← cd ~/compare
// compare · entra roles
Authentication Administrator vs Privileged Authentication Administrator
Two Microsoft Entra built-in roles that are often confused, compared permission by permission.
In short: Authentication Administrator has 19 permissions, privileged. Privileged Authentication Administrator has 20 permissions, privileged. Assign the one with less access that still covers the job, and use PIM for whichever is privileged.
| Authentication Administrator | Privileged Authentication Administrator | |
|---|---|---|
| What Microsoft says | Can access to view, set and reset authentication method information for any non-admin user. | Can access to view, set and reset authentication method information for any user (admin or non-admin). |
| Size | 19 permissions, privileged | 20 permissions, privileged |
Permissions only Authentication Administrator lists (1)
microsoft.directory/users/authenticationMethods/standard/restrictedRead
Permissions only Privileged Authentication Administrator lists (2)
microsoft.directory/users/authenticationMethods/standard/readmicrosoft.directory/users/authorizationInfo/update
Permissions are listed as Microsoft writes them. A broad one, such as one ending in allTasks, can cover several narrower ones listed for the other role.
Authentication Administrator explained Privileged Authentication Administrator explained