// roles/entra

Windows 365 AdministratorMicrosoft Entra built-in role

Can provision and manage all aspects of Cloud PCs.

Role ID	`11451d60-acb2-45eb-a7d6-43d0f0125c13`
Privileged	No
Permissions	28

What it can do

Permission	What it allows
`microsoft.azure.supportTickets/allEntities/allTasks`	Create and manage Azure support tickets
`microsoft.cloudPC/allEntities/allProperties/allTasks`	Manage all aspects of Windows 365
`microsoft.directory/deletedItems.devices/delete`	Permanently delete devices, which can no longer be restored
`microsoft.directory/deletedItems.devices/restore`	Restore soft deleted devices to original state
`microsoft.directory/deviceManagementPolicies/standard/read`	Read standard properties on mobile device management and mobile app management policies
`microsoft.directory/deviceRegistrationPolicy/standard/read`	Read standard properties on device registration policies
`microsoft.directory/devices/basic/update`	Update basic properties on devices
`microsoft.directory/devices/create`	Create devices (enroll in Microsoft Entra ID)
`microsoft.directory/devices/delete`	Delete devices from Microsoft Entra ID
`microsoft.directory/devices/disable`	Disable devices in Microsoft Entra ID
`microsoft.directory/devices/enable`	Enable devices in Microsoft Entra ID
`microsoft.directory/devices/extensionAttributeSet1/update`	Update the extensionAttribute1 to extensionAttribute5 properties on devices
`microsoft.directory/devices/extensionAttributeSet2/update`	Update the extensionAttribute6 to extensionAttribute10 properties on devices
`microsoft.directory/devices/extensionAttributeSet3/update`	Update the extensionAttribute11 to extensionAttribute15 properties on devices
`microsoft.directory/devices/registeredOwners/update`	Update registered owners of devices
`microsoft.directory/devices/registeredUsers/update`	Update registered users of devices
`microsoft.directory/groups.security/assignedLabels/update`	Update the assigned labels property on Security groups of assigned membership type, excluding role-assignable groups
`microsoft.directory/groups.security/basic/update`	Update basic properties on Security groups, excluding role-assignable groups
`microsoft.directory/groups.security/classification/update`	Update the classification property on Security groups, excluding role-assignable groups
`microsoft.directory/groups.security/create`	Create Security groups, excluding role-assignable groups
`microsoft.directory/groups.security/delete`	Delete Security groups, excluding role-assignable groups
`microsoft.directory/groups.security/dynamicMembershipRule/update`	Update the dynamic membership rule on Security groups, excluding role-assignable groups
`microsoft.directory/groups.security/members/update`	Update members of Security groups, excluding role-assignable groups
`microsoft.directory/groups.security/owners/update`	Update owners of Security groups, excluding role-assignable groups
`microsoft.directory/groups.security/visibility/update`	Update the visibility property on Security groups, excluding role-assignable groups
`microsoft.office365.supportTickets/allEntities/allTasks`	Create and manage Microsoft 365 service requests
`microsoft.office365.usageReports/allEntities/allProperties/read`	Read Office 365 usage reports
`microsoft.office365.webPortal/allEntities/standard/read`	Read basic properties on all resources in the Microsoft 365 admin center

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Windows 365 Administrator for <reason>"
    RoleDefinitionId = "11451d60-acb2-45eb-a7d6-43d0f0125c13"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '11451d60-acb2-45eb-a7d6-43d0f0125c13'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

SharePoint Advanced Management Administrator · 28 permissions
SharePoint Administrator · 27 permissions
Groups Administrator · 26 permissions
Exchange Administrator · 25 permissions
Teams Administrator · 33 permissions
Global Secure Access Administrator · 20 permissions
Authentication Policy Administrator · 19 permissions
Guest Inviter · 17 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles