// roles/entra · privileged

Authentication AdministratorMicrosoft Entra built-in role

Can access to view, set and reset authentication method information for any non-admin user.

Role ID	`c4e39bd9-1100-46d3-8c65-fb160da0071f`
Privileged	Yes. Microsoft marks this role as privileged.
Permissions	19

Before you assign it

Microsoft labels this a privileged role, so make it eligible through PIM rather than permanent, require phishing-resistant MFA to activate it, and review who has it regularly.

What it can do

Permission	What it allows
`microsoft.azure.serviceHealth/allEntities/allTasks`	Read and configure Azure Service Health
`microsoft.azure.supportTickets/allEntities/allTasks`	Create and manage Azure support tickets
`microsoft.directory/deletedItems.users/restore`	Restore soft deleted users to original state
`microsoft.directory/users/authenticationMethods/basic/update`	Update basic properties of authentication methods for users
`microsoft.directory/users/authenticationMethods/create`	Update authentication methods for users
`microsoft.directory/users/authenticationMethods/delete`	Delete authentication methods for users
`microsoft.directory/users/authenticationMethods/standard/restrictedRead`	Read standard properties of authentication methods that do not include personally identifiable information for users
`microsoft.directory/users/basic/update`	Update basic properties on users
`microsoft.directory/users/delete`	Delete users
`microsoft.directory/users/disable`	Disable users
`microsoft.directory/users/enable`	Enable users
`microsoft.directory/users/invalidateAllRefreshTokens`	Force sign-out by invalidating user refresh tokens
`microsoft.directory/users/manager/update`	Update manager for users
`microsoft.directory/users/password/update`	Reset passwords for all users
`microsoft.directory/users/restore`	Restore deleted users
`microsoft.directory/users/userPrincipalName/update`	Update User Principal Name of users
`microsoft.office365.serviceHealth/allEntities/allTasks`	Read and configure Service Health in the Microsoft 365 admin center
`microsoft.office365.supportTickets/allEntities/allTasks`	Create and manage Microsoft 365 service requests
`microsoft.office365.webPortal/allEntities/standard/read`	Read basic properties on all resources in the Microsoft 365 admin center

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Authentication Administrator for <reason>"
    RoleDefinitionId = "c4e39bd9-1100-46d3-8c65-fb160da0071f"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq 'c4e39bd9-1100-46d3-8c65-fb160da0071f'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Cloud Device Administrator · 19 permissions · privileged
Privileged Authentication Administrator · 20 permissions · privileged
Security Operator · 17 permissions · privileged
Tenant Governance Administrator · 24 permissions · privileged
Conditional Access Administrator · 13 permissions · privileged
Identity Governance Administrator · 10 permissions · privileged
Privileged Role Administrator · 28 permissions · privileged
Helpdesk Administrator · 9 permissions · privileged

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles