// roles/entra · privileged

Privileged Role AdministratorMicrosoft Entra built-in role

Can manage role assignments in Microsoft Entra ID, and all aspects of Privileged Identity Management.

Role ID	`e8611ab8-c189-46e8-94e1-60213ab1f814`
Privileged	Yes. Microsoft marks this role as privileged.
Permissions	28

Before you assign it

Microsoft labels this a privileged role, so make it eligible through PIM rather than permanent, require phishing-resistant MFA to activate it, and review who has it regularly.

What it can do

Permission	What it allows
`microsoft.directory/accessReviews/definitions.applications/allProperties/read`	Read all properties of access reviews of application role assignments in Microsoft Entra ID
`microsoft.directory/accessReviews/definitions.directoryRoles/allProperties/allTasks`	Manage access reviews for Microsoft Entra role assignments
`microsoft.directory/accessReviews/definitions.groups/allProperties/read`	Read all properties of access reviews for membership in Security and Microsoft 365 groups, including role-assignable groups.
`microsoft.directory/accessReviews/definitions.groupsAssignableToRoles/allProperties/update`	Update all properties of access reviews for membership in groups that are assignable to Microsoft Entra roles
`microsoft.directory/accessReviews/definitions.groupsAssignableToRoles/create`	Create access reviews for membership in groups that are assignable to Microsoft Entra roles
`microsoft.directory/accessReviews/definitions.groupsAssignableToRoles/delete`	Delete access reviews for membership in groups that are assignable to Microsoft Entra roles
`microsoft.directory/administrativeUnits/allProperties/allTasks`	Create and manage administrative units (including members)
`microsoft.directory/authorizationPolicy/allProperties/allTasks`	Manage all aspects of authorization policy
`microsoft.directory/directoryRoles/allProperties/allTasks`	Create and delete directory roles, and read and update all properties
`microsoft.directory/groupsAssignableToRoles/allProperties/update`	Update role-assignable groups
`microsoft.directory/groupsAssignableToRoles/assignLicense`	Assign a license to role-assignable groups
`microsoft.directory/groupsAssignableToRoles/create`	Create role-assignable groups
`microsoft.directory/groupsAssignableToRoles/delete`	Delete role-assignable groups
`microsoft.directory/groupsAssignableToRoles/reprocessLicenseAssignment`	Reprocess license assignments to role-assignable groups
`microsoft.directory/groupsAssignableToRoles/restore`	Restore role-assignable groups
`microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks`	Create and delete OAuth 2.0 permission grants, and read and update all properties
`microsoft.directory/permissionGrantPolicies/allProperties/read`	Read all properties of permission grant policies
`microsoft.directory/permissionGrantPolicies/allProperties/update`	Update all properties of permission grant policies
`microsoft.directory/permissionGrantPolicies/create`	Create permission grant policies
`microsoft.directory/permissionGrantPolicies/delete`	Delete permission grant policies
`microsoft.directory/privilegedIdentityManagement/allProperties/allTasks`	Create and delete all resources, and read and update standard properties in Privileged Identity Management
`microsoft.directory/roleAssignments/allProperties/allTasks`	Create and delete role assignments, and read and update all role assignment properties
`microsoft.directory/roleDefinitions/allProperties/allTasks`	Create and delete role definitions, and read and update all properties
`microsoft.directory/scopedRoleMemberships/allProperties/allTasks`	Create and delete scopedRoleMemberships, and read and update all properties
`microsoft.directory/servicePrincipals/appRoleAssignedTo/update`	Update service principal role assignments
`microsoft.directory/servicePrincipals/managePermissionGrantsForAll.microsoft-company-admin`	Grant consent for any permission to any application
`microsoft.directory/servicePrincipals/permissions/update`	Update permissions of service principals
`microsoft.office365.webPortal/allEntities/standard/read`	Read basic properties on all resources in the Microsoft 365 admin center

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Privileged Role Administrator for <reason>"
    RoleDefinitionId = "e8611ab8-c189-46e8-94e1-60213ab1f814"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq 'e8611ab8-c189-46e8-94e1-60213ab1f814'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Tenant Governance Administrator · 24 permissions · privileged
Security Reader · 33 permissions · privileged
Privileged Authentication Administrator · 20 permissions · privileged
Authentication Administrator · 19 permissions · privileged
Cloud Device Administrator · 19 permissions · privileged
Intune Administrator · 38 permissions · privileged
Security Operator · 17 permissions · privileged
Partner Tier1 Support · 40 permissions · privileged

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles