// roles/entra · privileged

Security OperatorMicrosoft Entra built-in role

Creates and manages security events and performs identity containment actions during security incidents.

Role ID	`5f2222b1-57c3-48ba-8ad5-d4759f1fde6f`
Privileged	Yes. Microsoft marks this role as privileged.
Permissions	17

Before you assign it

Microsoft labels this a privileged role, so make it eligible through PIM rather than permanent, require phishing-resistant MFA to activate it, and review who has it regularly.

What it can do

Permission	What it allows
`microsoft.azure.advancedThreatProtection/allEntities/allTasks`	Manage all aspects of Azure Advanced Threat Protection
`microsoft.azure.supportTickets/allEntities/allTasks`	Create and manage Azure support tickets
`microsoft.directory/auditLogs/allProperties/read`	Read all properties on audit logs, excluding custom security attributes audit logs
`microsoft.directory/authorizationPolicy/standard/read`	Read standard properties of authorization policy
`microsoft.directory/cloudAppSecurity/allProperties/allTasks`	Create and delete all resources, and read and update standard properties in Microsoft Defender for Cloud Apps
`microsoft.directory/identityProtection/allProperties/allTasks`	Create and delete all resources, and read and update standard properties in Microsoft Entra ID Protection
`microsoft.directory/privilegedIdentityManagement/allProperties/read`	Read all resources in Privileged Identity Management
`microsoft.directory/provisioningLogs/allProperties/read`	Read all properties of provisioning logs
`microsoft.directory/signInReports/allProperties/read`	Read all properties on sign-in reports, including privileged properties
`microsoft.directory/users/disable`	Disable users
`microsoft.directory/users/enable`	Enable users
`microsoft.directory/users/invalidateAllRefreshTokens`	Force sign-out by invalidating user refresh tokens
`microsoft.directory/users/password/update`	Reset passwords for all users
`microsoft.intune/allEntities/read`	Read all resources in Microsoft Intune
`microsoft.office365.securityComplianceCenter/allEntities/allTasks`	Create and delete all resources, and read and update standard properties in the Microsoft 365 Security and Compliance Center
`microsoft.office365.supportTickets/allEntities/allTasks`	Create and manage Microsoft 365 service requests
`microsoft.windows.defenderAdvancedThreatProtection/allEntities/allTasks`	Manage all aspects of Microsoft Defender for Endpoint

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Security Operator for <reason>"
    RoleDefinitionId = "5f2222b1-57c3-48ba-8ad5-d4759f1fde6f"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '5f2222b1-57c3-48ba-8ad5-d4759f1fde6f'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Authentication Administrator · 19 permissions · privileged
Cloud Device Administrator · 19 permissions · privileged
Privileged Authentication Administrator · 20 permissions · privileged
Conditional Access Administrator · 13 permissions · privileged
Identity Governance Administrator · 10 permissions · privileged
Tenant Governance Administrator · 24 permissions · privileged
Helpdesk Administrator · 9 permissions · privileged
Privileged Role Administrator · 28 permissions · privileged

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles