azureblog.co.uk
← cd ~/compare
// compare · entra roles

Privileged Role Administrator vs Global Administrator

Two Microsoft Entra built-in roles that are often confused, compared permission by permission.

In short: Privileged Role Administrator has 28 permissions, privileged. Global Administrator has 252 permissions, privileged. Assign the one with less access that still covers the job, and use PIM for whichever is privileged.

Privileged Role AdministratorGlobal Administrator
What Microsoft saysCan manage role assignments in Microsoft Entra ID, and all aspects of Privileged Identity Management.Can manage all aspects of Microsoft Entra ID and Microsoft services that use Microsoft Entra identities.
Size28 permissions, privileged252 permissions, privileged

Permissions only Privileged Role Administrator lists (11)

  • microsoft.directory/accessReviews/definitions.applications/allProperties/read
  • microsoft.directory/accessReviews/definitions.directoryRoles/allProperties/allTasks
  • microsoft.directory/accessReviews/definitions.groups/allProperties/read
  • microsoft.directory/accessReviews/definitions.groupsAssignableToRoles/allProperties/update
  • microsoft.directory/accessReviews/definitions.groupsAssignableToRoles/create
  • microsoft.directory/accessReviews/definitions.groupsAssignableToRoles/delete
  • microsoft.directory/permissionGrantPolicies/allProperties/read
  • microsoft.directory/permissionGrantPolicies/allProperties/update
  • microsoft.directory/privilegedIdentityManagement/allProperties/allTasks
  • microsoft.directory/servicePrincipals/appRoleAssignedTo/update
  • microsoft.directory/servicePrincipals/permissions/update

Permissions only Global Administrator lists (235)

  • microsoft.agentRegistry/allEntities/allProperties/allTasks
  • microsoft.azure.advancedThreatProtection/allEntities/allTasks
  • microsoft.azure.informationProtection/allEntities/allTasks
  • microsoft.azure.serviceHealth/allEntities/allTasks
  • microsoft.azure.supportTickets/allEntities/allTasks
  • microsoft.backup/allEntities/allProperties/allTasks
  • microsoft.cloudPC/allEntities/allProperties/allTasks
  • microsoft.commerce.billing/allEntities/allProperties/allTasks
  • microsoft.commerce.billing/purchases/standard/read
  • microsoft.commerce.tenantRelationships/customerDelegatedAdminPrivileges/allProperties/allTasks
  • microsoft.directory/accessReviews/allProperties/allTasks
  • microsoft.directory/accessReviews/definitions/allProperties/allTasks
  • microsoft.directory/adminConsentRequestPolicy/allProperties/allTasks
  • microsoft.directory/agentIdentities/appRoleAssignedTo/update
  • microsoft.directory/agentIdentities/authentication/update
  • microsoft.directory/agentIdentities/basic/update
  • microsoft.directory/agentIdentities/create
  • microsoft.directory/agentIdentities/delete
  • microsoft.directory/agentIdentities/disable
  • microsoft.directory/agentIdentities/enable
  • microsoft.directory/agentIdentities/owners/update
  • microsoft.directory/agentIdentities/tag/update
  • microsoft.directory/agentIdentityBlueprintPrincipals/appRoleAssignedTo/update
  • microsoft.directory/agentIdentityBlueprintPrincipals/authentication/update
  • microsoft.directory/agentIdentityBlueprintPrincipals/basic/update
  • microsoft.directory/agentIdentityBlueprintPrincipals/create
  • microsoft.directory/agentIdentityBlueprintPrincipals/delete
  • microsoft.directory/agentIdentityBlueprintPrincipals/disable
  • microsoft.directory/agentIdentityBlueprintPrincipals/enable
  • microsoft.directory/agentIdentityBlueprintPrincipals/owners/update
  • microsoft.directory/agentIdentityBlueprintPrincipals/tag/update
  • microsoft.directory/agentIdentityBlueprints/allProperties/update
  • microsoft.directory/agentIdentityBlueprints/appRoles/update
  • microsoft.directory/agentIdentityBlueprints/audience/update
  • microsoft.directory/agentIdentityBlueprints/authentication/update
  • microsoft.directory/agentIdentityBlueprints/basic/update
  • microsoft.directory/agentIdentityBlueprints/create
  • microsoft.directory/agentIdentityBlueprints/credentials/update
  • microsoft.directory/agentIdentityBlueprints/delete
  • microsoft.directory/agentIdentityBlueprints/owners/update

…and 195 more.

Permissions are listed as Microsoft writes them. A broad one, such as one ending in allTasks, can cover several narrower ones listed for the other role.

Privileged Role Administrator explained Global Administrator explained

Sources