← cd ~/compare
// compare · entra roles
Application Developer vs Application Administrator
Two Microsoft Entra built-in roles that are often confused, compared permission by permission.
In short: Application Developer has 3 permissions, privileged. Application Administrator has 73 permissions, privileged. Assign the one with less access that still covers the job, and use PIM for whichever is privileged.
| Detail | Application Developer | Application Administrator |
|---|---|---|
| What Microsoft says | Can create application registrations independent of the 'Users can register applications' setting. | Can create and manage all aspects of app registrations and enterprise apps. |
| Size | 3 permissions, privileged | 73 permissions, privileged |
Permissions only Application Developer lists (3)
microsoft.directory/applications/createAsOwnermicrosoft.directory/oAuth2PermissionGrants/createAsOwnermicrosoft.directory/servicePrincipals/createAsOwner
Permissions only Application Administrator lists (73)
microsoft.azure.serviceHealth/allEntities/allTasksmicrosoft.azure.supportTickets/allEntities/allTasksmicrosoft.directory/adminConsentRequestPolicy/allProperties/allTasksmicrosoft.directory/appConsent/appConsentRequests/allProperties/readmicrosoft.directory/applicationPolicies/basic/updatemicrosoft.directory/applicationPolicies/createmicrosoft.directory/applicationPolicies/deletemicrosoft.directory/applicationPolicies/owners/readmicrosoft.directory/applicationPolicies/owners/updatemicrosoft.directory/applicationPolicies/policyAppliedTo/readmicrosoft.directory/applicationPolicies/standard/readmicrosoft.directory/applications/applicationProxy/readmicrosoft.directory/applications/applicationProxy/updatemicrosoft.directory/applications/applicationProxyAuthentication/updatemicrosoft.directory/applications/applicationProxySslCertificate/updatemicrosoft.directory/applications/applicationProxyUrlSettings/updatemicrosoft.directory/applications/appRoles/updatemicrosoft.directory/applications/audience/updatemicrosoft.directory/applications/authentication/updatemicrosoft.directory/applications/basic/updatemicrosoft.directory/applications/createmicrosoft.directory/applications/credentials/updatemicrosoft.directory/applications/deletemicrosoft.directory/applications/disablement/updatemicrosoft.directory/applications/extensionProperties/updatemicrosoft.directory/applications/notes/updatemicrosoft.directory/applications/owners/updatemicrosoft.directory/applications/permissions/updatemicrosoft.directory/applications/policies/updatemicrosoft.directory/applications/synchronization/standard/readmicrosoft.directory/applications/tag/updatemicrosoft.directory/applications/verification/updatemicrosoft.directory/applicationTemplates/instantiatemicrosoft.directory/auditLogs/allProperties/readmicrosoft.directory/connectorGroups/allProperties/readmicrosoft.directory/connectorGroups/allProperties/updatemicrosoft.directory/connectorGroups/createmicrosoft.directory/connectorGroups/deletemicrosoft.directory/connectors/allProperties/readmicrosoft.directory/connectors/create
…and 33 more.
Permissions are listed as Microsoft writes them. A broad one, such as one ending in allTasks, can cover several narrower ones listed for the other role.
Application Developer explained Application Administrator explained
Spotted something out of date or wrong? Tell us and we'll fix it.