// roles/entra · privileged

AI AdministratorMicrosoft Entra built-in role

Manage all aspects of Microsoft Copilot and AI-related enterprise services in Microsoft 365.

Role ID	`d2562ede-74db-457e-a7b6-544e236ebb61`
Privileged	Yes. Microsoft marks this role as privileged.
Permissions	70

Before you assign it

Microsoft labels this a privileged role, so make it eligible through PIM rather than permanent, require phishing-resistant MFA to activate it, and review who has it regularly.

What it can do

Permission	What it allows
`microsoft.azure.serviceHealth/allEntities/allTasks`	Read and configure Azure Service Health
`microsoft.azure.supportTickets/allEntities/allTasks`	Create and manage Azure support tickets
`microsoft.directory/adminConsentRequestPolicy/allProperties/allTasks`	Manage admin consent request policies in Microsoft Entra ID
`microsoft.directory/agentIdentities/allProperties/read`	Read all properties of agent identities
`microsoft.directory/agentIdentities/appRoleAssignedTo/update`	Update agent identity role assignments
`microsoft.directory/agentIdentities/authentication/update`	Update authentication on agent identities
`microsoft.directory/agentIdentities/basic/update`	Update basic properties on agent identities
`microsoft.directory/agentIdentities/create`	Create agent identities
`microsoft.directory/agentIdentities/delete`	Delete agent identities
`microsoft.directory/agentIdentities/disable`	Disable agent identities
`microsoft.directory/agentIdentities/enable`	Enable agent identities
`microsoft.directory/agentIdentities/owners/update`	Update owners on agent identities
`microsoft.directory/agentIdentities/tag/update`	Update tags of agent identities
`microsoft.directory/agentIdentityBlueprintPrincipals/allProperties/read`	Read all properties of agent identity blueprint principals
`microsoft.directory/agentIdentityBlueprintPrincipals/appRoleAssignedTo/update`	Update agent identity blueprint principal role assignments
`microsoft.directory/agentIdentityBlueprintPrincipals/authentication/update`	Update authentication on agent identity blueprint principals
`microsoft.directory/agentIdentityBlueprintPrincipals/basic/update`	Update basic properties on agent identity blueprint principals
`microsoft.directory/agentIdentityBlueprintPrincipals/create`	Create agent identity blueprint principals
`microsoft.directory/agentIdentityBlueprintPrincipals/delete`	Delete agent identity blueprint principals
`microsoft.directory/agentIdentityBlueprintPrincipals/disable`	Disable agent identity blueprint principals
`microsoft.directory/agentIdentityBlueprintPrincipals/enable`	Enable agent identity blueprint principals
`microsoft.directory/agentIdentityBlueprintPrincipals/owners/update`	Update owners on agent identity blueprint principals
`microsoft.directory/agentIdentityBlueprintPrincipals/tag/update`	Update tags of agent identity blueprint principals
`microsoft.directory/agentIdentityBlueprints/allProperties/read`	Read all properties of agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/allProperties/update`	Update all properties of agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/appRoles/update`	Update appRoles on agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/audience/update`	Update audience on agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/authentication/update`	Update authentication on agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/basic/update`	Update basic properties on agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/create`	Create agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/credentials/update`	Update credentials on agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/delete`	Delete agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/owners/update`	Update owners on agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/permissions/update`	Update exposed permissions and required permissions on agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/tag/update`	Update tags of agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/verification/update`	Update verification on agent identity blueprints
`microsoft.directory/agentUsers/assignLicense`	Assign product licenses for agent users
`microsoft.directory/agentUsers/basic/update`	Update basic properties on agent users, such display name, user type, and mail nickname
`microsoft.directory/agentUsers/create`	Create agent users
`microsoft.directory/agentUsers/delete`	Delete agent users
`microsoft.directory/agentUsers/disable`	Disable agent users
`microsoft.directory/agentUsers/enable`	Enable agent users
`microsoft.directory/agentUsers/invalidateAllRefreshTokens`	Force sign-out by invalidating agent user refresh tokens
`microsoft.directory/agentUsers/lifeCycleInfo/read`	Read lifecycle information of agent users, such as employeeLeaveDateTime
`microsoft.directory/agentUsers/lifeCycleInfo/update`	Update lifecycle information of agent users, such as employeeLeaveDateTime
`microsoft.directory/agentUsers/manager/update`	Update manager for agent users
`microsoft.directory/agentUsers/photo/update`	Update photo of agent users
`microsoft.directory/agentUsers/reprocessLicenseAssignment`	Reprocess license assignments for agent users
`microsoft.directory/agentUsers/restore`	Restore deleted agent users
`microsoft.directory/agentUsers/revokeSignInSessions`	Revoke sign-in sessions for agent users
`microsoft.directory/agentUsers/sponsors/update`	Update sponsors of agent users
`microsoft.directory/agentUsers/usageLocation/update`	Update usage location of agent users
`microsoft.directory/agentUsers/userPrincipalName/update`	Update the user principal name of agent users
`microsoft.directory/deletedItems.agentIdentities/delete`	Permanently delete agent identities, which can no longer be restored
`microsoft.directory/deletedItems.agentIdentities/restore`	Restore soft-deleted agent identities to original state
`microsoft.directory/deletedItems.agentIdentityBlueprintPrincipals/delete`	Permanently delete agent identity blueprint principals, which can no longer be restored
`microsoft.directory/deletedItems.agentIdentityBlueprintPrincipals/restore`	Restore soft-deleted agent identity blueprint principals to original state
`microsoft.directory/deletedItems.agentIdentityBlueprints/delete`	Permanently delete agent identity blueprints, which can no longer be restored
`microsoft.directory/deletedItems.agentIdentityBlueprints/restore`	Restore soft-deleted agent identity blueprints to original state
`microsoft.directory/entitlementManagement/allProperties/read`	Read all properties in Microsoft Entra entitlement management
`microsoft.directory/subscribedSkus/standard/read`	Read basic properties on subscriptions
`microsoft.directory/users/allProperties/read`	Read all properties of users
`microsoft.office365.copilot/allEntities/allProperties/allTasks`	Create and manage all settings for Microsoft Copilot
`microsoft.office365.messageCenter/messages/read`	Read messages in Message Center in the Microsoft 365 admin center, excluding security messages
`microsoft.office365.network/performance/allProperties/read`	Read all network performance properties in the Microsoft 365 admin center
`microsoft.office365.search/content/manage`	Create and delete content, and read and update all properties in Microsoft Search
`microsoft.office365.serviceHealth/allEntities/allTasks`	Read and configure Service Health in the Microsoft 365 admin center
`microsoft.office365.supportTickets/allEntities/allTasks`	Create and manage Microsoft 365 service requests
`microsoft.office365.usageReports/allEntities/allProperties/read`	Read Office 365 usage reports
`microsoft.office365.webPortal/allEntities/standard/read`	Read basic properties on all resources in the Microsoft 365 admin center

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs AI Administrator for <reason>"
    RoleDefinitionId = "d2562ede-74db-457e-a7b6-544e236ebb61"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq 'd2562ede-74db-457e-a7b6-544e236ebb61'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Application Administrator · 73 permissions · privileged
Agent ID Administrator · 64 permissions · privileged
Cloud Application Administrator · 61 permissions · privileged
Hybrid Identity Administrator · 61 permissions · privileged
Security Administrator · 81 permissions · privileged
User Administrator · 56 permissions · privileged
Partner Tier2 Support · 46 permissions · privileged
AI Reader · 45 permissions · privileged

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles