterprise.

Best Cloud Computing Certificates

These are the some best Cloud Certifications, you can choose from it.

1. AWS Certified Solutions Architect

Amazon Web Services launched its certification in 2013. There are many job rules based credentials at the foundation associate and professional levels along with certifications. There are several roles for the candidates such as developer, operation, and architect. The professional news certification targets networking professional with two or more years of experience designing and deploying cloud environments on was.

1. Number of Exams- There is only a single exam of AWS Certified Solutions
2. Architect- Professional Level. It consists of mcqs which one has to do in 170 minutes.
3. Cost of the exam- The cost of the exam is $300 which is further administered by Webassessor.
4. Materials provided- AWS provides links and blueprints, practice exams, resource guides etc.

Follow to know best 4 AWS Certifications of IT industry

2. Cisco Certified Network Professional Cloud

The Cisco develops inventory Inspiring training and certification program. This program offers credentials that entry associate professional expert and architect levels. These Cloud certifications are one of the most value equations and their features in this year’s top 5 list.

The candidates opting for the certificate should have basic knowledge of cloud infrastructure and deployment models, networking and cloud storagesolutions, ongoing monitoring and other cloud administrative tasks. To get CCNA cloud two exams are required. Is credentials are valid for 3 years after which the credential holder must rectify by qualifying rectification examinations.

1. Prerequisites and required courses- understanding basic Cisco cloud fundamentals, the introduction of Cisco cloud administration.
2. A number of exams- There are two exams which consist of 55 to 65 questions which are 90 minutes in length.
3. Cost for exams- $300 ($600 both).

3. Cisco Certified Network Associate Cloud

For CCNA cloud or any other Cisco certification, there are some prerequisites or training such a person should be familiar with troubleshooting and implementing the Cisco cloud infrastructure. They should be familiar with designing the Cisco cloud, about automating the Cisco enterprise cloud and building the Cisco cloud with application-centric infrastructure. There are 4 examinations for this Cloud Computing certification and they are-

• Implementing and troubleshooting the Cisco cloud infrastructure
• Designing the Cisco cloud
• Automation of the Cisco cloud
• Building a Cisco cloud with application-centric infrastructure

The cost of the exam is $300 each and the total cost is 1200 dollars. They are few materials provided by the Cisco as the maintenance numerous resources for credential seekers which include blogs study and discussion group training videos self-assessment tools etc. There is a Cisco Marketplace Book Store from where the training materials can be bought.

4. MCSE: Cloud Platform and Infrastructure

This is one of the valuable Cloud computing certifications as it analyses the ability of a candidate to manage data centers in networking virtualization, system and identity management, storage in the cloud technologies which are related to it. This cloud certification candidate to get Microsoft certified solutions associate (MCSA) certification. These exams include topics such as implementing, developing and architecting Azure related solution, configuring and operating hybrid cloud with the help of Azure stack designing. It also helps in designing and implementing big data analytics solutions for cloud data platforms.

Below mentioned are the MCSA certificates along with the examination which an individual should clear.

• Windows Server 2016- 3 exams
• Cloud platform- 2 exams
• Linux on Azure- 2 exam
• Windows server 2012- 3 exams

Te first MCSE exam along with two or three prerequisite exams. The cost of this exam is $165 plus $300 for the prerequisite exam. There are several self-study material charge study groups forums blogs evaluation center and many more they are also downloadable books for purchase. Moreover, there are free training courses on a variety of topics

5. VPC7- CMA (VMware Certified Professional)

This is a type of cloud management and automation certification. Virtualizations play an important role in cloud computing as it has been contributed a lot to it. Company’s newest cloud credential certification is based on Vsphere 6.5 and VRealise. There are few prerequisites which an individual should possess for the certification. A person should have a minimum of 6 months experience on VSphere 8 and VRealise. Complete the following below mentioned courses

• vRealize Automation: Install, Configure, Manage [V7.0], [v7.0]
• Cloud Orchestration and Extensibility
• ZRealize Automation: Orchestration and Extensibility.

These training courses are fluctuating so the candidate should check regularly the training courses which are modified. There are approximately 123 examinations which depend on current VCP certification with 65 questions which an individual has to solve within 110 minutes. There is a passing score of 300 which one should clear to get certified.

