// roles/entra · privileged

Partner Tier2 SupportMicrosoft Entra built-in role

Do not use - not intended for general use.

Role ID	`e00e864a-17c5-4a4b-9c06-f5b95a8d5bd8`
Privileged	Yes. Microsoft marks this role as privileged.
Permissions	46

Before you assign it

Microsoft labels this a privileged role, so make it eligible through PIM rather than permanent, require phishing-resistant MFA to activate it, and review who has it regularly.

What it can do

Permission	What it allows
`microsoft.azure.serviceHealth/allEntities/allTasks`	Read and configure Azure Service Health
`microsoft.azure.supportTickets/allEntities/allTasks`	Create and manage Azure support tickets
`microsoft.directory/applications/appRoles/update`	Update the appRoles property on all types of applications
`microsoft.directory/applications/audience/update`	Update the audience property for applications
`microsoft.directory/applications/authentication/update`	Update authentication on all types of applications
`microsoft.directory/applications/basic/update`	Update basic properties for applications
`microsoft.directory/applications/credentials/update`	Update application credentials
`microsoft.directory/applications/notes/update`	Update notes of applications
`microsoft.directory/applications/owners/update`	Update owners of applications
`microsoft.directory/applications/permissions/update`	Update exposed permissions and required permissions on all types of applications
`microsoft.directory/applications/policies/update`	Update policies of applications
`microsoft.directory/applications/tag/update`	Update tags of applications
`microsoft.directory/contacts/basic/update`	Update basic properties on contacts
`microsoft.directory/contacts/create`	Create contacts
`microsoft.directory/contacts/delete`	Delete contacts
`microsoft.directory/deletedItems.groups/restore`	Restore soft deleted groups to original state
`microsoft.directory/deletedItems.users/restore`	Restore soft deleted users to original state
`microsoft.directory/domains/allProperties/allTasks`	Create and delete domains, and read and update all properties
`microsoft.directory/groups.unified/assignedLabels/update`	Update the assigned labels property on Microsoft 365 groups of assigned membership type, excluding role-assignable groups
`microsoft.directory/groups/create`	Create Security groups and Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups/delete`	Delete Security groups and Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups/members/update`	Update members of Security groups and Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups/owners/update`	Update owners of Security groups and Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups/restore`	Restore groups from soft-deleted container
`microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks`	Create and delete OAuth 2.0 permission grants, and read and update all properties
`microsoft.directory/organization/basic/update`	Update basic properties on organization
`microsoft.directory/roleAssignments/allProperties/allTasks`	Create and delete role assignments, and read and update all role assignment properties
`microsoft.directory/roleDefinitions/allProperties/allTasks`	Create and delete role definitions, and read and update all properties
`microsoft.directory/scopedRoleMemberships/allProperties/allTasks`	Create and delete scopedRoleMemberships, and read and update all properties
`microsoft.directory/servicePrincipals/appRoleAssignedTo/update`	Update service principal role assignments
`microsoft.directory/subscribedSkus/standard/read`	Read basic properties on subscriptions
`microsoft.directory/users/assignLicense`	Manage user licenses
`microsoft.directory/users/basic/update`	Update basic properties on users
`microsoft.directory/users/create`	Add users
`microsoft.directory/users/delete`	Delete users
`microsoft.directory/users/disable`	Disable users
`microsoft.directory/users/enable`	Enable users
`microsoft.directory/users/invalidateAllRefreshTokens`	Force sign-out by invalidating user refresh tokens
`microsoft.directory/users/manager/update`	Update manager for users
`microsoft.directory/users/password/update`	Reset passwords for all users
`microsoft.directory/users/photo/update`	Update photo of users
`microsoft.directory/users/restore`	Restore deleted users
`microsoft.directory/users/userPrincipalName/update`	Update User Principal Name of users
`microsoft.office365.serviceHealth/allEntities/allTasks`	Read and configure Service Health in the Microsoft 365 admin center
`microsoft.office365.supportTickets/allEntities/allTasks`	Create and manage Microsoft 365 service requests
`microsoft.office365.webPortal/allEntities/standard/read`	Read basic properties on all resources in the Microsoft 365 admin center

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Partner Tier2 Support for <reason>"
    RoleDefinitionId = "e00e864a-17c5-4a4b-9c06-f5b95a8d5bd8"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq 'e00e864a-17c5-4a4b-9c06-f5b95a8d5bd8'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

AI Reader · 45 permissions · privileged
Directory Writers · 42 permissions · privileged
Partner Tier1 Support · 40 permissions · privileged
Intune Administrator · 38 permissions · privileged
User Administrator · 56 permissions · privileged
Security Reader · 33 permissions · privileged
Cloud Application Administrator · 61 permissions · privileged
Hybrid Identity Administrator · 61 permissions · privileged

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles