← cd ~/compare
// compare · entra roles
Conditional Access Administrator vs Security Administrator
Two Microsoft Entra built-in roles that are often confused, compared permission by permission.
In short: Conditional Access Administrator has 13 permissions, privileged. Security Administrator has 81 permissions, privileged. Assign the one with less access that still covers the job, and use PIM for whichever is privileged.
| Conditional Access Administrator | Security Administrator | |
|---|---|---|
| What Microsoft says | Can manage Conditional Access capabilities. | Can read security information and reports, and manage configuration in Microsoft Entra ID and Office 365. |
| Size | 13 permissions, privileged | 81 permissions, privileged |
Permissions only Conditional Access Administrator lists (0)
None.
Permissions only Security Administrator lists (68)
microsoft.agentRegistry/allEntities/allProperties/readmicrosoft.azure.serviceHealth/allEntities/allTasksmicrosoft.azure.supportTickets/allEntities/allTasksmicrosoft.directory/applications/policies/updatemicrosoft.directory/auditLogs/allProperties/readmicrosoft.directory/authorizationPolicy/standard/readmicrosoft.directory/bitlockerKeys/key/readmicrosoft.directory/crossTenantAccessPolicy/allowedCloudEndpoints/updatemicrosoft.directory/crossTenantAccessPolicy/basic/updatemicrosoft.directory/crossTenantAccessPolicy/default/b2bCollaboration/updatemicrosoft.directory/crossTenantAccessPolicy/default/b2bDirectConnect/updatemicrosoft.directory/crossTenantAccessPolicy/default/crossCloudMeetings/updatemicrosoft.directory/crossTenantAccessPolicy/default/standard/readmicrosoft.directory/crossTenantAccessPolicy/default/tenantRestrictions/updatemicrosoft.directory/crossTenantAccessPolicy/partners/b2bCollaboration/updatemicrosoft.directory/crossTenantAccessPolicy/partners/b2bDirectConnect/updatemicrosoft.directory/crossTenantAccessPolicy/partners/createmicrosoft.directory/crossTenantAccessPolicy/partners/crossCloudMeetings/updatemicrosoft.directory/crossTenantAccessPolicy/partners/deletemicrosoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/basic/updatemicrosoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/createmicrosoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/standard/readmicrosoft.directory/crossTenantAccessPolicy/partners/standard/readmicrosoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/basic/updatemicrosoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/resetToDefaultSettingsmicrosoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/standard/readmicrosoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/basic/updatemicrosoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/resetToDefaultSettingsmicrosoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/standard/readmicrosoft.directory/crossTenantAccessPolicy/partners/tenantRestrictions/updatemicrosoft.directory/crossTenantAccessPolicy/standard/readmicrosoft.directory/deviceLocalCredentials/standard/readmicrosoft.directory/domains/federation/updatemicrosoft.directory/domains/federationConfiguration/basic/updatemicrosoft.directory/domains/federationConfiguration/createmicrosoft.directory/domains/federationConfiguration/deletemicrosoft.directory/domains/federationConfiguration/standard/readmicrosoft.directory/entitlementManagement/allProperties/readmicrosoft.directory/identityProtection/allProperties/readmicrosoft.directory/identityProtection/allProperties/update
…and 28 more.
Permissions are listed as Microsoft writes them. A broad one, such as one ending in allTasks, can cover several narrower ones listed for the other role.
Conditional Access Administrator explained Security Administrator explained