azureblog.co.uk
← cd ~/compare
// compare · entra roles

User Administrator vs Helpdesk Administrator

Two Microsoft Entra built-in roles that are often confused, compared permission by permission.

In short: User Administrator has 56 permissions, privileged. Helpdesk Administrator has 9 permissions, privileged. Assign the one with less access that still covers the job, and use PIM for whichever is privileged.

User AdministratorHelpdesk Administrator
What Microsoft saysCan manage all aspects of users and groups, including resetting passwords for limited admins.Can reset passwords for non-administrators and Helpdesk Administrators.
Size56 permissions, privileged9 permissions, privileged

Permissions only User Administrator lists (49)

  • microsoft.directory/accessReviews/definitions.applications/allProperties/allTasks
  • microsoft.directory/accessReviews/definitions.directoryRoles/allProperties/read
  • microsoft.directory/accessReviews/definitions.entitlementManagement/allProperties/allTasks
  • microsoft.directory/accessReviews/definitions.groups/allProperties/read
  • microsoft.directory/accessReviews/definitions.groups/allProperties/update
  • microsoft.directory/accessReviews/definitions.groups/create
  • microsoft.directory/accessReviews/definitions.groups/delete
  • microsoft.directory/contacts/basic/update
  • microsoft.directory/contacts/create
  • microsoft.directory/contacts/delete
  • microsoft.directory/deletedItems.groups/restore
  • microsoft.directory/deletedItems.users/restore
  • microsoft.directory/entitlementManagement/allProperties/allTasks
  • microsoft.directory/groups.unified/assignedLabels/update
  • microsoft.directory/groups/assignLicense
  • microsoft.directory/groups/basic/update
  • microsoft.directory/groups/classification/update
  • microsoft.directory/groups/create
  • microsoft.directory/groups/delete
  • microsoft.directory/groups/dynamicMembershipRule/update
  • microsoft.directory/groups/groupType/update
  • microsoft.directory/groups/hiddenMembers/read
  • microsoft.directory/groups/members/update
  • microsoft.directory/groups/onPremWriteBack/update
  • microsoft.directory/groups/owners/update
  • microsoft.directory/groups/reprocessLicenseAssignment
  • microsoft.directory/groups/restore
  • microsoft.directory/groups/settings/update
  • microsoft.directory/groups/visibility/update
  • microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks
  • microsoft.directory/onPremisesSynchronization/standard/read
  • microsoft.directory/policies/standard/read
  • microsoft.directory/servicePrincipals/appRoleAssignedTo/update
  • microsoft.directory/users/assignLicense
  • microsoft.directory/users/basic/update
  • microsoft.directory/users/convertExternalToInternalMemberUser
  • microsoft.directory/users/create
  • microsoft.directory/users/delete
  • microsoft.directory/users/disable
  • microsoft.directory/users/enable

…and 9 more.

Permissions only Helpdesk Administrator lists (2)

  • microsoft.directory/bitlockerKeys/key/read
  • microsoft.directory/deviceLocalCredentials/standard/read

Permissions are listed as Microsoft writes them. A broad one, such as one ending in allTasks, can cover several narrower ones listed for the other role.

User Administrator explained Helpdesk Administrator explained

Sources