// roles/entra

Knowledge AdministratorMicrosoft Entra built-in role

Can configure knowledge, learning, and other intelligent features.

Role ID	`b5a8dcf3-09d5-43a9-a639-8e29ef291470`
Privileged	No
Permissions	13

What it can do

Permission	What it allows
`microsoft.directory/groups.security/basic/update`	Update basic properties on Security groups, excluding role-assignable groups
`microsoft.directory/groups.security/create`	Create Security groups, excluding role-assignable groups
`microsoft.directory/groups.security/createAsOwner`	Create Security groups, excluding role-assignable groups. Creator is added as the first owner.
`microsoft.directory/groups.security/delete`	Delete Security groups, excluding role-assignable groups
`microsoft.directory/groups.security/members/update`	Update members of Security groups, excluding role-assignable groups
`microsoft.directory/groups.security/owners/update`	Update owners of Security groups, excluding role-assignable groups
`microsoft.office365.knowledge/contentUnderstanding/allProperties/allTasks`	Read and update all properties of content understanding in Microsoft 365 admin center
`microsoft.office365.knowledge/knowledgeNetwork/allProperties/allTasks`	Read and update all properties of knowledge network in Microsoft 365 admin center
`microsoft.office365.knowledge/learningSources/allProperties/allTasks`	Manage learning sources and all their properties in Learning App.
`microsoft.office365.protectionCenter/sensitivityLabels/allProperties/read`	Read all properties of sensitivity labels in the Security and Compliance centers
`microsoft.office365.sharePoint/allEntities/allTasks`	Create and delete all resources, and read and update standard properties in SharePoint
`microsoft.office365.supportTickets/allEntities/allTasks`	Create and manage Microsoft 365 service requests
`microsoft.office365.webPortal/allEntities/standard/read`	Read basic properties on all resources in the Microsoft 365 admin center

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Knowledge Administrator for <reason>"
    RoleDefinitionId = "b5a8dcf3-09d5-43a9-a639-8e29ef291470"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq 'b5a8dcf3-09d5-43a9-a639-8e29ef291470'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Tenant Governance Relationship Administrator · 13 permissions
Exchange Backup Administrator · 12 permissions
Knowledge Manager · 11 permissions
Teams Communications Administrator · 11 permissions
Yammer Administrator · 15 permissions
Attribute Assignment Administrator · 10 permissions
IoT Device Administrator · 10 permissions
Teams Telephony Administrator · 10 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles