// roles/entra · privileged

Privileged Authentication AdministratorMicrosoft Entra built-in role

Can access to view, set and reset authentication method information for any user (admin or non-admin).

Role ID	`7be44c8a-adaf-4e2a-84d6-ab2649e08a13`
Privileged	Yes. Microsoft marks this role as privileged.
Permissions	20

Before you assign it

Microsoft labels this a privileged role, so make it eligible through PIM rather than permanent, require phishing-resistant MFA to activate it, and review who has it regularly.

What it can do

Permission	What it allows
`microsoft.azure.serviceHealth/allEntities/allTasks`	Read and configure Azure Service Health
`microsoft.azure.supportTickets/allEntities/allTasks`	Create and manage Azure support tickets
`microsoft.directory/deletedItems.users/restore`	Restore soft deleted users to original state
`microsoft.directory/users/authenticationMethods/basic/update`	Update basic properties of authentication methods for users
`microsoft.directory/users/authenticationMethods/create`	Update authentication methods for users
`microsoft.directory/users/authenticationMethods/delete`	Delete authentication methods for users
`microsoft.directory/users/authenticationMethods/standard/read`	Read standard properties of authentication methods for users
`microsoft.directory/users/authorizationInfo/update`	Update the multivalued Certificate user IDs property of users
`microsoft.directory/users/basic/update`	Update basic properties on users
`microsoft.directory/users/delete`	Delete users
`microsoft.directory/users/disable`	Disable users
`microsoft.directory/users/enable`	Enable users
`microsoft.directory/users/invalidateAllRefreshTokens`	Force sign-out by invalidating user refresh tokens
`microsoft.directory/users/manager/update`	Update manager for users
`microsoft.directory/users/password/update`	Reset passwords for all users
`microsoft.directory/users/restore`	Restore deleted users
`microsoft.directory/users/userPrincipalName/update`	Update User Principal Name of users
`microsoft.office365.serviceHealth/allEntities/allTasks`	Read and configure Service Health in the Microsoft 365 admin center
`microsoft.office365.supportTickets/allEntities/allTasks`	Create and manage Microsoft 365 service requests
`microsoft.office365.webPortal/allEntities/standard/read`	Read basic properties on all resources in the Microsoft 365 admin center

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Privileged Authentication Administrator for <reason>"
    RoleDefinitionId = "7be44c8a-adaf-4e2a-84d6-ab2649e08a13"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '7be44c8a-adaf-4e2a-84d6-ab2649e08a13'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Authentication Administrator · 19 permissions · privileged
Cloud Device Administrator · 19 permissions · privileged
Security Operator · 17 permissions · privileged
Tenant Governance Administrator · 24 permissions · privileged
Conditional Access Administrator · 13 permissions · privileged
Privileged Role Administrator · 28 permissions · privileged
Identity Governance Administrator · 10 permissions · privileged
Helpdesk Administrator · 9 permissions · privileged

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles