// roles/entra

SharePoint Backup AdministratorMicrosoft Entra built-in role

Back up and restore content (including granular restore) for SharePoint and OneDrive in Microsoft 365 Backup

Role ID	`9d3e04ba-3ee4-4d1b-a3a7-9aef423a09be`
Privileged	No
Permissions	17

What it can do

Permission	What it allows
`microsoft.azure.serviceHealth/allEntities/allTasks`	Read and configure Azure Service Health
`microsoft.azure.supportTickets/allEntities/allTasks`	Create and manage Azure support tickets
`microsoft.backup/oneDriveForBusinessProtectionPolicies/allProperties/allTasks`	Create and manage OneDrive protection policy in Microsoft 365 Backup
`microsoft.backup/oneDriveForBusinessRestoreSessions/allProperties/allTasks`	Read and configure restore session for OneDrive in Microsoft 365 Backup
`microsoft.backup/restorePoints/sites/allProperties/allTasks`	Manage all restore points associated with selected SharePoint sites in Microsoft 365 Backup
`microsoft.backup/restorePoints/userDrives/allProperties/allTasks`	Manage all restore points associated with selected OneDrive accounts in Microsoft 365 Backup
`microsoft.backup/sharePointProtectionPolicies/allProperties/allTasks`	Create and manage SharePoint protection policy in Microsoft 365 Backup
`microsoft.backup/sharePointRestoreSessions/allProperties/allTasks`	Read and configure restore session for SharePoint in Microsoft 365 Backup
`microsoft.backup/siteProtectionUnits/allProperties/allTasks`	Manage sites added to SharePoint protection policy in Microsoft 365 Backup
`microsoft.backup/siteRestoreArtifacts/allProperties/allTasks`	Manage sites added to restore session for SharePoint in Microsoft 365 Backup
`microsoft.backup/userDriveProtectionUnits/allProperties/allTasks`	Manage accounts added to OneDrive protection policy in Microsoft 365 Backup
`microsoft.backup/userDriveRestoreArtifacts/allProperties/allTasks`	Manage accounts added to restore session for OneDrive in Microsoft 365 Backup
`microsoft.office365.network/performance/allProperties/read`	Read all network performance properties in the Microsoft 365 admin center
`microsoft.office365.serviceHealth/allEntities/allTasks`	Read and configure Service Health in the Microsoft 365 admin center
`microsoft.office365.supportTickets/allEntities/allTasks`	Create and manage Microsoft 365 service requests
`microsoft.office365.usageReports/allEntities/allProperties/read`	Read Office 365 usage reports
`microsoft.office365.webPortal/allEntities/standard/read`	Read basic properties on all resources in the Microsoft 365 admin center

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs SharePoint Backup Administrator for <reason>"
    RoleDefinitionId = "9d3e04ba-3ee4-4d1b-a3a7-9aef423a09be"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '9d3e04ba-3ee4-4d1b-a3a7-9aef423a09be'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Guest Inviter · 17 permissions
Authentication Policy Administrator · 19 permissions
Yammer Administrator · 15 permissions
Global Secure Access Administrator · 20 permissions
Knowledge Administrator · 13 permissions
Tenant Governance Relationship Administrator · 13 permissions
Exchange Backup Administrator · 12 permissions
Knowledge Manager · 11 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles