// roles/entra

Yammer AdministratorMicrosoft Entra built-in role

Manage all aspects of the Yammer service.

Role ID	`810a2642-a034-447f-a5e8-41beaa378541`
Privileged	No
Permissions	15

What it can do

Permission	What it allows
`microsoft.directory/groups.unified/assignedLabels/update`	Update the assigned labels property on Microsoft 365 groups of assigned membership type, excluding role-assignable groups
`microsoft.directory/groups.unified/basic/update`	Update basic properties on Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups.unified/create`	Create Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups.unified/delete`	Delete Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups.unified/members/update`	Update members of Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups.unified/owners/update`	Update owners of Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups.unified/restore`	Restore Microsoft 365 groups from soft-deleted container, excluding role-assignable groups
`microsoft.directory/groups/hiddenMembers/read`	Read hidden members of Security groups and Microsoft 365 groups, including role-assignable groups
`microsoft.office365.messageCenter/messages/read`	Read messages in Message Center in the Microsoft 365 admin center, excluding security messages
`microsoft.office365.network/performance/allProperties/read`	Read all network performance properties in the Microsoft 365 admin center
`microsoft.office365.serviceHealth/allEntities/allTasks`	Read and configure Service Health in the Microsoft 365 admin center
`microsoft.office365.supportTickets/allEntities/allTasks`	Create and manage Microsoft 365 service requests
`microsoft.office365.usageReports/allEntities/allProperties/read`	Read Office 365 usage reports
`microsoft.office365.webPortal/allEntities/standard/read`	Read basic properties on all resources in the Microsoft 365 admin center
`microsoft.office365.yammer/allEntities/allProperties/allTasks`	Manage all aspects of Yammer

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Yammer Administrator for <reason>"
    RoleDefinitionId = "810a2642-a034-447f-a5e8-41beaa378541"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '810a2642-a034-447f-a5e8-41beaa378541'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Guest Inviter · 17 permissions
Knowledge Administrator · 13 permissions
SharePoint Backup Administrator · 17 permissions
Tenant Governance Relationship Administrator · 13 permissions
Exchange Backup Administrator · 12 permissions
Authentication Policy Administrator · 19 permissions
Knowledge Manager · 11 permissions
Teams Communications Administrator · 11 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles