// compare · entra roles

Application Administrator vs Cloud Application Administrator

Two Microsoft Entra built-in roles that are often confused, compared permission by permission.

In short: Application Administrator has 73 permissions, privileged. Cloud Application Administrator has 61 permissions, privileged. Assign the one with less access that still covers the job, and use PIM for whichever is privileged.

	Application Administrator	Cloud Application Administrator
What Microsoft says	Can create and manage all aspects of app registrations and enterprise apps.	Can create and manage all aspects of app registrations and enterprise apps except App Proxy.
Size	73 permissions, privileged	61 permissions, privileged

Permissions only Application Administrator lists (12)

microsoft.directory/applications/applicationProxy/read
microsoft.directory/applications/applicationProxy/update
microsoft.directory/applications/applicationProxyAuthentication/update
microsoft.directory/applications/applicationProxySslCertificate/update
microsoft.directory/applications/applicationProxyUrlSettings/update
microsoft.directory/connectorGroups/allProperties/read
microsoft.directory/connectorGroups/allProperties/update
microsoft.directory/connectorGroups/create
microsoft.directory/connectorGroups/delete
microsoft.directory/connectors/allProperties/read
microsoft.directory/connectors/create
microsoft.directory/customAuthenticationExtensions/allProperties/allTasks

Permissions only Cloud Application Administrator lists (0)

None.

Permissions are listed as Microsoft writes them. A broad one, such as one ending in allTasks, can cover several narrower ones listed for the other role.

Application Administrator explained Cloud Application Administrator explained

Sources

Microsoft Learn: Microsoft Entra built-in roles