azureblog.co.uk
← cd ~/compare
// compare · entra roles

User Administrator vs Groups Administrator

Two Microsoft Entra built-in roles that are often confused, compared permission by permission.

In short: User Administrator has 56 permissions, privileged. Groups Administrator has 26 permissions. Assign the one with less access that still covers the job, and use PIM for whichever is privileged.

DetailUser AdministratorGroups Administrator
What Microsoft saysCan manage all aspects of users and groups, including resetting passwords for limited admins.Members of this role can create/manage groups, create/manage groups settings like naming and expiration policies, and view groups activity and audit reports.
Size56 permissions, privileged26 permissions

Permissions only User Administrator lists (35)

  • microsoft.directory/accessReviews/definitions.applications/allProperties/allTasks
  • microsoft.directory/accessReviews/definitions.directoryRoles/allProperties/read
  • microsoft.directory/accessReviews/definitions.entitlementManagement/allProperties/allTasks
  • microsoft.directory/accessReviews/definitions.groups/allProperties/read
  • microsoft.directory/accessReviews/definitions.groups/allProperties/update
  • microsoft.directory/accessReviews/definitions.groups/create
  • microsoft.directory/accessReviews/definitions.groups/delete
  • microsoft.directory/contacts/basic/update
  • microsoft.directory/contacts/create
  • microsoft.directory/contacts/delete
  • microsoft.directory/deletedItems.users/restore
  • microsoft.directory/entitlementManagement/allProperties/allTasks
  • microsoft.directory/groups.unified/assignedLabels/update
  • microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks
  • microsoft.directory/onPremisesSynchronization/standard/read
  • microsoft.directory/policies/standard/read
  • microsoft.directory/servicePrincipals/appRoleAssignedTo/update
  • microsoft.directory/users/assignLicense
  • microsoft.directory/users/basic/update
  • microsoft.directory/users/convertExternalToInternalMemberUser
  • microsoft.directory/users/create
  • microsoft.directory/users/delete
  • microsoft.directory/users/disable
  • microsoft.directory/users/enable
  • microsoft.directory/users/invalidateAllRefreshTokens
  • microsoft.directory/users/inviteGuest
  • microsoft.directory/users/lifeCycleInfo/read
  • microsoft.directory/users/manager/update
  • microsoft.directory/users/password/update
  • microsoft.directory/users/photo/update
  • microsoft.directory/users/reprocessLicenseAssignment
  • microsoft.directory/users/restore
  • microsoft.directory/users/sponsors/update
  • microsoft.directory/users/usageLocation/update
  • microsoft.directory/users/userPrincipalName/update

Permissions only Groups Administrator lists (5)

  • microsoft.directory/bulkJobs.groups/basic/update
  • microsoft.directory/bulkJobs.groups/create
  • microsoft.directory/bulkJobs.groups/standard/read
  • microsoft.directory/deletedItems.groups/delete
  • microsoft.directory/groups/assignedLabels/update

Permissions are listed as Microsoft writes them. A broad one, such as one ending in allTasks, can cover several narrower ones listed for the other role.

User Administrator explained Groups Administrator explained

Sources

Spotted something out of date or wrong? Tell us and we'll fix it.