// roles/entra

Authentication Policy AdministratorMicrosoft Entra built-in role

Can create and manage the authentication methods policy, tenant-wide MFA settings, password protection policy, and verifiable credentials.

Role ID	`0526716b-113d-4c15-b2c8-68e3c22b9f80`
Privileged	No
Permissions	19

What it can do

Permission	What it allows
`microsoft.azure.supportTickets/allEntities/allTasks`	Create and manage Azure support tickets
`microsoft.directory/organization/strongAuthentication/allTasks`	Manage all aspects of strong authentication properties of an organization
`microsoft.directory/userCredentialPolicies/basic/update`	Update basic policies for users
`microsoft.directory/userCredentialPolicies/create`	Create credential policies for users
`microsoft.directory/userCredentialPolicies/delete`	Delete credential policies for users
`microsoft.directory/userCredentialPolicies/owners/read`	Read owners of credential policies for users
`microsoft.directory/userCredentialPolicies/owners/update`	Update owners of credential policies for users
`microsoft.directory/userCredentialPolicies/policyAppliedTo/read`	Read policy.appliesTo navigation link
`microsoft.directory/userCredentialPolicies/standard/read`	Read standard properties of credential policies for users
`microsoft.directory/userCredentialPolicies/tenantDefault/update`	Update policy.isOrganizationDefault property
`microsoft.directory/verifiableCredentials/configuration/allProperties/read`	Read configuration required to create and manage verifiable credentials
`microsoft.directory/verifiableCredentials/configuration/allProperties/update`	Update configuration required to create and manage verifiable credentials
`microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/read`	Read a verifiable credential contract
`microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/update`	Update a verifiable credential contract
`microsoft.directory/verifiableCredentials/configuration/contracts/cards/allProperties/read`	Read a verifiable credential card
`microsoft.directory/verifiableCredentials/configuration/contracts/cards/revoke`	Revoke a verifiable credential card
`microsoft.directory/verifiableCredentials/configuration/contracts/create`	Create a verifiable credential contract
`microsoft.directory/verifiableCredentials/configuration/create`	Create configuration required to create and manage verifiable credentials
`microsoft.directory/verifiableCredentials/configuration/delete`	Delete configuration required to create and manage verifiable credentials and delete all of its verifiable credentials

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Authentication Policy Administrator for <reason>"
    RoleDefinitionId = "0526716b-113d-4c15-b2c8-68e3c22b9f80"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '0526716b-113d-4c15-b2c8-68e3c22b9f80'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Global Secure Access Administrator · 20 permissions
Guest Inviter · 17 permissions
SharePoint Backup Administrator · 17 permissions
Yammer Administrator · 15 permissions
Exchange Administrator · 25 permissions
Knowledge Administrator · 13 permissions
Tenant Governance Relationship Administrator · 13 permissions
Exchange Backup Administrator · 12 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles