// roles/entra · privileged

Cloud Device AdministratorMicrosoft Entra built-in role

Limited access to manage devices in Microsoft Entra ID.

Role ID	`7698a772-787b-4ac8-901f-60d6b08affd2`
Privileged	Yes. Microsoft marks this role as privileged.
Permissions	19

Before you assign it

Microsoft labels this a privileged role, so make it eligible through PIM rather than permanent, require phishing-resistant MFA to activate it, and review who has it regularly.

What it can do

Permission	What it allows
`microsoft.azure.serviceHealth/allEntities/allTasks`	Read and configure Azure Service Health
`microsoft.directory/auditLogs/allProperties/read`	Read all properties on audit logs, excluding custom security attributes audit logs
`microsoft.directory/authorizationPolicy/standard/read`	Read standard properties of authorization policy
`microsoft.directory/bitlockerKeys/key/read`	Read bitlocker metadata and key on devices
`microsoft.directory/deletedItems.devices/delete`	Permanently delete devices, which can no longer be restored
`microsoft.directory/deletedItems.devices/restore`	Restore soft deleted devices to original state
`microsoft.directory/deviceLocalCredentials/password/read`	Read all properties of the backed up local administrator account credentials for Microsoft Entra joined devices, including the password
`microsoft.directory/deviceManagementPolicies/basic/update`	Update basic properties on mobile device management and mobile app management policies
`microsoft.directory/deviceManagementPolicies/standard/read`	Read standard properties on mobile device management and mobile app management policies
`microsoft.directory/deviceRegistrationPolicy/basic/update`	Update basic properties on device registration policies
`microsoft.directory/deviceRegistrationPolicy/standard/read`	Read standard properties on device registration policies
`microsoft.directory/devices/delete`	Delete devices from Microsoft Entra ID
`microsoft.directory/devices/disable`	Disable devices in Microsoft Entra ID
`microsoft.directory/devices/enable`	Enable devices in Microsoft Entra ID
`microsoft.directory/devices/permissions/update`	Update the alternative name property on an IoT device
`microsoft.directory/deviceTemplates/owners/read`	Read owners on Internet of Things (IoT) device templates
`microsoft.directory/deviceTemplates/owners/update`	Update owners on Internet of Things (IoT) device templates
`microsoft.directory/signInReports/allProperties/read`	Read all properties on sign-in reports, including privileged properties
`microsoft.office365.serviceHealth/allEntities/allTasks`	Read and configure Service Health in the Microsoft 365 admin center

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Cloud Device Administrator for <reason>"
    RoleDefinitionId = "7698a772-787b-4ac8-901f-60d6b08affd2"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '7698a772-787b-4ac8-901f-60d6b08affd2'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Authentication Administrator · 19 permissions · privileged
Privileged Authentication Administrator · 20 permissions · privileged
Security Operator · 17 permissions · privileged
Tenant Governance Administrator · 24 permissions · privileged
Conditional Access Administrator · 13 permissions · privileged
Identity Governance Administrator · 10 permissions · privileged
Privileged Role Administrator · 28 permissions · privileged
Helpdesk Administrator · 9 permissions · privileged

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles