azureblog.co.uk
← cd ~/compare
// compare · entra roles

Security Administrator vs Security Operator

Two Microsoft Entra built-in roles that are often confused, compared permission by permission.

In short: Security Administrator has 81 permissions, privileged. Security Operator has 17 permissions, privileged. Assign the one with less access that still covers the job, and use PIM for whichever is privileged.

Security AdministratorSecurity Operator
What Microsoft saysCan read security information and reports, and manage configuration in Microsoft Entra ID and Office 365.Creates and manages security events and performs identity containment actions during security incidents.
Size81 permissions, privileged17 permissions, privileged

Permissions only Security Administrator lists (74)

  • microsoft.agentRegistry/allEntities/allProperties/read
  • microsoft.azure.serviceHealth/allEntities/allTasks
  • microsoft.directory/applications/policies/update
  • microsoft.directory/bitlockerKeys/key/read
  • microsoft.directory/conditionalAccessPolicies/basic/update
  • microsoft.directory/conditionalAccessPolicies/create
  • microsoft.directory/conditionalAccessPolicies/delete
  • microsoft.directory/conditionalAccessPolicies/owners/read
  • microsoft.directory/conditionalAccessPolicies/owners/update
  • microsoft.directory/conditionalAccessPolicies/policyAppliedTo/read
  • microsoft.directory/conditionalAccessPolicies/standard/read
  • microsoft.directory/conditionalAccessPolicies/tenantDefault/update
  • microsoft.directory/crossTenantAccessPolicy/allowedCloudEndpoints/update
  • microsoft.directory/crossTenantAccessPolicy/basic/update
  • microsoft.directory/crossTenantAccessPolicy/default/b2bCollaboration/update
  • microsoft.directory/crossTenantAccessPolicy/default/b2bDirectConnect/update
  • microsoft.directory/crossTenantAccessPolicy/default/crossCloudMeetings/update
  • microsoft.directory/crossTenantAccessPolicy/default/standard/read
  • microsoft.directory/crossTenantAccessPolicy/default/tenantRestrictions/update
  • microsoft.directory/crossTenantAccessPolicy/partners/b2bCollaboration/update
  • microsoft.directory/crossTenantAccessPolicy/partners/b2bDirectConnect/update
  • microsoft.directory/crossTenantAccessPolicy/partners/create
  • microsoft.directory/crossTenantAccessPolicy/partners/crossCloudMeetings/update
  • microsoft.directory/crossTenantAccessPolicy/partners/delete
  • microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/basic/update
  • microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/create
  • microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/standard/read
  • microsoft.directory/crossTenantAccessPolicy/partners/standard/read
  • microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/basic/update
  • microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/resetToDefaultSettings
  • microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/standard/read
  • microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/basic/update
  • microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/resetToDefaultSettings
  • microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/standard/read
  • microsoft.directory/crossTenantAccessPolicy/partners/tenantRestrictions/update
  • microsoft.directory/crossTenantAccessPolicy/standard/read
  • microsoft.directory/deviceLocalCredentials/standard/read
  • microsoft.directory/domains/federation/update
  • microsoft.directory/domains/federationConfiguration/basic/update
  • microsoft.directory/domains/federationConfiguration/create

…and 34 more.

Permissions only Security Operator lists (10)

  • microsoft.azure.advancedThreatProtection/allEntities/allTasks
  • microsoft.directory/cloudAppSecurity/allProperties/allTasks
  • microsoft.directory/identityProtection/allProperties/allTasks
  • microsoft.directory/users/disable
  • microsoft.directory/users/enable
  • microsoft.directory/users/invalidateAllRefreshTokens
  • microsoft.directory/users/password/update
  • microsoft.intune/allEntities/read
  • microsoft.office365.securityComplianceCenter/allEntities/allTasks
  • microsoft.windows.defenderAdvancedThreatProtection/allEntities/allTasks

Permissions are listed as Microsoft writes them. A broad one, such as one ending in allTasks, can cover several narrower ones listed for the other role.

Security Administrator explained Security Operator explained

Sources