// roles/entra · privileged

Conditional Access AdministratorMicrosoft Entra built-in role

Can manage Conditional Access capabilities.

Role ID	`b1be1c3e-b65d-4f19-8427-f6fa0d97feb9`
Privileged	Yes. Microsoft marks this role as privileged.
Permissions	13

Before you assign it

Microsoft labels this a privileged role, so make it eligible through PIM rather than permanent, require phishing-resistant MFA to activate it, and review who has it regularly.

What it can do

Permission	What it allows
`microsoft.directory/conditionalAccessPolicies/basic/update`	Update basic properties for Conditional Access policies
`microsoft.directory/conditionalAccessPolicies/create`	Create Conditional Access policies
`microsoft.directory/conditionalAccessPolicies/delete`	Delete Conditional Access policies
`microsoft.directory/conditionalAccessPolicies/owners/read`	Read the owners of Conditional Access policies
`microsoft.directory/conditionalAccessPolicies/owners/update`	Update owners for Conditional Access policies
`microsoft.directory/conditionalAccessPolicies/policyAppliedTo/read`	Read the "applied to" property for Conditional Access policies
`microsoft.directory/conditionalAccessPolicies/standard/read`	Read Conditional Access for policies
`microsoft.directory/conditionalAccessPolicies/tenantDefault/update`	Update the default tenant for Conditional Access policies
`microsoft.directory/namedLocations/basic/update`	Update basic properties of custom rules that define network locations
`microsoft.directory/namedLocations/create`	Create custom rules that define network locations
`microsoft.directory/namedLocations/delete`	Delete custom rules that define network locations
`microsoft.directory/namedLocations/standard/read`	Read basic properties of custom rules that define network locations
`microsoft.directory/resourceNamespaces/resourceActions/authenticationContext/update`	Update Conditional Access authentication context of Microsoft 365 role-based access control (RBAC) resource actions

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Conditional Access Administrator for <reason>"
    RoleDefinitionId = "b1be1c3e-b65d-4f19-8427-f6fa0d97feb9"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq 'b1be1c3e-b65d-4f19-8427-f6fa0d97feb9'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Identity Governance Administrator · 10 permissions · privileged
Helpdesk Administrator · 9 permissions · privileged
Security Operator · 17 permissions · privileged
Authentication Administrator · 19 permissions · privileged
Cloud Device Administrator · 19 permissions · privileged
Privileged Authentication Administrator · 20 permissions · privileged
Entra SOC Identity Responder · 4 permissions · privileged
Application Developer · 3 permissions · privileged

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles