// roles/entra

Global Secure Access AdministratorMicrosoft Entra built-in role

Create and manage all aspects of Global Secure Internet Access and Microsoft Global Secure Private Access, including managing access to public and private endpoints.

Role ID	`ac434307-12b9-4fa1-a708-88bf58caabc1`
Privileged	No
Permissions	20

What it can do

Permission	What it allows
`microsoft.azure.supportTickets/allEntities/allTasks`	Create and manage Azure support tickets
`microsoft.directory/applicationPolicies/standard/read`	Read standard properties of application policies
`microsoft.directory/applications/applicationProxy/read`	Read all application proxy properties
`microsoft.directory/applications/owners/read`	Read owners of applications
`microsoft.directory/applications/policies/read`	Read policies of applications
`microsoft.directory/applications/standard/read`	Read standard properties of applications
`microsoft.directory/auditLogs/allProperties/read`	Read all properties on audit logs, excluding custom security attributes audit logs
`microsoft.directory/conditionalAccessPolicies/standard/read`	Read Conditional Access for policies
`microsoft.directory/connectorGroups/allProperties/read`	Read all properties of application proxy connector groups
`microsoft.directory/connectors/allProperties/read`	Read all properties of application proxy connectors
`microsoft.directory/crossTenantAccessPolicy/default/standard/read`	Read basic properties of the default cross-tenant access policy
`microsoft.directory/crossTenantAccessPolicy/partners/standard/read`	Read basic properties of cross-tenant access policy for partners
`microsoft.directory/crossTenantAccessPolicy/standard/read`	Read basic properties of cross-tenant access policy
`microsoft.directory/namedLocations/standard/read`	Read basic properties of custom rules that define network locations
`microsoft.directory/signInReports/allProperties/read`	Read all properties on sign-in reports, including privileged properties
`microsoft.networkAccess/allEntities/allProperties/allTasks`	Manage all aspects of Microsoft Entra Network Access
`microsoft.office365.messageCenter/messages/read`	Read messages in Message Center in the Microsoft 365 admin center, excluding security messages
`microsoft.office365.serviceHealth/allEntities/allTasks`	Read and configure Service Health in the Microsoft 365 admin center
`microsoft.office365.supportTickets/allEntities/allTasks`	Create and manage Microsoft 365 service requests
`microsoft.office365.webPortal/allEntities/standard/read`	Read basic properties on all resources in the Microsoft 365 admin center

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Global Secure Access Administrator for <reason>"
    RoleDefinitionId = "ac434307-12b9-4fa1-a708-88bf58caabc1"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq 'ac434307-12b9-4fa1-a708-88bf58caabc1'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Authentication Policy Administrator · 19 permissions
Guest Inviter · 17 permissions
SharePoint Backup Administrator · 17 permissions
Exchange Administrator · 25 permissions
Yammer Administrator · 15 permissions
Groups Administrator · 26 permissions
Knowledge Administrator · 13 permissions
SharePoint Administrator · 27 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles