// roles/entra

Attribute Assignment AdministratorMicrosoft Entra built-in role

Assign custom security attribute keys and values to supported Microsoft Entra objects.

Role ID	`58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d`
Privileged	No
Permissions	10

What it can do

Permission	What it allows
`microsoft.directory/attributeSets/allProperties/read`	Read all properties of attribute sets
`microsoft.directory/azureManagedIdentities/customSecurityAttributes/read`	Read custom security attribute values for Microsoft Entra managed identities
`microsoft.directory/azureManagedIdentities/customSecurityAttributes/update`	Update custom security attribute values for Microsoft Entra managed identities
`microsoft.directory/customSecurityAttributeDefinitions/allProperties/read`	Read all properties of custom security attribute definitions
`microsoft.directory/devices/customSecurityAttributes/read`	Read custom security attribute values for devices
`microsoft.directory/devices/customSecurityAttributes/update`	Update custom security attribute values for devices
`microsoft.directory/servicePrincipals/customSecurityAttributes/read`	Read custom security attribute values for service principals
`microsoft.directory/servicePrincipals/customSecurityAttributes/update`	Update custom security attribute values for service principals
`microsoft.directory/users/customSecurityAttributes/read`	Read custom security attribute values for users
`microsoft.directory/users/customSecurityAttributes/update`	Update custom security attribute values for users

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Attribute Assignment Administrator for <reason>"
    RoleDefinitionId = "58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

IoT Device Administrator · 10 permissions
Teams Telephony Administrator · 10 permissions
Compliance Data Administrator · 9 permissions
Knowledge Manager · 11 permissions
License Administrator · 9 permissions
Teams Communications Administrator · 11 permissions
Dragon Administrator · 8 permissions
Dynamics 365 Business Central Administrator · 8 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles