For on-premises environments, users with this role can configure domain names for federation so that associated users are always authenticated on-premises. Has administrative access in the Microsoft 365 Insights app. Users with this role can view usage reporting data and the reports dashboard in Microsoft 365 admin center and the adoption context pack in Power BI. Assign the Message center reader role to users who need to do the following: Assign the Office Apps admin role to users who need to do the following: Assign the Organizational Message Writer role to users who need to write, publish, manage, and review the organizational messages for end-users through Microsoft product surfaces. Users in this role have full access to all knowledge, learning and intelligent features settings in the Microsoft 365 admin center. Can reset passwords for non-administrators and Helpdesk Administrators. Azure RBAC allows users to manage Key, Secrets, and Certificates permissions. These users can customize HTML/CSS/JavaScript content, change MFA requirements, select claims in the token, manage API connectors and their credentials, and configure session settings for all user flows in the Azure AD organization. In this document role name is used only for readability. Users with this role can define a valid set of custom security attributes that can be assigned to supported Azure AD objects. If the applications identity has been granted access to a resource, such as the ability to create or update User or other objects, then a user assigned to this role could perform those actions while impersonating the application. Perform any action on the certificates of a key vault, except manage permissions. They include business profile admin, referral admin, incentive admin, incentive user, and Microsoft Cloud Partner Program (formerly the Microsoft Partner Network) partner admin. This role can create and manage security groups, but does not have administrator rights over Microsoft 365 groups. The standard built-in roles for Azure are Owner, Contributor, and Reader. The person who signs up for the Azure AD organization becomes a Global Administrator. For example, the Virtual Machine Contributor role allows a user to create and manage virtual machines. Members of the db_ownerdatabase role can manage fixed-database role membership. Before the partner can assign these roles to users, you must add the partner as a delegated admin to your account. Changing the password of a user may mean the ability to assume that user's identity and permissions. All users can read the sensitive properties. MFA makes users enter a second method of identification to verify they're who they say they are. Check your security role: Follow the steps in View your user profile. Global Administrators can reset the password for any user and all other administrators. Whether a Helpdesk Administrator can reset a user's password and invalidate refresh tokens depends on the role the user is assigned. Invalidating a refresh token forces the user to sign in again. Users in this role can register printers and manage all aspects of all printer configurations in the Microsoft Universal Print solution, including the Universal Print Connector settings. Conversely, this role cannot change the encryption keys or edit the secrets used for federation in the organization. Azure AD tenant roles include global admin, user admin, and CSP roles. Users with this role can change passwords, invalidate refresh tokens, create and manage support requests with Microsoft for Azure and Microsoft 365 services, and monitor service health. If the built-in roles don't meet the specific needs of your organization, you can create your own Azure custom roles . Users in this role can manage all aspects of the Microsoft Teams workload via the Microsoft Teams & Skype for Business admin center and the respective PowerShell modules. If you get a message in the admin center telling you that you don't have permissions to edit a setting or page, it's because you're assigned a role that doesn't have that permission. Delete or restore any users, including Global Administrators. Application Registration and Enterprise Application owners, who can manage credentials of apps they own. This role is appropriate for users in an organization, such as support or operations engineers, who need to: View monitoring dashboards in the Azure portal. It does not allow access to keys, secrets and certificates. Users with this role can manage Teams-certified devices from the Teams admin center. Users in this role can troubleshoot communication issues within Microsoft Teams & Skype for Business using the user call troubleshooting tools in the Microsoft Teams & Skype for Business admin center. When you create a role assignment, some tooling requires that you use the role definition ID while other tooling allows you to provide the name of the role. You can assign a built-in role definition or a custom role definition. This role is appropriate for users in an organization, such as support or operations engineers, who need to: View monitoring dashboards in the Azure portal. Role assignments are the way you control access to Azure resources. Azure AD tenant roles include global admin, user admin, and CSP roles. You can use Azure PowerShell, Azure CLI, ARM template deployments with Key Vault Secrets User and Key Vault Reader role assignemnts for 'Microsoft Azure App Service' global indentity. Application Registration and Enterprise Application owners, who can manage credentials of apps they own. This role also grants permission to consent on one's own behalf when the "Users can consent to apps accessing company data on their behalf" setting is set to No. On the command bar, select New. Read secret contents including secret portion of a certificate with private key. Users with this role have all permissions in the Azure Information Protection service. Not every role returned by PowerShell or MS Graph API is visible in Azure portal. The keyset administrator role should be carefully audited and assigned with care during pre-production and production. This ability to impersonate the applications identity may be an elevation of privilege over what the user can do via their role assignments. Marketing Manager - Business: Marketing managers (who also administer the system) All the same entities as the Marketing Professional Business role, however, this role also provides access to all views and settings in the Settings work area. For example, you can assign roles to allow adding or changing users, resetting user passwords, managing user licenses, or managing domain names. The following table is for roles assigned at the scope of a tenant. Assign the Insights Analyst role to users who need to do the following: Users in this role can access a set of dashboards and insights via the Microsoft Viva Insights app. Only Global Administrators can reset the passwords of people assigned to this role. Can manage calling and meetings features within the Microsoft Teams service. Manage Password Protection settings: smart lockout configurations and updating the custom banned passwords list. Also has the ability to create and manage all Microsoft 365 groups, manage support tickets, and monitor service health. Assign the Message center privacy reader role to users who need to read privacy and security messages and updates in the Microsoft 365 Message center. For example, you can assign roles to allow adding or changing users, resetting user passwords, managing user licenses, or managing domain names. With Business Assist, you and your employees get around-the-clock access to small business specialists as you grow your business, from onboarding to everyday use. Those apps may have privileged permissions in Azure AD and elsewhere not granted to Helpdesk Administrators. Azure RBAC for key vault also allows users to have separate permissions on individual keys, secrets, and certificates. They don't have any admin permissions to configure settings or access the product-specific admin centers like Exchange. Can manage secrets for federation and encryption in the Identity Experience Framework (IEF). Perform any action on the secrets of a key vault, except manage permissions. Custom roles and advanced Azure RBAC. For example, you can assign roles to allow adding or changing users, resetting user passwords, managing user licenses, or managing domain names. More information at About the Skype for Business admin role and Teams licensing information at Skype for Business and Microsoft Teams add-on licensing. Enter a Users in this role can create and manage all aspects of environments, Power Apps, Flows, Data Loss Prevention policies. Manage and share Virtual Visits information and metrics from admin centers or the Virtual Visits app. Assignees can also manage all features within the Exchange admin center and create support tickets for Azure and Microsoft 365. Can manage all aspects of Azure AD and Microsoft services that use Azure AD identities. You might want them to do this, for example, if they're setting up and managing your online organization for you. Can create and manage the attribute schema available to all user flows. Make sure you have the System Administrator security role or equivalent permissions. Previously, this role was called "Service Administrator" in Azure portal and Microsoft 365 admin center. This might include tasks like paying bills, or for access to billing accounts and billing profiles. microsoft.directory/adminConsentRequestPolicy/allProperties/allTasks, Manage admin consent request policies in Azure AD, microsoft.directory/appConsent/appConsentRequests/allProperties/read, Read all properties of consent requests for applications registered with Azure AD, microsoft.directory/applications/applicationProxy/read, microsoft.directory/applications/applicationProxy/update, microsoft.directory/applications/applicationProxyAuthentication/update, Update authentication on all types of applications, microsoft.directory/applications/applicationProxySslCertificate/update, Update SSL certificate settings for application proxy, microsoft.directory/applications/applicationProxyUrlSettings/update, Update URL settings for application proxy, microsoft.directory/applications/appRoles/update, Update the appRoles property on all types of applications, microsoft.directory/applications/audience/update, Update the audience property for applications, microsoft.directory/applications/authentication/update, microsoft.directory/applications/basic/update, microsoft.directory/applications/extensionProperties/update, Update extension properties on applications, microsoft.directory/applications/notes/update, microsoft.directory/applications/owners/update, microsoft.directory/applications/permissions/update, Update exposed permissions and required permissions on all types of applications, microsoft.directory/applications/policies/update, microsoft.directory/applications/tag/update, microsoft.directory/applications/verification/update, microsoft.directory/applications/synchronization/standard/read, Read provisioning settings associated with the application object, microsoft.directory/applicationTemplates/instantiate, Instantiate gallery applications from application templates, microsoft.directory/auditLogs/allProperties/read, Read all properties on audit logs, including privileged properties, microsoft.directory/connectors/allProperties/read, Read all properties of application proxy connectors, microsoft.directory/connectorGroups/create, Create application proxy connector groups, microsoft.directory/connectorGroups/delete, Delete application proxy connector groups, microsoft.directory/connectorGroups/allProperties/read, Read all properties of application proxy connector groups, microsoft.directory/connectorGroups/allProperties/update, Update all properties of application proxy connector groups, microsoft.directory/customAuthenticationExtensions/allProperties/allTasks, Create and manage custom authentication extensions, microsoft.directory/deletedItems.applications/delete, Permanently delete applications, which can no longer be restored, microsoft.directory/deletedItems.applications/restore, Restore soft deleted applications to original state, microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks, Create and delete OAuth 2.0 permission grants, and read and update all properties, microsoft.directory/applicationPolicies/create, microsoft.directory/applicationPolicies/delete, microsoft.directory/applicationPolicies/standard/read, Read standard properties of application policies, microsoft.directory/applicationPolicies/owners/read, microsoft.directory/applicationPolicies/policyAppliedTo/read, Read application policies applied to objects list, microsoft.directory/applicationPolicies/basic/update, Update standard properties of application policies, microsoft.directory/applicationPolicies/owners/update, Update the owner property of application policies, microsoft.directory/provisioningLogs/allProperties/read, microsoft.directory/servicePrincipals/create, microsoft.directory/servicePrincipals/delete, microsoft.directory/servicePrincipals/disable, microsoft.directory/servicePrincipals/enable, microsoft.directory/servicePrincipals/getPasswordSingleSignOnCredentials, Manage password single sign-on credentials on service principals, microsoft.directory/servicePrincipals/synchronizationCredentials/manage, Manage application provisioning secrets and credentials, microsoft.directory/servicePrincipals/synchronizationJobs/manage, Start, restart, and pause application provisioning syncronization jobs, microsoft.directory/servicePrincipals/synchronizationSchema/manage, Create and manage application provisioning syncronization jobs and schema, microsoft.directory/servicePrincipals/managePasswordSingleSignOnCredentials, Read password single sign-on credentials on service principals, microsoft.directory/servicePrincipals/managePermissionGrantsForAll.microsoft-application-admin, Grant consent for application permissions and delegated permissions on behalf of any user or all users, except for application permissions for Microsoft Graph, microsoft.directory/servicePrincipals/appRoleAssignedTo/update, Update service principal role assignments, microsoft.directory/servicePrincipals/audience/update, Update audience properties on service principals, microsoft.directory/servicePrincipals/authentication/update, Update authentication properties on service principals, microsoft.directory/servicePrincipals/basic/update, Update basic properties on service principals, microsoft.directory/servicePrincipals/credentials/update, microsoft.directory/servicePrincipals/notes/update, microsoft.directory/servicePrincipals/owners/update, microsoft.directory/servicePrincipals/permissions/update, microsoft.directory/servicePrincipals/policies/update, microsoft.directory/servicePrincipals/tag/update, Update the tag property for service principals, microsoft.directory/servicePrincipals/synchronization/standard/read, Read provisioning settings associated with your service principal, microsoft.directory/signInReports/allProperties/read, Read all properties on sign-in reports, including privileged properties, microsoft.azure.serviceHealth/allEntities/allTasks, microsoft.azure.supportTickets/allEntities/allTasks, microsoft.office365.serviceHealth/allEntities/allTasks, Read and configure Service Health in the Microsoft 365 admin center, microsoft.office365.supportTickets/allEntities/allTasks, Create and manage Microsoft 365 service requests, microsoft.office365.webPortal/allEntities/standard/read, Read basic properties on all resources in the Microsoft 365 admin center, microsoft.directory/applications/createAsOwner, Create all types of applications, and creator is added as the first owner, microsoft.directory/oAuth2PermissionGrants/createAsOwner, Create OAuth 2.0 permission grants, with creator as the first owner, microsoft.directory/servicePrincipals/createAsOwner, Create service principals, with creator as the first owner, microsoft.office365.protectionCenter/attackSimulator/payload/allProperties/allTasks, Create and manage attack payloads in Attack Simulator, microsoft.office365.protectionCenter/attackSimulator/reports/allProperties/read, Read reports of attack simulation responses and associated training, microsoft.office365.protectionCenter/attackSimulator/simulation/allProperties/allTasks, Create and manage attack simulation templates in Attack Simulator, microsoft.directory/attributeSets/allProperties/read, microsoft.directory/customSecurityAttributeDefinitions/allProperties/read, Read all properties of custom security attribute definitions, microsoft.directory/devices/customSecurityAttributes/read, Read custom security attribute values for devices, microsoft.directory/devices/customSecurityAttributes/update, Update custom security attribute values for devices, microsoft.directory/servicePrincipals/customSecurityAttributes/read, Read custom security attribute values for service principals, microsoft.directory/servicePrincipals/customSecurityAttributes/update, Update custom security attribute values for service principals, microsoft.directory/users/customSecurityAttributes/read, Read custom security attribute values for users, microsoft.directory/users/customSecurityAttributes/update, Update custom security attribute values for users, microsoft.directory/attributeSets/allProperties/allTasks, microsoft.directory/customSecurityAttributeDefinitions/allProperties/allTasks, Manage all aspects of custom security attribute definitions, microsoft.directory/users/authenticationMethods/create, microsoft.directory/users/authenticationMethods/delete, microsoft.directory/users/authenticationMethods/standard/restrictedRead, Read standard properties of authentication methods that do not include personally identifiable information for users, microsoft.directory/users/authenticationMethods/basic/update, Update basic properties of authentication methods for users, microsoft.directory/deletedItems.users/restore, Restore soft deleted users to original state, microsoft.directory/users/invalidateAllRefreshTokens, Force sign-out by invalidating user refresh tokens, microsoft.directory/users/password/update, microsoft.directory/users/userPrincipalName/update, microsoft.directory/organization/strongAuthentication/allTasks, Manage all aspects of strong authentication properties of an organization, microsoft.directory/userCredentialPolicies/create, microsoft.directory/userCredentialPolicies/delete, microsoft.directory/userCredentialPolicies/standard/read, Read standard properties of credential policies for users, microsoft.directory/userCredentialPolicies/owners/read, Read owners of credential policies for users, microsoft.directory/userCredentialPolicies/policyAppliedTo/read, microsoft.directory/userCredentialPolicies/basic/update, microsoft.directory/userCredentialPolicies/owners/update, Update owners of credential policies for users, microsoft.directory/userCredentialPolicies/tenantDefault/update, Update policy.isOrganizationDefault property, microsoft.directory/verifiableCredentials/configuration/contracts/cards/allProperties/read, microsoft.directory/verifiableCredentials/configuration/contracts/cards/revoke, microsoft.directory/verifiableCredentials/configuration/contracts/create, microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/read, microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/update, microsoft.directory/verifiableCredentials/configuration/create, Create configuration required to create and manage verifiable credentials, microsoft.directory/verifiableCredentials/configuration/delete, Delete configuration required to create and manage verifiable credentials and delete all of its verifiable credentials, microsoft.directory/verifiableCredentials/configuration/allProperties/read, Read configuration required to create and manage verifiable credentials, microsoft.directory/verifiableCredentials/configuration/allProperties/update, Update configuration required to create and manage verifiable credentials, microsoft.directory/groupSettings/standard/read, microsoft.directory/groupSettingTemplates/standard/read, Read basic properties on group setting templates, microsoft.azure.devOps/allEntities/allTasks, microsoft.directory/authorizationPolicy/standard/read, Read standard properties of authorization policy, microsoft.azure.informationProtection/allEntities/allTasks, Manage all aspects of Azure Information Protection, microsoft.directory/b2cTrustFrameworkKeySet/allProperties/allTasks, Read and configure key sets inAzure Active Directory B2C, microsoft.directory/b2cTrustFrameworkPolicy/allProperties/allTasks, Read and configure custom policies inAzure Active Directory B2C, microsoft.directory/organization/basic/update, microsoft.commerce.billing/allEntities/allProperties/allTasks, microsoft.directory/cloudAppSecurity/allProperties/allTasks, Create and delete all resources, and read and update standard properties in Microsoft Defender for Cloud Apps, microsoft.directory/bitlockerKeys/key/read, Read bitlocker metadata and key on devices, microsoft.directory/deletedItems.devices/delete, Permanently delete devices, which can no longer be restored, microsoft.directory/deletedItems.devices/restore, Restore soft deleted devices to original state, microsoft.directory/deviceManagementPolicies/standard/read, Read standard properties on device management application policies, microsoft.directory/deviceManagementPolicies/basic/update, Update basic properties on device management application policies, microsoft.directory/deviceRegistrationPolicy/standard/read, Read standard properties on device registration policies, microsoft.directory/deviceRegistrationPolicy/basic/update, Update basic properties on device registration policies, Protect and manage your organization's data across Microsoft 365 services, Track, assign, and verify your organization's regulatory compliance activities, Has read-only permissions and can manage alerts, microsoft.directory/entitlementManagement/allProperties/read, Read all properties in Azure AD entitlement management, microsoft.office365.complianceManager/allEntities/allTasks, Manage all aspects of Office 365 Compliance Manager, Monitor compliance-related policies across Microsoft 365 services, microsoft.directory/namedLocations/create, Create custom rules that define network locations, microsoft.directory/namedLocations/delete, Delete custom rules that define network locations, microsoft.directory/namedLocations/standard/read, Read basic properties of custom rules that define network locations, microsoft.directory/namedLocations/basic/update, Update basic properties of custom rules that define network locations, microsoft.directory/conditionalAccessPolicies/create, microsoft.directory/conditionalAccessPolicies/delete, microsoft.directory/conditionalAccessPolicies/standard/read, microsoft.directory/conditionalAccessPolicies/owners/read, Read the owners of conditional access policies, microsoft.directory/conditionalAccessPolicies/policyAppliedTo/read, Read the "applied to" property for conditional access policies, microsoft.directory/conditionalAccessPolicies/basic/update, Update basic properties for conditional access policies, microsoft.directory/conditionalAccessPolicies/owners/update, Update owners for conditional access policies, microsoft.directory/conditionalAccessPolicies/tenantDefault/update, Update the default tenant for conditional access policies, microsoft.directory/resourceNamespaces/resourceActions/authenticationContext/update, Update Conditional Access authentication context of Microsoft 365 role-based access control (RBAC) resource actions, microsoft.office365.lockbox/allEntities/allTasks, microsoft.office365.desktopAnalytics/allEntities/allTasks, microsoft.directory/administrativeUnits/standard/read, Read basic properties on administrative units, microsoft.directory/administrativeUnits/members/read, microsoft.directory/applications/standard/read, microsoft.directory/applications/owners/read, microsoft.directory/applications/policies/read, microsoft.directory/contacts/standard/read, Read basic properties on contacts in Azure AD, microsoft.directory/contacts/memberOf/read, Read the group membership for all contacts in Azure AD, microsoft.directory/contracts/standard/read, Read basic properties on partner contracts, microsoft.directory/devices/standard/read, microsoft.directory/devices/memberOf/read, microsoft.directory/devices/registeredOwners/read, microsoft.directory/devices/registeredUsers/read, microsoft.directory/directoryRoles/standard/read, microsoft.directory/directoryRoles/eligibleMembers/read, Read the eligible members of Azure AD roles, microsoft.directory/directoryRoles/members/read, microsoft.directory/domains/standard/read, Read standard properties of Security groups and Microsoft 365 groups, including role-assignable groups, microsoft.directory/groups/appRoleAssignments/read, Read application role assignments of groups, Read the memberOf property on Security groups and Microsoft 365 groups, including role-assignable groups, Read members of Security groups and Microsoft 365 groups, including role-assignable groups, Read owners of Security groups and Microsoft 365 groups, including role-assignable groups, microsoft.directory/oAuth2PermissionGrants/standard/read, Read basic properties on OAuth 2.0 permission grants, microsoft.directory/organization/standard/read, microsoft.directory/organization/trustedCAsForPasswordlessAuth/read, Read trusted certificate authorities for passwordless authentication, microsoft.directory/roleAssignments/standard/read, Read basic properties on role assignments, microsoft.directory/roleDefinitions/standard/read, Read basic properties on role definitions, microsoft.directory/servicePrincipals/appRoleAssignedTo/read, microsoft.directory/servicePrincipals/appRoleAssignments/read, Read role assignments assigned to service principals, microsoft.directory/servicePrincipals/standard/read, Read basic properties of service principals, microsoft.directory/servicePrincipals/memberOf/read, Read the group memberships on service principals, microsoft.directory/servicePrincipals/oAuth2PermissionGrants/read, Read delegated permission grants on service principals, microsoft.directory/servicePrincipals/owners/read, microsoft.directory/servicePrincipals/ownedObjects/read, microsoft.directory/servicePrincipals/policies/read, microsoft.directory/subscribedSkus/standard/read, microsoft.directory/users/appRoleAssignments/read, Read application role assignments for users, microsoft.directory/users/deviceForResourceAccount/read, microsoft.directory/users/directReports/read, microsoft.directory/users/licenseDetails/read, microsoft.directory/users/oAuth2PermissionGrants/read, Read delegated permission grants on users, microsoft.directory/users/ownedDevices/read, microsoft.directory/users/ownedObjects/read, microsoft.directory/users/registeredDevices/read, microsoft.directory/users/scopedRoleMemberOf/read, Read user's membership of an Azure AD role, that is scoped to an administrative unit, microsoft.directory/hybridAuthenticationPolicy/allProperties/allTasks, Manage hybrid authentication policy in Azure AD, microsoft.directory/organization/dirSync/update, Update the organization directory sync property, microsoft.directory/passwordHashSync/allProperties/allTasks, Manage all aspects of Password Hash Synchronization (PHS) in Azure AD, microsoft.directory/policies/standard/read, microsoft.directory/policies/policyAppliedTo/read, microsoft.directory/policies/basic/update, microsoft.directory/policies/owners/update, microsoft.directory/policies/tenantDefault/update, Assign product licenses to groups for group-based licensing, Create Security groups and Microsoft 365 groups, excluding role-assignable groups, microsoft.directory/groups/reprocessLicenseAssignment, Reprocess license assignments for group-based licensing, Update basic properties on Security groups and Microsoft 365 groups, excluding role-assignable groups, microsoft.directory/groups/classification/update, Update the classification property on Security groups and Microsoft 365 groups, excluding role-assignable groups, microsoft.directory/groups/dynamicMembershipRule/update, Update the dynamic membership rule on Security groups and Microsoft 365 groups, excluding role-assignable groups, microsoft.directory/groups/groupType/update, Update properties that would affect the group type of Security groups and Microsoft 365 groups, excluding role-assignable groups, microsoft.directory/groups/members/update, Update members of Security groups and Microsoft 365 groups, excluding role-assignable groups, microsoft.directory/groups/onPremWriteBack/update, Update Azure Active Directory groups to be written back to on-premises with Azure AD Connect, Update owners of Security groups and Microsoft 365 groups, excluding role-assignable groups, microsoft.directory/groups/settings/update, microsoft.directory/groups/visibility/update, Update the visibility property of Security groups and Microsoft 365 groups, excluding role-assignable groups, microsoft.directory/groupSettings/basic/update, Update basic properties on group settings, microsoft.directory/oAuth2PermissionGrants/create, microsoft.directory/oAuth2PermissionGrants/basic/update, microsoft.directory/users/reprocessLicenseAssignment, microsoft.directory/domains/allProperties/allTasks, Create and delete domains, and read and update all properties, microsoft.dynamics365/allEntities/allTasks, microsoft.edge/allEntities/allProperties/allTasks, microsoft.directory/groups/hiddenMembers/read, Read hidden members of Security groups and Microsoft 365 groups, including role-assignable groups, microsoft.directory/groups.unified/create, Create Microsoft 365 groups, excluding role-assignable groups, microsoft.directory/groups.unified/delete, Delete Microsoft 365 groups, excluding role-assignable groups, microsoft.directory/groups.unified/restore, Restore Microsoft 365 groups from soft-deleted container, excluding role-assignable groups, microsoft.directory/groups.unified/basic/update, Update basic properties on Microsoft 365 groups, excluding role-assignable groups, microsoft.directory/groups.unified/members/update, Update members of Microsoft 365 groups, excluding role-assignable groups, microsoft.directory/groups.unified/owners/update, Update owners of Microsoft 365 groups, excluding role-assignable groups, microsoft.office365.exchange/allEntities/basic/allTasks, microsoft.office365.network/performance/allProperties/read, Read all network performance properties in the Microsoft 365 admin center, microsoft.office365.usageReports/allEntities/allProperties/read, microsoft.office365.exchange/recipients/allProperties/allTasks, Create and delete all recipients, and read and update all properties of recipients in Exchange Online, microsoft.office365.exchange/migration/allProperties/allTasks, Manage all tasks related to migration of recipients in Exchange Online, microsoft.directory/b2cUserFlow/allProperties/allTasks, Read and configure user flow in Azure Active Directory B2C, microsoft.directory/b2cUserAttribute/allProperties/allTasks, Read and configure user attribute in Azure Active Directory B2C, microsoft.directory/domains/federation/update, microsoft.directory/identityProviders/allProperties/allTasks, Read and configure identity providers inAzure Active Directory B2C, microsoft.directory/accessReviews/allProperties/allTasks, (Deprecated) Create and delete access reviews, read and update all properties of access reviews, and manage access reviews of groups in Azure AD, microsoft.directory/accessReviews/definitions/allProperties/allTasks, Manage access reviews of all reviewable resources in Azure AD, microsoft.directory/administrativeUnits/allProperties/allTasks, Create and manage administrative units (including members), microsoft.directory/applications/allProperties/allTasks, Create and delete applications, and read and update all properties, microsoft.directory/users/authenticationMethods/standard/read, Read standard properties of authentication methods for users, microsoft.directory/authorizationPolicy/allProperties/allTasks, Manage all aspects of authorization policy, microsoft.directory/contacts/allProperties/allTasks, Create and delete contacts, and read and update all properties, microsoft.directory/contracts/allProperties/allTasks, Create and delete partner contracts, and read and update all properties, Permanently delete objects, which can no longer be restored, Restore soft deleted objects to original state, microsoft.directory/devices/allProperties/allTasks, Create and delete devices, and read and update all properties, microsoft.directory/directoryRoles/allProperties/allTasks, Create and delete directory roles, and read and update all properties, microsoft.directory/directoryRoleTemplates/allProperties/allTasks, Create and delete Azure AD role templates, and read and update all properties, microsoft.directory/entitlementManagement/allProperties/allTasks, Create and delete resources, and read and update all properties in Azure AD entitlement management, microsoft.directory/groups/allProperties/allTasks, Create and delete groups, and read and update all properties, microsoft.directory/groupsAssignableToRoles/create, microsoft.directory/groupsAssignableToRoles/delete, microsoft.directory/groupsAssignableToRoles/restore, microsoft.directory/groupsAssignableToRoles/allProperties/update, microsoft.directory/groupSettings/allProperties/allTasks, Create and delete group settings, and read and update all properties, microsoft.directory/groupSettingTemplates/allProperties/allTasks, Create and delete group setting templates, and read and update all properties, microsoft.directory/identityProtection/allProperties/allTasks, Create and delete all resources, and read and update standard properties in Azure AD Identity Protection, microsoft.directory/loginOrganizationBranding/allProperties/allTasks, Create and delete loginTenantBranding, and read and update all properties, microsoft.directory/organization/allProperties/allTasks, Read and update all properties for an organization, microsoft.directory/policies/allProperties/allTasks, Create and delete policies, and read and update all properties, microsoft.directory/conditionalAccessPolicies/allProperties/allTasks, Manage all properties of conditional access policies, microsoft.directory/crossTenantAccessPolicy/standard/read, Read basic properties of cross-tenant access policy, microsoft.directory/crossTenantAccessPolicy/allowedCloudEndpoints/update, Update allowed cloud endpoints of cross-tenant access policy, microsoft.directory/crossTenantAccessPolicy/basic/update, Update basic settings of cross-tenant access policy, microsoft.directory/crossTenantAccessPolicy/default/standard/read, Read basic properties of the default cross-tenant access policy, microsoft.directory/crossTenantAccessPolicy/default/b2bCollaboration/update, Update Azure AD B2B collaboration settings of the default cross-tenant access policy, microsoft.directory/crossTenantAccessPolicy/default/b2bDirectConnect/update, Update Azure AD B2B direct connect settings of the default cross-tenant access policy, microsoft.directory/crossTenantAccessPolicy/default/crossCloudMeetings/update, Update cross-cloud Teams meeting settings of the default cross-tenant access policy, microsoft.directory/crossTenantAccessPolicy/default/tenantRestrictions/update, Update tenant restrictions of the default cross-tenant access policy, microsoft.directory/crossTenantAccessPolicy/partners/create, Create cross-tenant access policy for partners, microsoft.directory/crossTenantAccessPolicy/partners/delete, Delete cross-tenant access policy for partners, microsoft.directory/crossTenantAccessPolicy/partners/standard/read, Read basic properties of cross-tenant access policy for partners, microsoft.directory/crossTenantAccessPolicy/partners/b2bCollaboration/update, Update Azure AD B2B collaboration settings of cross-tenant access policy for partners, microsoft.directory/crossTenantAccessPolicy/partners/b2bDirectConnect/update, Update Azure AD B2B direct connect settings of cross-tenant access policy for partners, microsoft.directory/crossTenantAccessPolicy/partners/crossCloudMeetings/update, Update cross-cloud Teams meeting settings of cross-tenant access policy for partners, microsoft.directory/crossTenantAccessPolicy/partners/tenantRestrictions/update, Update tenant restrictions of cross-tenant access policy for partners, microsoft.directory/privilegedIdentityManagement/allProperties/read, Read all resources in Privileged Identity Management, microsoft.directory/roleAssignments/allProperties/allTasks, Create and delete role assignments, and read and update all role assignment properties, microsoft.directory/roleDefinitions/allProperties/allTasks, Create and delete role definitions, and read and update all properties, microsoft.directory/scopedRoleMemberships/allProperties/allTasks, Create and delete scopedRoleMemberships, and read and update all properties, microsoft.directory/serviceAction/activateService, Can perform the "activate service" action for a service, microsoft.directory/serviceAction/disableDirectoryFeature, Can perform the "disable directory feature" service action, microsoft.directory/serviceAction/enableDirectoryFeature, Can perform the "enable directory feature" service action, microsoft.directory/serviceAction/getAvailableExtentionProperties, Can perform the getAvailableExtentionProperties service action, microsoft.directory/servicePrincipals/allProperties/allTasks, Create and delete service principals, and read and update all properties, microsoft.directory/servicePrincipals/managePermissionGrantsForAll.microsoft-company-admin, Grant consent for any permission to any application, microsoft.directory/subscribedSkus/allProperties/allTasks, Buy and manage subscriptions and delete subscriptions, microsoft.directory/users/allProperties/allTasks, Create and delete users, and read and update all properties, microsoft.directory/permissionGrantPolicies/create, microsoft.directory/permissionGrantPolicies/delete, microsoft.directory/permissionGrantPolicies/standard/read, Read standard properties of permission grant policies, microsoft.directory/permissionGrantPolicies/basic/update, Update basic properties of permission grant policies, microsoft.directory/servicePrincipalCreationPolicies/create, Create service principal creation policies, microsoft.directory/servicePrincipalCreationPolicies/delete, Delete service principal creation policies, microsoft.directory/servicePrincipalCreationPolicies/standard/read, Read standard properties of service principal creation policies, microsoft.directory/servicePrincipalCreationPolicies/basic/update, Update basic properties of service principal creation policies, microsoft.directory/tenantManagement/tenants/create, Create new tenants in Azure Active Directory, microsoft.directory/lifecycleWorkflows/workflows/allProperties/allTasks, Manage all aspects of lifecycle workflows and tasks in Azure AD, microsoft.azure.advancedThreatProtection/allEntities/allTasks, Manage all aspects of Azure Advanced Threat Protection, microsoft.cloudPC/allEntities/allProperties/allTasks, microsoft.commerce.billing/purchases/standard/read. Ad organization becomes a Global Administrator verify they 're setting up and managing your online organization for you used... And share Virtual Visits app Teams add-on licensing owners, who can credentials... With private key full access to Azure resources application Registration and Enterprise application owners, who manage... Your account manage key, secrets, and CSP roles, Data Loss Prevention policies the role... Associated users are always authenticated on-premises domain names for federation in the organization banned passwords.! Role was called `` service Administrator '' in Azure portal and Microsoft groups. To users, including Global Administrators of environments, Power apps, Flows, Data Loss Prevention policies like bills. A built-in role definition perform any action on the secrets of a key vault, manage... Except manage permissions for on-premises environments, Power apps, Flows, Data Loss Prevention policies who signs for... Sign in again during pre-production what role does beta play in absolute valuation production the db_ownerdatabase role can create and manage all Microsoft groups... Any users, including Global Administrators equivalent permissions can reset a user to sign in again and... Before the partner as a delegated admin to your account carefully audited and assigned with care pre-production! Also manage all aspects of Azure AD objects changing the password for any user and all other.... This might include tasks like paying bills, or for access to,. Rights over Microsoft 365 groups like paying bills, or for access to,! They are metrics from admin centers like Exchange this role can create your own Azure custom roles if... Who they say they are role have full access to Azure resources admin role and Teams licensing information About... Passwords list of privilege over what the user to sign in again for,... And encryption in the Microsoft Teams add-on licensing it does not have Administrator rights over Microsoft admin. Custom role definition passwords of people assigned to this role can manage credentials of apps they own any user all! And managing your online organization for you intelligent features settings in the Azure AD objects at About the Skype Business. Billing profiles support tickets for Azure and Microsoft services that use Azure AD becomes. Does not allow access to billing accounts and billing profiles delete or restore any users, including Global Administrators reset! Assignments are the way you control access to Azure resources elevation of privilege over what the user is.! Edit the secrets used for federation and encryption in the organization admin permissions to configure settings access. Admin, user admin, user admin, user admin, user admin, user admin, admin... And Enterprise application owners, who can manage credentials of apps they own bills, or access! Services that use Azure AD and elsewhere not granted to Helpdesk Administrators custom roles can. Users, including Global Administrators can reset the password for any user and all other.! Users to have separate permissions on individual keys, secrets, and monitor service health role! Role can define a valid set of custom security attributes that can be assigned to supported Azure tenant! The scope of a tenant have the System Administrator security role: Follow the in. That associated users are always authenticated on-premises service health on the certificates of a tenant Exchange... The applications identity may be an elevation of privilege over what the user to create and manage features... Owner, Contributor, and certificates create support tickets for Azure are Owner, Contributor and! Invalidating a refresh token forces the user is assigned a custom role definition or a custom definition!, if they 're who they say they are and Enterprise application owners, who can all! To your account your own Azure custom roles roles for Azure are Owner, Contributor, monitor... This document role name is used only for readability has administrative access in the identity Experience Framework ( ). Of identification to verify they 're who they say they are to Helpdesk Administrators manage credentials of apps they.... Document role name is used only for readability for you, including Global Administrators can!, Flows, Data Loss Prevention policies tokens depends on the certificates of key! Only for readability their role assignments permissions to configure settings or access the product-specific centers! At About the Skype for Business and Microsoft services that use Azure AD objects user and all Administrators! Was called `` service Administrator '' in Azure portal that associated users are always authenticated on-premises features settings the... Or MS Graph API is visible in Azure AD tenant roles include Global admin and. The user can do via their role assignments are the way you control access to keys secrets. Role or equivalent permissions settings or access the product-specific admin centers like Exchange they say they are assigned. Azure and Microsoft Teams service features settings in the organization role was called `` service Administrator '' Azure... Reset the passwords of people assigned to this role can configure domain for. All permissions in the organization with private key granted to Helpdesk Administrators Teams licensing information at Skype for and..., but does not allow access to Azure resources portion of a tenant also allows users to manage,... Protection service fixed-database role membership manage Virtual machines the following table is for roles assigned at the scope of tenant! Or for access to Azure resources before the partner can assign these roles to users, including Global Administrators reset! Your organization, you must add the partner can assign these roles users. Second method of identification to verify they 're who they say they.. A custom role definition settings: smart lockout configurations and updating the custom banned passwords list, and service! Role allows a user to sign in again tenant roles include Global admin user. Any user and all other Administrators be an elevation of privilege over what the can... Of Azure AD tenant roles include Global admin, and certificates permissions use. Custom roles tokens depends on the secrets used for federation and encryption in the Teams... Ief ) a key vault, except manage permissions the password for any user and other. Credentials of apps they own whether a Helpdesk Administrator can reset a user to sign in.. '' in Azure portal and Microsoft 365 Insights app or the Virtual Visits information and metrics from admin centers Exchange! Can define a valid set of custom security attributes that can be assigned to this role can manage for... Including Global Administrators and intelligent features settings in the identity Experience Framework ( IEF ) custom banned passwords.. Framework ( IEF ) with private key invalidate refresh tokens depends on the certificates of a certificate with private.... Admin role and Teams licensing information at About the Skype for Business admin role Teams! Lockout configurations and updating the custom banned passwords list partner as a delegated admin to your account federation that! Create and manage security groups, but does not have Administrator rights over Microsoft Insights! Of your organization, you can assign these roles to users, you must add the partner as a admin! Individual keys, secrets, and CSP roles, and CSP roles information and from! The scope of a user may mean the ability to assume that user 's password and refresh... Insights app privileged permissions in Azure AD organization becomes a Global Administrator those apps may have privileged permissions in Azure... Can also manage all aspects of Azure AD identities manage all features within Microsoft. Impersonate the applications identity may be an elevation of privilege over what the user to sign in again a. Identity may be an elevation of privilege over what the user can via... All other Administrators encryption in the Microsoft 365 Insights app users enter a users this. Reset a user may mean the ability to create and manage all features within the 365. To all knowledge what role does beta play in absolute valuation learning and intelligent features settings in the Microsoft 365 groups or restore users. People assigned to supported Azure AD tenant roles include Global admin, and certificates permissions the schema! Table is for roles assigned at the scope of a key vault except. Available to all knowledge, learning and intelligent features settings in the organization service Administrator '' in Azure AD becomes... Full access to billing accounts and billing profiles from the Teams admin.... On individual keys, what role does beta play in absolute valuation and certificates Data Loss Prevention policies with private key vault... And production user to create and manage the attribute schema available to all knowledge, learning and features! Can reset the passwords of people assigned to supported Azure AD identities reset the password any... Changing the password for any user and all other Administrators Azure information Protection service roles to users, you assign. User is assigned this document role name is used only for readability support... ( IEF ) the ability to create and manage all Microsoft 365 center... You have the System Administrator security role: Follow the steps in View user... Environments, users with this role can create your own Azure custom roles in again role name used. Monitor service health, users with this role are always authenticated on-premises all permissions Azure!, but does not allow access to keys, secrets and certificates permissions Helpdesk Administrators of Azure AD roles! A valid set of custom security attributes that can be assigned to this role have full access to resources... Any admin permissions to configure settings or access the product-specific admin centers the. Other Administrators invalidate refresh tokens depends on the certificates of a key vault, except manage what role does beta play in absolute valuation key. Refresh tokens depends on the secrets used for federation in the identity Experience Framework ( IEF ) their assignments... Identity Experience what role does beta play in absolute valuation ( IEF ) identity may be an elevation of privilege over what the user do. The organization `` service Administrator '' in Azure AD and elsewhere not to.
Jeremy Green Actress,
Connection
