// roles/entra · privileged

Agent ID AdministratorMicrosoft Entra built-in role

Manage all aspects of agents in a tenant including identity lifecycle operations for agent blueprints, agent identity blueprint principals, agent identities, and agentic users.

Role ID	`db506228-d27e-4b7d-95e5-295956d6615f`
Privileged	Yes. Microsoft marks this role as privileged.
Permissions	64

Before you assign it

Microsoft labels this a privileged role, so make it eligible through PIM rather than permanent, require phishing-resistant MFA to activate it, and review who has it regularly.

What it can do

Permission	What it allows
`microsoft.azure.serviceHealth/allEntities/allTasks`	Read and configure Azure Service Health
`microsoft.azure.supportTickets/allEntities/allTasks`	Create and manage Azure support tickets
`microsoft.directory/agentIdentities/appRoleAssignedTo/update`	Update agent identity role assignments
`microsoft.directory/agentIdentities/authentication/update`	Update authentication on agent identities
`microsoft.directory/agentIdentities/basic/update`	Update basic properties on agent identities
`microsoft.directory/agentIdentities/create`	Create agent identities
`microsoft.directory/agentIdentities/delete`	Delete agent identities
`microsoft.directory/agentIdentities/disable`	Disable agent identities
`microsoft.directory/agentIdentities/enable`	Enable agent identities
`microsoft.directory/agentIdentities/owners/update`	Update owners on agent identities
`microsoft.directory/agentIdentities/tag/update`	Update tags of agent identities
`microsoft.directory/agentIdentityBlueprintPrincipals/appRoleAssignedTo/update`	Update agent identity blueprint principal role assignments
`microsoft.directory/agentIdentityBlueprintPrincipals/authentication/update`	Update authentication on agent identity blueprint principals
`microsoft.directory/agentIdentityBlueprintPrincipals/basic/update`	Update basic properties on agent identity blueprint principals
`microsoft.directory/agentIdentityBlueprintPrincipals/create`	Create agent identity blueprint principals
`microsoft.directory/agentIdentityBlueprintPrincipals/delete`	Delete agent identity blueprint principals
`microsoft.directory/agentIdentityBlueprintPrincipals/disable`	Disable agent identity blueprint principals
`microsoft.directory/agentIdentityBlueprintPrincipals/enable`	Enable agent identity blueprint principals
`microsoft.directory/agentIdentityBlueprintPrincipals/owners/update`	Update owners on agent identity blueprint principals
`microsoft.directory/agentIdentityBlueprintPrincipals/tag/update`	Update tags of agent identity blueprint principals
`microsoft.directory/agentIdentityBlueprints/allProperties/read`	Read all properties of agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/allProperties/update`	Update all properties of agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/appRoles/update`	Update appRoles on agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/audience/update`	Update audience on agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/authentication/update`	Update authentication on agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/basic/update`	Update basic properties on agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/create`	Create agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/credentials/update`	Update credentials on agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/delete`	Delete agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/owners/update`	Update owners on agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/permissions/update`	Update exposed permissions and required permissions on agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/tag/update`	Update tags of agent identity blueprints
`microsoft.directory/agentUsers/assignLicense`	Assign product licenses for agent users
`microsoft.directory/agentUsers/basic/update`	Update basic properties on agent users, such display name, user type, and mail nickname
`microsoft.directory/agentUsers/create`	Create agent users
`microsoft.directory/agentUsers/delete`	Delete agent users
`microsoft.directory/agentUsers/disable`	Disable agent users
`microsoft.directory/agentUsers/enable`	Enable agent users
`microsoft.directory/agentUsers/invalidateAllRefreshTokens`	Force sign-out by invalidating agent user refresh tokens
`microsoft.directory/agentUsers/lifeCycleInfo/read`	Read lifecycle information of agent users, such as employeeLeaveDateTime
`microsoft.directory/agentUsers/lifeCycleInfo/update`	Update lifecycle information of agent users, such as employeeLeaveDateTime
`microsoft.directory/agentUsers/manager/update`	Update manager for agent users
`microsoft.directory/agentUsers/photo/update`	Update photo of agent users
`microsoft.directory/agentUsers/reprocessLicenseAssignment`	Reprocess license assignments for agent users
`microsoft.directory/agentUsers/restore`	Restore deleted agent users
`microsoft.directory/agentUsers/revokeSignInSessions`	Revoke sign-in sessions for agent users
`microsoft.directory/agentUsers/sponsors/update`	Update sponsors of agent users
`microsoft.directory/agentUsers/usageLocation/update`	Update usage location of agent users
`microsoft.directory/agentUsers/userPrincipalName/update`	Update the user principal name of agent users
`microsoft.directory/auditLogs/allProperties/read`	Read all properties on audit logs, excluding custom security attributes audit logs
`microsoft.directory/deletedItems.agentIdentities/delete`	Permanently delete agent identities, which can no longer be restored
`microsoft.directory/deletedItems.agentIdentities/restore`	Restore soft-deleted agent identities to original state
`microsoft.directory/deletedItems.agentIdentityBlueprintPrincipals/delete`	Permanently delete agent identity blueprint principals, which can no longer be restored
`microsoft.directory/deletedItems.agentIdentityBlueprintPrincipals/restore`	Restore soft-deleted agent identity blueprint principals to original state
`microsoft.directory/deletedItems.agentIdentityBlueprints/delete`	Permanently delete agent identity blueprints, which can no longer be restored
`microsoft.directory/deletedItems.agentIdentityBlueprints/restore`	Restore soft-deleted agent identity blueprints to original state
`microsoft.directory/externalUserProfiles/standard/read`	Read standard properties of external user profiles in the extended directory for Teams
`microsoft.directory/groups.unified/createAsOwner`	Create Microsoft 365 groups, excluding role-assignable groups. Creator is added as the first owner.
`microsoft.directory/groups/hiddenMembers/read`	Read hidden members of Security groups and Microsoft 365 groups, including role-assignable groups
`microsoft.directory/organization/standard/read`	Read basic properties on an organization
`microsoft.directory/policies/standard/read`	Read basic properties on policies
`microsoft.directory/signInReports/allProperties/read`	Read all properties on sign-in reports, including privileged properties
`microsoft.office365.serviceHealth/allEntities/allTasks`	Read and configure Service Health in the Microsoft 365 admin center
`microsoft.office365.supportTickets/allEntities/allTasks`	Create and manage Microsoft 365 service requests

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Agent ID Administrator for <reason>"
    RoleDefinitionId = "db506228-d27e-4b7d-95e5-295956d6615f"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq 'db506228-d27e-4b7d-95e5-295956d6615f'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Cloud Application Administrator · 61 permissions · privileged
Hybrid Identity Administrator · 61 permissions · privileged
AI Administrator · 70 permissions · privileged
User Administrator · 56 permissions · privileged
Application Administrator · 73 permissions · privileged
Security Administrator · 81 permissions · privileged
Partner Tier2 Support · 46 permissions · privileged
AI Reader · 45 permissions · privileged

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles