azureblog.co.uk
← cd ~/roles
// roles/entra

Organizational Branding AdministratorMicrosoft Entra built-in role

Manage all aspects of organizational branding in a tenant.

Role ID92ed04bf-c94a-4b82-9729-b799a7a4c178
PrivilegedNo
Permissions1

What it can do

PermissionWhat it allows
microsoft.directory/loginOrganizationBranding/allProperties/allTasksCreate and delete loginTenantBranding, and read and update all properties

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines
Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Organizational Branding Administrator for <reason>"
    RoleDefinitionId = "92ed04bf-c94a-4b82-9729-b799a7a4c178"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines
Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '92ed04bf-c94a-4b82-9729-b799a7a4c178'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Find the smallest role for a task →

Sources