Follow this link to know about Virtualization in Cloud Computing

For VSphere 6.5 Foundations there are 70 questions which one should finish in 105 minutes. The minimum passing score is 300.

For VPC7- CMA, there are 85 questions which one has to finish in one 110 minutes. The passing score is 300

The cost of the examiners $125 for the first one and$250 for the second one.

Cloud Computing Job Roles.

Cloud Computing Job Roles.






Cloud administrator: To become a cloud administrator, a candidate generally must have three to five years of practical experience in the cloud. A cloud admin should have a strong understanding of system management, troubleshooting and virtualization. They should know Linux, along with some configuration management tools, monitoring tools and scripting languages. Beyond their cloud knowledge, administrators should have strong leadership and people skills


Cloud architect: A cloud architect focuses on the big picture of infrastructure design and configuration rather than individual server configurations. To succeed, the candidate should bring eight to 10 years of experience and be able to build a roadmap for the organization's existing and future cloud assets

Cloud engineer: A cloud engineer is in charge of any and all technical responsibilities associated with cloud computing. Companies that want to hire a cloud engineer look for someone with three to five years of cloud services experience.

The engineer should be versed in areas such as open source technology, scripting languages, multi-cloud environments, system engineering and software development. This cloud computing job role is responsible for the design, planning and management of the cloud infrastructure. Familiarity with APIs, orchestration and automation, DevOps and databases are all pluses for cloud engineers on top of their computer science or engineering degrees.

Cloud security manager: Security is a concern for both private and public clouds. Providers and users alike take comprehensive security measures to ensure that data is stored safely. Because of this, cloud security roles are vital for IT teams within companies. Cloud security managers should have completed formal training and acquired vendor-neutral certifications to stand out in the job field.

To be competitive, a cloud security manager candidate should have a strong understanding of compliance issues and IT governance related to the cloud. A security manager designs, implements and maintains security strategies. They should know the major modern software development approaches, because the role is often incorporated into software development. Security managers can excel in the position if they constantly monitor the IT landscape to asses and prevent new threats to the corporate cloud estate.

Cloud application developer: An effective cloud application developer has to be a proficient in most -- if not all -- major scripting languages, with typically at least five years of experience. However, specific job roles dictate the expected software tools knowledge. For example, if the job is geared toward web development, demonstrate skills with HTML5 and jQuery. Since software development requires integration tasks, application developers need to know the back-end system integrations with the major cloud platforms.

Cloud app developer applicants should research the common cloud providers and platforms. Someone in this role will build, test and deploy applications in a company's cloud environment -- often using DevOps practices, as well as CI/CD tools. If candidates are experienced, versatile and work well with others, they are a great fit for a cloud application developer position.

Cloud network engineer: A cloud network engineer wears many hats. The role is primarily responsible for the implementation, configuration, maintenance and support of the entire cloud network -- but the obligations don't stop there. Cloud network engineers can also be in charge of the administration, monitoring, documentation, security and integration of the company's network, as well as other related cloud services.

A good network engineer has acquired relevant certifications in networking, security and other industry standards for the job role. Candidates should have practical experience in asset deployment and management. This role requires a strong understanding of data center administration -- preferably more than five years of experience.

Cloud automation engineer: One of the most critical and influential roles that affects a business's success with its cloud strategy is a cloud automation engineer. An automation engineer takes experience from software development or IT operations positions and applies a focus on cloud automation, orchestration and integration. More often than not, this role requires a widespread understanding of hardware and software, as well as data center and cloud infrastructure. A cloud automation engineer implements, optimizes and supports an infrastructure.

To get hired in this growing cloud computing job role, a candidate should have five to 10 years of experience in infrastructure operations and application development, in addition to two or more years of practical experience with CI/CD development models. There are no industry certifications required for this position across the board; expectations vary from employer to employer. A good cloud automation engineer has hands-on experience with cloud platforms and technologies. This is usually a senior position, so it is crucial for the engineer's knowledge and experience to be reflected in her work.

Advantages and Disadvantages Of Cloud Computing

What is Cloud Computing?

Cloud computing is a term referred to storing and accessing data over the internet. It doesn't store any data on the hard disk of your personal computer. In cloud computing, you can access data from a remote server.

Advantages of Cloud Computing

Here, are important benefits for using Cloud computing in your organization:

Cloud Computing

Cost Savings

Cost saving is the biggest benefit of cloud computing. It helps you to save substantial capital cost as it does not need any physical hardware investments. Also, you do not need trained personnel to maintain the hardware. The buying and managing of equipment is done by the cloud service provider.

Strategic edge

Cloud computing offers a competitive edge over your competitors. It helps you to access the latest and applications any time without spending your time and money on installations.

High Speed

Cloud computing allows you to deploy your service quickly in fewer clicks. This faster deployment allows you to get the resources required for your system within fewer minutes.

Back-up and restore data

Once the data is stored in a Cloud, it is easier to get the back-up and recovery of that, which is otherwise very time taking process on-premise.

Automatic Software Integration

In the cloud, software integration is something that occurs automatically. Therefore, you don't need to take additional efforts to customize and integrate your applications as per your preferences.

Reliability

Reliability is one of the biggest pluses of cloud computing. You can always get instantly updated about the changes.

Mobility

Employees who are working on the premises or at the remote locations can easily access all the could services. All they need is an Internet connectivity.

Unlimited storage capacity

The cloud offers almost limitless storage capacity. At any time you can quickly expand your storage capacity with very nominal monthly fees.

Collaboration

The cloud computing platform helps employees who are located in different geographies to collaborate in a highly convenient and secure manner.

Quick Deployment

Last but not least, cloud computing gives you the advantage of rapid deployment. So, when you decide to use the cloud, your entire system can be fully functional in very few minutes. Although, the amount of time taken depends on what kind of technologies are used in your business.

Other Important Benefits

Apart from the above, some other advantages of cloud computing are:

• On-Demand Self-service
• Multi-tenancy
• Offers Resilient Computing
• Fast and effective virtualization
• Provide you low-cost software
• Offers advanced online security
• Location and Device Independence
• Always available, and scales automatically to adjust to the increase in demand
• Allows pay-per-use
• Web-based control & interfaces
• API Access available.

Disadvantages of Cloud Computing

Here, are significant challenges of using Cloud Computing:

Performance Can Vary

When you are working in a cloud environment, your application is running on the server which simultaneously provides resources to other businesses. Any greedy behavior or DDOS attack on your tenant could affect the performance of your shared resource.

Technical Issues

Cloud technology is always prone to an outage and other technical issues. Even, the best cloud service provider companies may face this type of trouble despite maintaining high standards of maintenance.

Security Threat in the Cloud

Another drawback while working with cloud computing services is security risk. Before adopting cloud technology, you should be well aware of the fact that you will be sharing all your company's sensitive information to a third-party cloud computing service provider. Hackers might access this information.

Downtime

Downtime should also be considered while working with cloud computing. That's because your cloud provider may face power loss, low internet connectivity, service maintenance, etc.

Internet Connectivity

Good Internet connectivity is a must in cloud computing. You can't access cloud without an internet connection. Moreover, you don't have any other way to gather data from the cloud.

Lower Bandwidth

Many cloud storage service providers limit bandwidth usage of their users. So, in case if your organization surpasses the given allowance, the additional charges could be significantly costly

Lacks of Support

Cloud Computing companies fail to provide proper support to the customers. Moreover, they want their user to depend on FAQs or online help, which can be a tedious job for non-technical persons.

Conclusion:

Despite all the pro and cons, we can't deny the fact that Cloud Computing is the fastest growing part of network-based computing. It offers a great advantage to customers of all sizes: simple users, developers, enterprises and all types of organizations. So, this technology here to stay for a long time.

Cloud Computing, has now made it effortlessly easy for all to access applications and software from the internet. Earlier the software and applications had to be physically installed but not anymore. With the evolution in technology and the feasibility to access beneficial apps off the internet, businesses are reaping huge benefits from cloud computing.

However, along with the advantages cloud computing provides, the disadvantages are pretty evident. There are several advantages with cloud computing, and there are prominent setbacks as well.

Advantages

Cost Saving

Cloud computing has invariable benefited businesses and organizations to help cut costs. The core strategy of every business is to churn out as much revenue as possible, while keeping the expenses at a minimum. With Cloud Computing, you can save substantial capital costs, with zero expense as you don’t need to install applications or in-house servers. With no in-house servers, the operational costs of running and maintaining them is eliminated. If the servers were present physically this would call for massive expenses for maintenance, air conditioning, power and other associated expenses.

The benefits of associating your business process with cloud is that you pay for the services, and disengage whenever you don’t need the storage service. Organizations do not need to worry about expending a massive portion of the IT capital for an in-house sever.

Often people wonder if it is extremely expensive to afford the cloud, but the fact is that it’s quite convenient even for small businesses to get on the cloud. Cloud services are quite affordable for small businesses as well.

Reliability

With the need to cater to a larger diverse audience, comes a massive bout of responsibility as well. The cloud infrastructure has to be very efficient in catering to the needs of several clients and maintain its consistency in its functionality and services. Most cloud service providers assure a guarantees assistance round the clock for all days of the contract and there is always close to 100% availability. You don’t need to worry about server maintenance and if the host server fails, the hosted files can easily be transitioned to other available servers.

Manageability

The ordeal of maintaining and dealing with server issues become almost non-existent with cloud services. With opting to venture onto cloud services, businesses will benefit massively for enhanced and structured IT services and the various intricate details of managing the servers. All the services related technicalities are taken care by the service provider and you will enjoy the luxury of a simple web-based user interface to access your applications, services and services. Businesses now need not worry about the installation and massive expenditure on setting up a server with all the amenities. The service providers abide by the signed Service-Level-Agreement to ensure timely assistance to your business needs and they guarantee to provide the required service to help you use the cloud based servers.

Strategic Edge

With competitions soaring high, you might be in need of the latest applications to catch up with the rest of the crowd. Through cloud computing you will have access to the latest apps and infrastructure to create, develop and enhance your deliverables. Your company could access software that is the need of the hour, without actually having to invest in installations or in the maintenance of the software.

Cloud computing lets you focus on your key business objectives and not worry too much about the installation of applications and software.

Disadvantages of Cloud Computing

Downtime

With massive overload on the servers from various clients, the service provider might come up against technical outages. Due to this unavoidable situation your business could be temporarily sabotaged.

And in case your internet connection is down, you will not be able to access the data, software or applications on the cloud. So basically you are depending on the quality of the internet to access the tools and software, as it is not installed in-house.

Security

There is room for imminent risk for your data even though cloud service providers abide by strict confidentiality terms, are industry certified and implement the best security standards. When you seek to use cloud-based technology you are extending your access controls to a third party agent to import critical confidential data from your company onto the cloud. With high levels of security and confidentiality involved, the cloud service providers are often faced with security challenges.

The presence of data on the cloud opens up a greater risk of data theft as hackers could find loopholes in the framework. Basically your data on the cloud is at a higher risk, than if it was managed in-house.

Hackers could find ways to gain access to data, scan, exploit a loophole and look for vulnerabilities on the cloud server to gain access to the data.

For instance, when you are dealing with a multi-tenant cloud server, the chances of a hacker breaking into your data is quite high, as the server has data stored by multiple users. But the cloud-based servers take enough precautions to prevent data thefts and the likelihood of being hacked is quite less.

Vendor Lock-In

Companies might find it a bit of a hassle to change the vendors. Although the cloud service providers assure that it is a breeze to use the cloud and integrate your business needs with them, disengaging and moving to the next vendor is not a forte that’s completely evolved. As the applications that work fine with one platform may not be compatible with another. The transition might pose a risk and the change could be inflexible due to synchronisation and support issues.

Limited Control

Organisations could have limited access control on the data, tools and apps as the cloud is controlled by the service provider. It hands over minimal control to the customer, as the access is only limited to the applications, tools and data that is loaded on the server and no access to the infrastructure itself. The customer may not have access to the key administrative services.

Conclusion

The advantages of cloud computing is way too good, is quite cost effective and it is efficient. The drawbacks are incidental and almost negligible. The decision to opt for cloud based services is great with saving substantial costs with regards to installation and maintenance, reduced downtime, almost negligible manpower involved in monitoring the servers and no collateral investment with regards to the infrastructure required to house the servers in-house.