// roles/entra · privileged

Tenant Governance AdministratorMicrosoft Entra built-in role

Manage all capabilities in the Microsoft Entra Tenant Governance service.

Role ID	`1981f584-96e9-4a6f-95b0-f522373f8fae`
Privileged	Yes. Microsoft marks this role as privileged.
Permissions	24

Before you assign it

Microsoft labels this a privileged role, so make it eligible through PIM rather than permanent, require phishing-resistant MFA to activate it, and review who has it regularly.

What it can do

Permission	What it allows
`microsoft.directory/crossTenantAccessPolicy/basic/update`	Update basic settings of cross-tenant access policy
`microsoft.directory/crossTenantAccessPolicy/default/standard/read`	Read basic properties of the default cross-tenant access policy
`microsoft.directory/crossTenantAccessPolicy/partners/create`	Create cross-tenant access policy for partners
`microsoft.directory/crossTenantAccessPolicy/partners/delete`	Delete cross-tenant access policy for partners
`microsoft.directory/crossTenantAccessPolicy/partners/standard/read`	Read basic properties of cross-tenant access policy for partners
`microsoft.directory/crossTenantAccessPolicy/standard/read`	Read basic properties of cross-tenant access policy
`microsoft.directory/tenantGovernance/invitations/create`	Create tenant governance invitations
`microsoft.directory/tenantGovernance/invitations/delete`	Delete tenant governance invitations
`microsoft.directory/tenantGovernance/invitations/standard/read`	Read tenant governance invitations
`microsoft.directory/tenantGovernance/policyTemplates/allProperties/update`	Update tenant governance policy templates
`microsoft.directory/tenantGovernance/policyTemplates/create`	Create tenant governance policy templates
`microsoft.directory/tenantGovernance/policyTemplates/delete`	Delete tenant governance policy templates
`microsoft.directory/tenantGovernance/policyTemplates/standard/read`	Read tenant governance policy templates
`microsoft.directory/tenantGovernance/relatedTenants/refresh`	Trigger a data refresh about related tenants discovered by Microsoft Entra Tenant Governance service
`microsoft.directory/tenantGovernance/relatedTenants/standard/read`	Read data about related tenants discovered by Microsoft Entra Tenant Governance service
`microsoft.directory/tenantGovernance/relationships/allProperties/update`	Update the status of governance relationships
`microsoft.directory/tenantGovernance/relationships/create`	Create tenant governance relationships
`microsoft.directory/tenantGovernance/relationships/standard/read`	Read tenant governance relationships
`microsoft.directory/tenantGovernance/requests/allProperties/update`	Update the status of tenant governance requests
`microsoft.directory/tenantGovernance/requests/create`	Create tenant governance requests
`microsoft.directory/tenantGovernance/requests/standard/read`	Read tenant governance requests
`microsoft.directory/tenantGovernance/settings/allProperties/update`	Manage Microsoft Entra Tenant Governance settings
`microsoft.directory/tenantGovernance/settings/standard/read`	Read tenant governance settings
`microsoft.office365.webPortal/allEntities/standard/read`	Read basic properties on all resources in the Microsoft 365 admin center

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Tenant Governance Administrator for <reason>"
    RoleDefinitionId = "1981f584-96e9-4a6f-95b0-f522373f8fae"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '1981f584-96e9-4a6f-95b0-f522373f8fae'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Privileged Authentication Administrator · 20 permissions · privileged
Privileged Role Administrator · 28 permissions · privileged
Authentication Administrator · 19 permissions · privileged
Cloud Device Administrator · 19 permissions · privileged
Security Operator · 17 permissions · privileged
Security Reader · 33 permissions · privileged
Conditional Access Administrator · 13 permissions · privileged
Identity Governance Administrator · 10 permissions · privileged

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles