// roles/entra

Knowledge ManagerMicrosoft Entra built-in role

Organize, create, manage, and promote topics and knowledge.

Role ID	`744ec460-397e-42ad-a462-8b3f9747a02c`
Privileged	No
Permissions	11

What it can do

Permission	What it allows
`microsoft.directory/groups.security/basic/update`	Update basic properties on Security groups, excluding role-assignable groups
`microsoft.directory/groups.security/create`	Create Security groups, excluding role-assignable groups
`microsoft.directory/groups.security/createAsOwner`	Create Security groups, excluding role-assignable groups. Creator is added as the first owner.
`microsoft.directory/groups.security/delete`	Delete Security groups, excluding role-assignable groups
`microsoft.directory/groups.security/members/update`	Update members of Security groups, excluding role-assignable groups
`microsoft.directory/groups.security/owners/update`	Update owners of Security groups, excluding role-assignable groups
`microsoft.office365.knowledge/contentUnderstanding/analytics/allProperties/read`	Read analytics reports of content understanding in Microsoft 365 admin center
`microsoft.office365.knowledge/knowledgeNetwork/topicVisibility/allProperties/allTasks`	Manage topic visibility of knowledge network in Microsoft 365 admin center
`microsoft.office365.sharePoint/allEntities/allTasks`	Create and delete all resources, and read and update standard properties in SharePoint
`microsoft.office365.supportTickets/allEntities/allTasks`	Create and manage Microsoft 365 service requests
`microsoft.office365.webPortal/allEntities/standard/read`	Read basic properties on all resources in the Microsoft 365 admin center

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Knowledge Manager for <reason>"
    RoleDefinitionId = "744ec460-397e-42ad-a462-8b3f9747a02c"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '744ec460-397e-42ad-a462-8b3f9747a02c'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Teams Communications Administrator · 11 permissions
Attribute Assignment Administrator · 10 permissions
Exchange Backup Administrator · 12 permissions
IoT Device Administrator · 10 permissions
Teams Telephony Administrator · 10 permissions
Compliance Data Administrator · 9 permissions
Knowledge Administrator · 13 permissions
License Administrator · 9 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles