azureblog.co.uk
← cd ~/compare
// compare · entra roles

Hybrid Identity Administrator vs Global Administrator

Two Microsoft Entra built-in roles that are often confused, compared permission by permission.

In short: Hybrid Identity Administrator has 61 permissions, privileged. Global Administrator has 252 permissions, privileged. Assign the one with less access that still covers the job, and use PIM for whichever is privileged.

DetailHybrid Identity AdministratorGlobal Administrator
What Microsoft saysManage Active Directory to Microsoft Entra cloud provisioning, Microsoft Entra Connect, pass-through authentication (PTA), password hash synchronization (PHS), seamless single sign-on (seamless SSO), and federation settings. Does not have access to manage Microsoft Entra Connect Health.Can manage all aspects of Microsoft Entra ID and Microsoft services that use Microsoft Entra identities.
Size61 permissions, privileged252 permissions, privileged

Permissions only Hybrid Identity Administrator lists (34)

  • microsoft.directory/applications/appRoles/update
  • microsoft.directory/applications/audience/update
  • microsoft.directory/applications/authentication/update
  • microsoft.directory/applications/basic/update
  • microsoft.directory/applications/create
  • microsoft.directory/applications/delete
  • microsoft.directory/applications/notes/update
  • microsoft.directory/applications/owners/update
  • microsoft.directory/applications/permissions/update
  • microsoft.directory/applications/policies/update
  • microsoft.directory/applications/tag/update
  • microsoft.directory/cloudProvisioning/allProperties/allTasks
  • microsoft.directory/deletedItems.applications/delete
  • microsoft.directory/deletedItems.applications/restore
  • microsoft.directory/domains/allProperties/read
  • microsoft.directory/domains/federation/update
  • microsoft.directory/organization/dirSync/update
  • microsoft.directory/servicePrincipals/appRoleAssignedTo/update
  • microsoft.directory/servicePrincipals/audience/update
  • microsoft.directory/servicePrincipals/authentication/update
  • microsoft.directory/servicePrincipals/basic/update
  • microsoft.directory/servicePrincipals/create
  • microsoft.directory/servicePrincipals/delete
  • microsoft.directory/servicePrincipals/disable
  • microsoft.directory/servicePrincipals/enable
  • microsoft.directory/servicePrincipals/notes/update
  • microsoft.directory/servicePrincipals/owners/update
  • microsoft.directory/servicePrincipals/permissions/update
  • microsoft.directory/servicePrincipals/policies/update
  • microsoft.directory/servicePrincipals/synchronizationCredentials/manage
  • microsoft.directory/servicePrincipals/synchronizationJobs/manage
  • microsoft.directory/servicePrincipals/synchronizationSchema/manage
  • microsoft.directory/servicePrincipals/tag/update
  • microsoft.directory/users/authorizationInfo/update

Permissions only Global Administrator lists (225)

  • microsoft.agentRegistry/allEntities/allProperties/allTasks
  • microsoft.azure.advancedThreatProtection/allEntities/allTasks
  • microsoft.azure.informationProtection/allEntities/allTasks
  • microsoft.backup/allEntities/allProperties/allTasks
  • microsoft.cloudPC/allEntities/allProperties/allTasks
  • microsoft.commerce.billing/allEntities/allProperties/allTasks
  • microsoft.commerce.billing/purchases/standard/read
  • microsoft.commerce.tenantRelationships/customerDelegatedAdminPrivileges/allProperties/allTasks
  • microsoft.directory/accessReviews/allProperties/allTasks
  • microsoft.directory/accessReviews/definitions/allProperties/allTasks
  • microsoft.directory/adminConsentRequestPolicy/allProperties/allTasks
  • microsoft.directory/administrativeUnits/allProperties/allTasks
  • microsoft.directory/agentIdentities/appRoleAssignedTo/update
  • microsoft.directory/agentIdentities/authentication/update
  • microsoft.directory/agentIdentities/basic/update
  • microsoft.directory/agentIdentities/create
  • microsoft.directory/agentIdentities/delete
  • microsoft.directory/agentIdentities/disable
  • microsoft.directory/agentIdentities/enable
  • microsoft.directory/agentIdentities/owners/update
  • microsoft.directory/agentIdentities/tag/update
  • microsoft.directory/agentIdentityBlueprintPrincipals/appRoleAssignedTo/update
  • microsoft.directory/agentIdentityBlueprintPrincipals/authentication/update
  • microsoft.directory/agentIdentityBlueprintPrincipals/basic/update
  • microsoft.directory/agentIdentityBlueprintPrincipals/create
  • microsoft.directory/agentIdentityBlueprintPrincipals/delete
  • microsoft.directory/agentIdentityBlueprintPrincipals/disable
  • microsoft.directory/agentIdentityBlueprintPrincipals/enable
  • microsoft.directory/agentIdentityBlueprintPrincipals/owners/update
  • microsoft.directory/agentIdentityBlueprintPrincipals/tag/update
  • microsoft.directory/agentIdentityBlueprints/allProperties/update
  • microsoft.directory/agentIdentityBlueprints/appRoles/update
  • microsoft.directory/agentIdentityBlueprints/audience/update
  • microsoft.directory/agentIdentityBlueprints/authentication/update
  • microsoft.directory/agentIdentityBlueprints/basic/update
  • microsoft.directory/agentIdentityBlueprints/create
  • microsoft.directory/agentIdentityBlueprints/credentials/update
  • microsoft.directory/agentIdentityBlueprints/delete
  • microsoft.directory/agentIdentityBlueprints/owners/update
  • microsoft.directory/agentIdentityBlueprints/permissions/update

…and 185 more.

Permissions are listed as Microsoft writes them. A broad one, such as one ending in allTasks, can cover several narrower ones listed for the other role.

Hybrid Identity Administrator explained Global Administrator explained

Sources

Spotted something out of date or wrong? Tell us and we'll fix it.