// roles/entra

Groups AdministratorMicrosoft Entra built-in role

Members of this role can create/manage groups, create/manage groups settings like naming and expiration policies, and view groups activity and audit reports.

Role ID	`fdd7a751-b60b-444a-984c-02652fe8fa1c`
Privileged	No
Permissions	26

What it can do

Permission	What it allows
`microsoft.azure.serviceHealth/allEntities/allTasks`	Read and configure Azure Service Health
`microsoft.azure.supportTickets/allEntities/allTasks`	Create and manage Azure support tickets
`microsoft.directory/bulkJobs.groups/basic/update`	Update bulk jobs related to groups
`microsoft.directory/bulkJobs.groups/create`	Create bulk jobs related to groups
`microsoft.directory/bulkJobs.groups/standard/read`	Read bulk jobs related to groups
`microsoft.directory/deletedItems.groups/delete`	Permanently delete groups, which can no longer be restored
`microsoft.directory/deletedItems.groups/restore`	Restore soft deleted groups to original state
`microsoft.directory/groups/assignedLabels/update`	Update the assigned labels property on groups of assigned membership type, excluding role-assignable groups
`microsoft.directory/groups/assignLicense`	Assign product licenses to groups for group-based licensing
`microsoft.directory/groups/basic/update`	Update basic properties on Security groups and Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups/classification/update`	Update the classification property on Security groups and Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups/create`	Create Security groups and Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups/delete`	Delete Security groups and Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups/dynamicMembershipRule/update`	Update the dynamic membership rule on Security groups and Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups/groupType/update`	Update properties that would affect the group type of Security groups and Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups/hiddenMembers/read`	Read hidden members of Security groups and Microsoft 365 groups, including role-assignable groups
`microsoft.directory/groups/members/update`	Update members of Security groups and Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups/onPremWriteBack/update`	Update Microsoft Entra groups to be written back to on-premises with Microsoft Entra Connect
`microsoft.directory/groups/owners/update`	Update owners of Security groups and Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups/reprocessLicenseAssignment`	Reprocess license assignments for group-based licensing
`microsoft.directory/groups/restore`	Restore groups from soft-deleted container
`microsoft.directory/groups/settings/update`	Update settings of groups
`microsoft.directory/groups/visibility/update`	Update the visibility property of Security groups and Microsoft 365 groups, excluding role-assignable groups
`microsoft.office365.serviceHealth/allEntities/allTasks`	Read and configure Service Health in the Microsoft 365 admin center
`microsoft.office365.supportTickets/allEntities/allTasks`	Create and manage Microsoft 365 service requests
`microsoft.office365.webPortal/allEntities/standard/read`	Read basic properties on all resources in the Microsoft 365 admin center

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Groups Administrator for <reason>"
    RoleDefinitionId = "fdd7a751-b60b-444a-984c-02652fe8fa1c"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq 'fdd7a751-b60b-444a-984c-02652fe8fa1c'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Exchange Administrator · 25 permissions
SharePoint Administrator · 27 permissions
SharePoint Advanced Management Administrator · 28 permissions
Windows 365 Administrator · 28 permissions
Global Secure Access Administrator · 20 permissions
Authentication Policy Administrator · 19 permissions
Teams Administrator · 33 permissions
Guest Inviter · 17 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles