// roles/entra · privileged

Directory WritersMicrosoft Entra built-in role

Can read and write basic directory information. For granting access to applications, not intended for users.

Role ID	`9360feb5-f418-4baa-8175-e2a00bac4301`
Privileged	Yes. Microsoft marks this role as privileged.
Permissions	42

Before you assign it

Microsoft labels this a privileged role, so make it eligible through PIM rather than permanent, require phishing-resistant MFA to activate it, and review who has it regularly.

What it can do

Permission	What it allows
`microsoft.directory/applications/extensionProperties/update`	Update extension properties on applications
`microsoft.directory/contacts/create`	Create contacts
`microsoft.directory/groups/assignedLabels/update`	Update the assigned labels property on groups of assigned membership type, excluding role-assignable groups
`microsoft.directory/groups/assignLicense`	Assign product licenses to groups for group-based licensing
`microsoft.directory/groups/basic/update`	Update basic properties on Security groups and Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups/classification/update`	Update the classification property on Security groups and Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups/create`	Create Security groups and Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups/dynamicMembershipRule/update`	Update the dynamic membership rule on Security groups and Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups/groupType/update`	Update properties that would affect the group type of Security groups and Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups/members/update`	Update members of Security groups and Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups/onPremWriteBack/update`	Update Microsoft Entra groups to be written back to on-premises with Microsoft Entra Connect
`microsoft.directory/groups/owners/update`	Update owners of Security groups and Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups/reprocessLicenseAssignment`	Reprocess license assignments for group-based licensing
`microsoft.directory/groups/settings/update`	Update settings of groups
`microsoft.directory/groups/visibility/update`	Update the visibility property of Security groups and Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groupSettings/basic/update`	Update basic properties on group settings
`microsoft.directory/groupSettings/create`	Create group settings
`microsoft.directory/groupSettings/delete`	Delete group settings
`microsoft.directory/oAuth2PermissionGrants/basic/update`	Update OAuth 2.0 permission grants
`microsoft.directory/oAuth2PermissionGrants/create`	Create OAuth 2.0 permission grants
`microsoft.directory/servicePrincipals/appRoleAssignedTo/update`	Update service principal role assignments
`microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/credentials/manage`	Manage cloud tenant to cloud tenant application provisioning secrets and credentials.
`microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/jobs/manage`	Start, restart, and pause cloud tenant to cloud tenant application provisioning synchronization jobs.
`microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/schema/manage`	Create and manage cloud tenant to cloud tenant application provisioning synchronization jobs and schema.
`microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/credentials/manage`	Manage application provisioning secrets and credentials.
`microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/jobs/manage`	Start, restart, and pause application provisioning synchronization jobs.
`microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/schema/manage`	Create and manage application provisioning synchronization jobs and schema.
`microsoft.directory/servicePrincipals/synchronizationCredentials/manage`	Manage application provisioning secrets and credentials
`microsoft.directory/servicePrincipals/synchronizationJobs/manage`	Start, restart, and pause application provisioning synchronization jobs
`microsoft.directory/servicePrincipals/synchronizationSchema/manage`	Create and manage application provisioning synchronization jobs and schema
`microsoft.directory/users/assignLicense`	Manage user licenses
`microsoft.directory/users/basic/update`	Update basic properties on users
`microsoft.directory/users/create`	Add users
`microsoft.directory/users/disable`	Disable users
`microsoft.directory/users/enable`	Enable users
`microsoft.directory/users/invalidateAllRefreshTokens`	Force sign-out by invalidating user refresh tokens
`microsoft.directory/users/inviteGuest`	Invite guest users
`microsoft.directory/users/manager/update`	Update manager for users
`microsoft.directory/users/photo/update`	Update photo of users
`microsoft.directory/users/reprocessLicenseAssignment`	Reprocess license assignments for users
`microsoft.directory/users/sponsors/update`	Update sponsors of users
`microsoft.directory/users/userPrincipalName/update`	Update User Principal Name of users

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Directory Writers for <reason>"
    RoleDefinitionId = "9360feb5-f418-4baa-8175-e2a00bac4301"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '9360feb5-f418-4baa-8175-e2a00bac4301'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Partner Tier1 Support · 40 permissions · privileged
AI Reader · 45 permissions · privileged
Intune Administrator · 38 permissions · privileged
Partner Tier2 Support · 46 permissions · privileged
Security Reader · 33 permissions · privileged
Privileged Role Administrator · 28 permissions · privileged
User Administrator · 56 permissions · privileged
Tenant Governance Administrator · 24 permissions · privileged

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles