// roles/entra · privileged

Global AdministratorMicrosoft Entra built-in role

Can manage all aspects of Microsoft Entra ID and Microsoft services that use Microsoft Entra identities.

Role ID	`62e90394-69f5-4237-9190-012177145e10`
Privileged	Yes. Microsoft marks this role as privileged.
Permissions	252

Before you assign it

Microsoft labels this a privileged role, so make it eligible through PIM rather than permanent, require phishing-resistant MFA to activate it, and review who has it regularly.

What it can do

Permission	What it allows
`microsoft.agentRegistry/allEntities/allProperties/allTasks`	Manage all aspects of Agent Registry in Microsoft Entra ID
`microsoft.azure.advancedThreatProtection/allEntities/allTasks`	Manage all aspects of Azure Advanced Threat Protection
`microsoft.azure.informationProtection/allEntities/allTasks`	Manage all aspects of Azure Information Protection
`microsoft.azure.serviceHealth/allEntities/allTasks`	Read and configure Azure Service Health
`microsoft.azure.supportTickets/allEntities/allTasks`	Create and manage Azure support tickets
`microsoft.backup/allEntities/allProperties/allTasks`	Manage all aspects of Microsoft 365 Backup
`microsoft.cloudPC/allEntities/allProperties/allTasks`	Manage all aspects of Windows 365
`microsoft.commerce.billing/allEntities/allProperties/allTasks`	Manage all aspects of Office 365 billing
`microsoft.commerce.billing/purchases/standard/read`	Read purchase services in Microsoft 365 admin center.
`microsoft.commerce.tenantRelationships/customerDelegatedAdminPrivileges/allProperties/allTasks`	Manage all aspects of granular delegated admin privileges (GDAP) relationships in a customer tenant.
`microsoft.directory/accessReviews/allProperties/allTasks`	Create and delete access reviews, and read and update all properties of access reviews in Microsoft Entra ID
`microsoft.directory/accessReviews/definitions/allProperties/allTasks`	Manage access reviews of all reviewable resources in Microsoft Entra ID
`microsoft.directory/adminConsentRequestPolicy/allProperties/allTasks`	Manage admin consent request policies in Microsoft Entra ID
`microsoft.directory/administrativeUnits/allProperties/allTasks`	Create and manage administrative units (including members)
`microsoft.directory/agentIdentities/appRoleAssignedTo/update`	Update agent identity role assignments
`microsoft.directory/agentIdentities/authentication/update`	Update authentication on agent identities
`microsoft.directory/agentIdentities/basic/update`	Update basic properties on agent identities
`microsoft.directory/agentIdentities/create`	Create agent identities
`microsoft.directory/agentIdentities/delete`	Delete agent identities
`microsoft.directory/agentIdentities/disable`	Disable agent identities
`microsoft.directory/agentIdentities/enable`	Enable agent identities
`microsoft.directory/agentIdentities/owners/update`	Update owners on agent identities
`microsoft.directory/agentIdentities/tag/update`	Update tags of agent identities
`microsoft.directory/agentIdentityBlueprintPrincipals/appRoleAssignedTo/update`	Update agent identity blueprint principal role assignments
`microsoft.directory/agentIdentityBlueprintPrincipals/authentication/update`	Update authentication on agent identity blueprint principals
`microsoft.directory/agentIdentityBlueprintPrincipals/basic/update`	Update basic properties on agent identity blueprint principals
`microsoft.directory/agentIdentityBlueprintPrincipals/create`	Create agent identity blueprint principals
`microsoft.directory/agentIdentityBlueprintPrincipals/delete`	Delete agent identity blueprint principals
`microsoft.directory/agentIdentityBlueprintPrincipals/disable`	Disable agent identity blueprint principals
`microsoft.directory/agentIdentityBlueprintPrincipals/enable`	Enable agent identity blueprint principals
`microsoft.directory/agentIdentityBlueprintPrincipals/owners/update`	Update owners on agent identity blueprint principals
`microsoft.directory/agentIdentityBlueprintPrincipals/tag/update`	Update tags of agent identity blueprint principals
`microsoft.directory/agentIdentityBlueprints/allProperties/update`	Update all properties of agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/appRoles/update`	Update appRoles on agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/audience/update`	Update audience on agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/authentication/update`	Update authentication on agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/basic/update`	Update basic properties on agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/create`	Create agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/credentials/update`	Update credentials on agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/delete`	Delete agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/owners/update`	Update owners on agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/permissions/update`	Update exposed permissions and required permissions on agent identity blueprints
`microsoft.directory/agentIdentityBlueprints/tag/update`	Update tags of agent identity blueprints
`microsoft.directory/appConsent/appConsentRequests/allProperties/read`	Read all properties of consent requests for applications registered with Microsoft Entra ID
`microsoft.directory/applications/allProperties/allTasks`	Create and delete applications, and read and update all properties
`microsoft.directory/applications/disablement/update`	Update whether an application is enabled for users to sign in
`microsoft.directory/applications/synchronization/standard/read`	Read provisioning settings associated with the application object
`microsoft.directory/applicationTemplates/instantiate`	Instantiate gallery applications from application templates
`microsoft.directory/auditLogs/allProperties/read`	Read all properties on audit logs, excluding custom security attributes audit logs
`microsoft.directory/authorizationPolicy/allProperties/allTasks`	Manage all aspects of authorization policy
`microsoft.directory/backup/preview/cancel`	Cancel a Microsoft Entra backup operation to compare a backup snapshot with the current state.
`microsoft.directory/backup/preview/create`	Create a Microsoft Entra backup operation that allows a user to compare a backup snapshot with the current state.
`microsoft.directory/backup/recovery/cancel`	Cancel a Microsoft Entra recovery operation to recover the contents of a backup snapshot
`microsoft.directory/backup/recovery/create`	Create a Microsoft Entra recovery operation that allows a user to recover the contents of a backup snapshot.
`microsoft.directory/backup/standard/read`	List Microsoft Entra backups (for example, backup IDs and timestamps), view difference reports, and list recovery jobs and their associated properties.
`microsoft.directory/bitlockerKeys/key/read`	Read bitlocker metadata and key on devices
`microsoft.directory/bulkJobs/basic/update`	Update all the bulk jobs in a directory
`microsoft.directory/bulkJobs/create`	Create all bulk jobs in a directory
`microsoft.directory/cloudAppSecurity/allProperties/allTasks`	Create and delete all resources, and read and update standard properties in Microsoft Defender for Cloud Apps
`microsoft.directory/conditionalAccessPolicies/allProperties/allTasks`	Manage all properties of Conditional Access policies
`microsoft.directory/connectorGroups/allProperties/read`	Read all properties of application proxy connector groups
`microsoft.directory/connectorGroups/allProperties/update`	Update all properties of application proxy connector groups
`microsoft.directory/connectorGroups/create`	Create application proxy connector groups
`microsoft.directory/connectorGroups/delete`	Delete application proxy connector groups
`microsoft.directory/connectors/allProperties/read`	Read all properties of application proxy connectors
`microsoft.directory/connectors/create`	Create application proxy connectors
`microsoft.directory/contacts/allProperties/allTasks`	Create and delete contacts, and read and update all properties
`microsoft.directory/contracts/allProperties/allTasks`	Create and delete partner contracts, and read and update all properties
`microsoft.directory/crossTenantAccessPolicy/allowedCloudEndpoints/update`	Update allowed cloud endpoints of cross-tenant access policy
`microsoft.directory/crossTenantAccessPolicy/basic/update`	Update basic settings of cross-tenant access policy
`microsoft.directory/crossTenantAccessPolicy/default/b2bCollaboration/update`	Update Microsoft Entra B2B collaboration settings of the default cross-tenant access policy
`microsoft.directory/crossTenantAccessPolicy/default/b2bDirectConnect/update`	Update Microsoft Entra B2B direct connect settings of the default cross-tenant access policy
`microsoft.directory/crossTenantAccessPolicy/default/crossCloudMeetings/update`	Update cross-cloud Teams meeting settings of the default cross-tenant access policy
`microsoft.directory/crossTenantAccessPolicy/default/standard/read`	Read basic properties of the default cross-tenant access policy
`microsoft.directory/crossTenantAccessPolicy/default/tenantRestrictions/update`	Update tenant restrictions of the default cross-tenant access policy
`microsoft.directory/crossTenantAccessPolicy/partners/b2bCollaboration/update`	Update Microsoft Entra B2B collaboration settings of cross-tenant access policy for partners
`microsoft.directory/crossTenantAccessPolicy/partners/b2bDirectConnect/update`	Update Microsoft Entra B2B direct connect settings of cross-tenant access policy for partners
`microsoft.directory/crossTenantAccessPolicy/partners/create`	Create cross-tenant access policy for partners
`microsoft.directory/crossTenantAccessPolicy/partners/crossCloudMeetings/update`	Update cross-cloud Teams meeting settings of cross-tenant access policy for partners
`microsoft.directory/crossTenantAccessPolicy/partners/delete`	Delete cross-tenant access policy for partners
`microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/basic/update`	Update basic settings of cross-tenant sync policy
`microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/create`	Create cross-tenant sync policy for partners
`microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/standard/read`	Read basic properties of cross-tenant sync policy
`microsoft.directory/crossTenantAccessPolicy/partners/standard/read`	Read basic properties of cross-tenant access policy for partners
`microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/basic/update`	Update cross tenant sync policy templates for multi-tenant organization
`microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/resetToDefaultSettings`	Reset cross tenant sync policy template for multi-tenant organization to default settings
`microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/standard/read`	Read basic properties of cross tenant sync policy templates for multi-tenant organization
`microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/basic/update`	Update cross tenant access policy templates for multi-tenant organization
`microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/resetToDefaultSettings`	Reset cross tenant access policy template for multi-tenant organization to default settings
`microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/standard/read`	Read basic properties of cross tenant access policy templates for multi-tenant organization
`microsoft.directory/crossTenantAccessPolicy/partners/tenantRestrictions/update`	Update tenant restrictions of cross-tenant access policy for partners
`microsoft.directory/crossTenantAccessPolicy/standard/read`	Read basic properties of cross-tenant access policy
`microsoft.directory/customAuthenticationExtensions/allProperties/allTasks`	Create and manage custom authentication extensions
`microsoft.directory/deletedItems/delete`	Permanently delete objects, which can no longer be restored
`microsoft.directory/deletedItems/restore`	Restore soft deleted objects to original state
`microsoft.directory/deviceLocalCredentials/password/read`	Read all properties of the backed up local administrator account credentials for Microsoft Entra joined devices, including the password
`microsoft.directory/deviceManagementPolicies/basic/update`	Update basic properties on mobile device management and mobile app management policies
`microsoft.directory/deviceManagementPolicies/standard/read`	Read standard properties on mobile device management and mobile app management policies
`microsoft.directory/deviceRegistrationPolicy/basic/update`	Update basic properties on device registration policies
`microsoft.directory/deviceRegistrationPolicy/standard/read`	Read standard properties on device registration policies
`microsoft.directory/devices/allProperties/allTasks`	Create and delete devices, and read and update all properties
`microsoft.directory/devices/permissions/update`	Update the alternative name property on an IoT device
`microsoft.directory/deviceTemplates/owners/read`	Read owners on Internet of Things (IoT) device templates
`microsoft.directory/deviceTemplates/owners/update`	Update owners on Internet of Things (IoT) device templates
`microsoft.directory/directoryRoles/allProperties/allTasks`	Create and delete directory roles, and read and update all properties
`microsoft.directory/directoryRoleTemplates/allProperties/allTasks`	Create and delete Microsoft Entra role templates, and read and update all properties
`microsoft.directory/domains/allProperties/allTasks`	Create and delete domains, and read and update all properties
`microsoft.directory/domains/federationConfiguration/basic/update`	Update basic federation configuration for domains
`microsoft.directory/domains/federationConfiguration/create`	Create federation configuration for domains
`microsoft.directory/domains/federationConfiguration/delete`	Delete federation configuration for domains
`microsoft.directory/domains/federationConfiguration/standard/read`	Read standard properties of federation configuration for domains
`microsoft.directory/entitlementManagement/allProperties/allTasks`	Create and delete resources, and read and update all properties in Microsoft Entra entitlement management
`microsoft.directory/externalUserProfiles/basic/update`	Update basic properties of external user profiles in the extended directory for Teams
`microsoft.directory/externalUserProfiles/delete`	Delete external user profiles in the extended directory for Teams
`microsoft.directory/externalUserProfiles/standard/read`	Read standard properties of external user profiles in the extended directory for Teams
`microsoft.directory/groups/allProperties/allTasks`	Create and delete groups, and read and update all properties
`microsoft.directory/groupsAssignableToRoles/allProperties/update`	Update role-assignable groups
`microsoft.directory/groupsAssignableToRoles/assignLicense`	Assign a license to role-assignable groups
`microsoft.directory/groupsAssignableToRoles/create`	Create role-assignable groups
`microsoft.directory/groupsAssignableToRoles/delete`	Delete role-assignable groups

Showing 120 of 252.

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Global Administrator for <reason>"
    RoleDefinitionId = "62e90394-69f5-4237-9190-012177145e10"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '62e90394-69f5-4237-9190-012177145e10'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Global Reader · 99 permissions · privileged
Security Administrator · 81 permissions · privileged
Application Administrator · 73 permissions · privileged
AI Administrator · 70 permissions · privileged
Agent ID Administrator · 64 permissions · privileged
Cloud Application Administrator · 61 permissions · privileged
Hybrid Identity Administrator · 61 permissions · privileged
User Administrator · 56 permissions · privileged

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles