← cd ~/compare
// compare · entra roles
Helpdesk Administrator vs Password Administrator
Two Microsoft Entra built-in roles that are often confused, compared permission by permission.
In short: Helpdesk Administrator has 9 permissions, privileged. Password Administrator has 2 permissions, privileged. Assign the one with less access that still covers the job, and use PIM for whichever is privileged.
| Detail | Helpdesk Administrator | Password Administrator |
|---|---|---|
| What Microsoft says | Can reset passwords for non-administrators and Helpdesk Administrators. | Can reset passwords for non-administrators and Password Administrators. |
| Size | 9 permissions, privileged | 2 permissions, privileged |
Permissions only Helpdesk Administrator lists (7)
microsoft.azure.serviceHealth/allEntities/allTasksmicrosoft.azure.supportTickets/allEntities/allTasksmicrosoft.directory/bitlockerKeys/key/readmicrosoft.directory/deviceLocalCredentials/standard/readmicrosoft.directory/users/invalidateAllRefreshTokensmicrosoft.office365.serviceHealth/allEntities/allTasksmicrosoft.office365.supportTickets/allEntities/allTasks
Permissions only Password Administrator lists (0)
None.
Permissions are listed as Microsoft writes them. A broad one, such as one ending in allTasks, can cover several narrower ones listed for the other role.
Helpdesk Administrator explained Password Administrator explained
Spotted something out of date or wrong? Tell us and we'll fix it.