// roles/entra

Tenant Governance Relationship AdministratorMicrosoft Entra built-in role

Can initiate governance relationships and terminate them.

Role ID	`b8e31d83-1534-480f-9b10-0338ded51b7e`
Privileged	No
Permissions	13

What it can do

Permission	What it allows
`microsoft.directory/tenantGovernance/invitations/standard/read`	Read tenant governance invitations
`microsoft.directory/tenantGovernance/policyTemplates/allProperties/update`	Update tenant governance policy templates
`microsoft.directory/tenantGovernance/policyTemplates/create`	Create tenant governance policy templates
`microsoft.directory/tenantGovernance/policyTemplates/delete`	Delete tenant governance policy templates
`microsoft.directory/tenantGovernance/policyTemplates/standard/read`	Read tenant governance policy templates
`microsoft.directory/tenantGovernance/relatedTenants/standard/read`	Read data about related tenants discovered by Microsoft Entra Tenant Governance service
`microsoft.directory/tenantGovernance/relationships/allProperties/update`	Update the status of governance relationships
`microsoft.directory/tenantGovernance/relationships/create`	Create tenant governance relationships
`microsoft.directory/tenantGovernance/relationships/standard/read`	Read tenant governance relationships
`microsoft.directory/tenantGovernance/requests/create`	Create tenant governance requests
`microsoft.directory/tenantGovernance/requests/standard/read`	Read tenant governance requests
`microsoft.directory/tenantGovernance/settings/standard/read`	Read tenant governance settings
`microsoft.office365.webPortal/allEntities/standard/read`	Read basic properties on all resources in the Microsoft 365 admin center

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Tenant Governance Relationship Administrator for <reason>"
    RoleDefinitionId = "b8e31d83-1534-480f-9b10-0338ded51b7e"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq 'b8e31d83-1534-480f-9b10-0338ded51b7e'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Knowledge Administrator · 13 permissions
Exchange Backup Administrator · 12 permissions
Knowledge Manager · 11 permissions
Teams Communications Administrator · 11 permissions
Yammer Administrator · 15 permissions
Attribute Assignment Administrator · 10 permissions
IoT Device Administrator · 10 permissions
Teams Telephony Administrator · 10 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles