📋 Microsoft Entra Documentation Changes

Changes for June 28th 2025

Period: June 27th 2025, 12:00 AM to June 28th 2025, 12:00 AM

📚 Historical Report: This report shows documentation changes that occurred during the 24-hour period ending on June 28th 2025.

📊 Summary

184
Total Commits
0
New Files
154
Modified Files
0
Deleted Files
11
Contributors

📝 Modified Documentation Files

MODIFIED docs/fundamentals/whats-new.md
Modified by Ortagus Winfrey on Jun 27, 2025 4:53 AM
📖 View on learn.microsoft.com
+78 / -0 lines changed
Commit: June 2025 added to whats new article
Changes:
Before
After
 
>Get notified about when to revisit this page for updates by copying and pasting this URL: `https://learn.microsoft.com/api/search/rss?search=%22Release+notes+-+Azure+Active+Directory%22&locale=en-us` into your ![RSS feed reader icon](./media/whats-new/feed-icon-16x16.png) feed reader.
 
## May 2025
 
### General Availability - Microsoft Entra External ID: User authentication with SAML/WS-Fed Identity Providers
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
>Get notified about when to revisit this page for updates by copying and pasting this URL: `https://learn.microsoft.com/api/search/rss?search=%22Release+notes+-+Azure+Active+Directory%22&locale=en-us` into your ![RSS feed reader icon](./media/whats-new/feed-icon-16x16.png) feed reader.
 
## June 2025
### Public Preview of Conditional Access Overview Monitoring Tab to Retire
**Type:** Deprecated
**Service category:** Conditional Access
**Product capability:** Identity Security & Protection
We're retiring the Monitoring tab on the Conditional Access Overview pane (Public Preview) in July 2025. This retirement is due to low usage and known data accuracy issues. Customers can continue to monitor Conditional Access policies using Insights & Reporting, per-policy impact reports, and Sign-in logs. For more information, see: [Policy impact](../identity/conditional-access/concept-conditional-access-report-only.md#policy-impact).
---
### General Availability - Manage Lifecycle Workflows with Microsoft Security CoPilot in Microsoft Entra
**Type:** New feature
**Service category:** Lifecycle Workflows
**Product capability:** Identity Governance
MODIFIED docs/identity/role-based-access-control/includes/global-administrator.md
Modified by Faith Moraa Ombongi on Jun 27, 2025 9:35 PM
📖 View on learn.microsoft.com
+21 / -21 lines changed
Commit: June 26 pass
Changes:
Before
After
ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: include
ms.date: 06/25/2025
ms.custom: include file
---
 
> | microsoft.directory/adminConsentRequestPolicy/allProperties/allTasks | Manage admin consent request policies in Microsoft Entra ID |
> | microsoft.directory/administrativeUnits/allProperties/allTasks | Create and manage administrative units (including members) |
> | microsoft.directory/appConsent/appConsentRequests/allProperties/read | Read all properties of consent requests for applications registered with Microsoft Entra ID |
> | microsoft.directory/applications/allProperties/allTasks | Create and delete applications, and read and update all properties<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/applications/synchronization/standard/read | Read provisioning settings associated with the application object |
> | microsoft.directory/applicationTemplates/instantiate | Instantiate gallery applications from application templates |
> | microsoft.directory/auditLogs/allProperties/read | Read all properties on audit logs, excluding custom security attributes audit logs |
> | microsoft.directory/authorizationPolicy/allProperties/allTasks | Manage all aspects of authorization policy<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/bitlockerKeys/key/read | Read bitlocker metadata and key on devices<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/bulkJobs/basic/update | Update all the bulk jobs in a directory |
> | microsoft.directory/bulkJobs/create | Create all bulk jobs in a directory |
> | microsoft.directory/bulkJobs/standard/read | Read all bulk jobs in a directory |
> | microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/standard/read | Read basic properties of cross tenant access policy templates for multi-tenant organization |
ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: include
ms.date: 06/27/2025
ms.custom: include file
---
 
> | microsoft.directory/adminConsentRequestPolicy/allProperties/allTasks | Manage admin consent request policies in Microsoft Entra ID |
> | microsoft.directory/administrativeUnits/allProperties/allTasks | Create and manage administrative units (including members) |
> | microsoft.directory/appConsent/appConsentRequests/allProperties/read | Read all properties of consent requests for applications registered with Microsoft Entra ID |
> | microsoft.directory/applications/allProperties/allTasks | Create and delete applications, and read and update all properties<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/applications/synchronization/standard/read | Read provisioning settings associated with the application object |
> | microsoft.directory/applicationTemplates/instantiate | Instantiate gallery applications from application templates |
> | microsoft.directory/auditLogs/allProperties/read | Read all properties on audit logs, excluding custom security attributes audit logs |
> | microsoft.directory/authorizationPolicy/allProperties/allTasks | Manage all aspects of authorization policy<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/bitlockerKeys/key/read | Read bitlocker metadata and key on devices<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/bulkJobs/basic/update | Update all the bulk jobs in a directory |
> | microsoft.directory/bulkJobs/create | Create all bulk jobs in a directory |
> | microsoft.directory/bulkJobs/standard/read | Read all bulk jobs in a directory |
> | microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/standard/read | Read basic properties of cross tenant access policy templates for multi-tenant organization |
MODIFIED docs/identity/role-based-access-control/includes/partner-tier2-support.md
Modified by Faith Moraa Ombongi on Jun 27, 2025 9:35 PM
📖 View on learn.microsoft.com
+11 / -11 lines changed
Commit: June 26 pass
Changes:
Before
After
ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: include
ms.date: 06/25/2025
ms.custom: include file
---
 
> | microsoft.directory/applications/audience/update | Update the audience property for applications |
> | microsoft.directory/applications/authentication/update | Update authentication on all types of applications |
> | microsoft.directory/applications/basic/update | Update basic properties for applications |
> | microsoft.directory/applications/credentials/update | Update application credentials<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/applications/notes/update | Update notes of applications |
> | microsoft.directory/applications/owners/update | Update owners of applications |
> | microsoft.directory/applications/permissions/update | Update exposed permissions and required permissions on all types of applications |
> | microsoft.directory/contacts/delete | Delete contacts |
> | microsoft.directory/deletedItems.groups/restore | Restore soft deleted groups to original state |
> | microsoft.directory/deletedItems.users/restore | Restore soft deleted users to original state |
> | microsoft.directory/domains/allProperties/allTasks | Create and delete domains, and read and update all properties<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/groups.unified/assignedLabels/update | Update the assigned labels property on Microsoft 365 groups of assigned membership type, excluding role-assignable groups |
> | microsoft.directory/groups/create | Create Security groups and Microsoft 365 groups, excluding role-assignable groups |
ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: include
ms.date: 06/27/2025
ms.custom: include file
---
 
> | microsoft.directory/applications/audience/update | Update the audience property for applications |
> | microsoft.directory/applications/authentication/update | Update authentication on all types of applications |
> | microsoft.directory/applications/basic/update | Update basic properties for applications |
> | microsoft.directory/applications/credentials/update | Update application credentials<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/applications/notes/update | Update notes of applications |
> | microsoft.directory/applications/owners/update | Update owners of applications |
> | microsoft.directory/applications/permissions/update | Update exposed permissions and required permissions on all types of applications |
> | microsoft.directory/contacts/delete | Delete contacts |
> | microsoft.directory/deletedItems.groups/restore | Restore soft deleted groups to original state |
> | microsoft.directory/deletedItems.users/restore | Restore soft deleted users to original state |
> | microsoft.directory/domains/allProperties/allTasks | Create and delete domains, and read and update all properties<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/groups.unified/assignedLabels/update | Update the assigned labels property on Microsoft 365 groups of assigned membership type, excluding role-assignable groups |
> | microsoft.directory/groups/create | Create Security groups and Microsoft 365 groups, excluding role-assignable groups |
MODIFIED docs/identity/role-based-access-control/includes/privileged-authentication-administrator.md
Modified by Faith Moraa Ombongi on Jun 27, 2025 9:35 PM
📖 View on learn.microsoft.com
+11 / -11 lines changed
Commit: June 26 pass
Changes:
Before
After
ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: include
ms.date: 06/25/2025
ms.custom: include file
---
 
> | microsoft.azure.serviceHealth/allEntities/allTasks | Read and configure Azure Service Health |
> | microsoft.azure.supportTickets/allEntities/allTasks | Create and manage Azure support tickets |
> | microsoft.directory/deletedItems.users/restore | Restore soft deleted users to original state |
> | microsoft.directory/users/authenticationMethods/basic/update | Update basic properties of authentication methods for users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/users/authenticationMethods/create | Update authentication methods for users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/users/authenticationMethods/delete | Delete authentication methods for users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/users/authenticationMethods/standard/read | Read standard properties of authentication methods for users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/users/authorizationInfo/update | Update the multivalued Certificate user IDs property of users |
> | microsoft.directory/users/basic/update | Update basic properties on users |
> | microsoft.directory/users/delete | Delete users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/users/disable | Disable users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/users/enable | Enable users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/users/invalidateAllRefreshTokens | Force sign-out by invalidating user refresh tokens<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: include
ms.date: 06/27/2025
ms.custom: include file
---
 
> | microsoft.azure.serviceHealth/allEntities/allTasks | Read and configure Azure Service Health |
> | microsoft.azure.supportTickets/allEntities/allTasks | Create and manage Azure support tickets |
> | microsoft.directory/deletedItems.users/restore | Restore soft deleted users to original state |
> | microsoft.directory/users/authenticationMethods/basic/update | Update basic properties of authentication methods for users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/users/authenticationMethods/create | Update authentication methods for users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/users/authenticationMethods/delete | Delete authentication methods for users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/users/authenticationMethods/standard/read | Read standard properties of authentication methods for users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/users/authorizationInfo/update | Update the multivalued Certificate user IDs property of users |
> | microsoft.directory/users/basic/update | Update basic properties on users |
> | microsoft.directory/users/delete | Delete users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/users/disable | Disable users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/users/enable | Enable users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/users/invalidateAllRefreshTokens | Force sign-out by invalidating user refresh tokens<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
MODIFIED docs/identity/role-based-access-control/includes/authentication-administrator.md
Modified by Faith Moraa Ombongi on Jun 27, 2025 9:35 PM
📖 View on learn.microsoft.com
+10 / -10 lines changed
Commit: June 26 pass
Changes:
Before
After
ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: include
ms.date: 06/25/2025
ms.custom: include file
---
 
> | microsoft.azure.serviceHealth/allEntities/allTasks | Read and configure Azure Service Health |
> | microsoft.azure.supportTickets/allEntities/allTasks | Create and manage Azure support tickets |
> | microsoft.directory/deletedItems.users/restore | Restore soft deleted users to original state |
> | microsoft.directory/users/authenticationMethods/basic/update | Update basic properties of authentication methods for users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/users/authenticationMethods/create | Update authentication methods for users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/users/authenticationMethods/delete | Delete authentication methods for users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/users/authenticationMethods/standard/restrictedRead | Read standard properties of authentication methods that do not include personally identifiable information for users |
> | microsoft.directory/users/basic/update | Update basic properties on users |
> | microsoft.directory/users/delete | Delete users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/users/disable | Disable users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/users/enable | Enable users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/users/invalidateAllRefreshTokens | Force sign-out by invalidating user refresh tokens<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/users/manager/update | Update manager for users |
ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: include
ms.date: 06/27/2025
ms.custom: include file
---
 
> | microsoft.azure.serviceHealth/allEntities/allTasks | Read and configure Azure Service Health |
> | microsoft.azure.supportTickets/allEntities/allTasks | Create and manage Azure support tickets |
> | microsoft.directory/deletedItems.users/restore | Restore soft deleted users to original state |
> | microsoft.directory/users/authenticationMethods/basic/update | Update basic properties of authentication methods for users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/users/authenticationMethods/create | Update authentication methods for users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/users/authenticationMethods/delete | Delete authentication methods for users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/users/authenticationMethods/standard/restrictedRead | Read standard properties of authentication methods that do not include personally identifiable information for users |
> | microsoft.directory/users/basic/update | Update basic properties on users |
> | microsoft.directory/users/delete | Delete users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/users/disable | Disable users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/users/enable | Enable users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/users/invalidateAllRefreshTokens | Force sign-out by invalidating user refresh tokens<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/users/manager/update | Update manager for users |
MODIFIED docs/identity/role-based-access-control/includes/partner-tier1-support.md
Modified by Faith Moraa Ombongi on Jun 27, 2025 9:35 PM
📖 View on learn.microsoft.com
+10 / -10 lines changed
Commit: June 26 pass
Changes:
Before
After
ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: include
ms.date: 06/25/2025
ms.custom: include file
---
 
> | microsoft.directory/applications/audience/update | Update the audience property for applications |
> | microsoft.directory/applications/authentication/update | Update authentication on all types of applications |
> | microsoft.directory/applications/basic/update | Update basic properties for applications |
> | microsoft.directory/applications/credentials/update | Update application credentials<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/applications/notes/update | Update notes of applications |
> | microsoft.directory/applications/owners/update | Update owners of applications |
> | microsoft.directory/applications/permissions/update | Update exposed permissions and required permissions on all types of applications |
> | microsoft.directory/groups/members/update | Update members of Security groups and Microsoft 365 groups, excluding role-assignable groups |
> | microsoft.directory/groups/owners/update | Update owners of Security groups and Microsoft 365 groups, excluding role-assignable groups |
> | microsoft.directory/groups/restore | Restore groups from soft-deleted container |
> | microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks | Create and delete OAuth 2.0 permission grants, and read and update all properties<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/servicePrincipals/appRoleAssignedTo/update | Update service principal role assignments |
> | microsoft.directory/users/assignLicense | Manage user licenses |
ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: include
ms.date: 06/27/2025
ms.custom: include file
---
 
> | microsoft.directory/applications/audience/update | Update the audience property for applications |
> | microsoft.directory/applications/authentication/update | Update authentication on all types of applications |
> | microsoft.directory/applications/basic/update | Update basic properties for applications |
> | microsoft.directory/applications/credentials/update | Update application credentials<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/applications/notes/update | Update notes of applications |
> | microsoft.directory/applications/owners/update | Update owners of applications |
> | microsoft.directory/applications/permissions/update | Update exposed permissions and required permissions on all types of applications |
> | microsoft.directory/groups/members/update | Update members of Security groups and Microsoft 365 groups, excluding role-assignable groups |
> | microsoft.directory/groups/owners/update | Update owners of Security groups and Microsoft 365 groups, excluding role-assignable groups |
> | microsoft.directory/groups/restore | Restore groups from soft-deleted container |
> | microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks | Create and delete OAuth 2.0 permission grants, and read and update all properties<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/servicePrincipals/appRoleAssignedTo/update | Update service principal role assignments |
> | microsoft.directory/users/assignLicense | Manage user licenses |
MODIFIED docs/identity/role-based-access-control/includes/user-administrator.md
Modified by Faith Moraa Ombongi on Jun 27, 2025 9:35 PM
📖 View on learn.microsoft.com
+10 / -10 lines changed
Commit: June 26 pass
Changes:
Before
After
ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: include
ms.date: 06/25/2025
ms.custom: include file
---
 
> | microsoft.directory/groups/restore | Restore groups from soft-deleted container |
> | microsoft.directory/groups/settings/update | Update settings of groups |
> | microsoft.directory/groups/visibility/update | Update the visibility property of Security groups and Microsoft 365 groups, excluding role-assignable groups |
> | microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks | Create and delete OAuth 2.0 permission grants, and read and update all properties<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/onPremisesSynchronization/standard/read | Read standard on-premises directory synchronization information |
> | microsoft.directory/policies/standard/read | Read basic properties on policies |
> | microsoft.directory/servicePrincipals/appRoleAssignedTo/update | Update service principal role assignments |
> | microsoft.directory/users/assignLicense | Manage user licenses |
> | microsoft.directory/users/basic/update | Update basic properties on users |
> | microsoft.directory/users/convertExternalToInternalMemberUser | Convert external user to internal user |
> | microsoft.directory/users/create | Add users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/users/delete | Delete users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/users/disable | Disable users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: include
ms.date: 06/27/2025
ms.custom: include file
---
 
> | microsoft.directory/groups/restore | Restore groups from soft-deleted container |
> | microsoft.directory/groups/settings/update | Update settings of groups |
> | microsoft.directory/groups/visibility/update | Update the visibility property of Security groups and Microsoft 365 groups, excluding role-assignable groups |
> | microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks | Create and delete OAuth 2.0 permission grants, and read and update all properties<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/onPremisesSynchronization/standard/read | Read standard on-premises directory synchronization information |
> | microsoft.directory/policies/standard/read | Read basic properties on policies |
> | microsoft.directory/servicePrincipals/appRoleAssignedTo/update | Update service principal role assignments |
> | microsoft.directory/users/assignLicense | Manage user licenses |
> | microsoft.directory/users/basic/update | Update basic properties on users |
> | microsoft.directory/users/convertExternalToInternalMemberUser | Convert external user to internal user |
> | microsoft.directory/users/create | Add users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/users/delete | Delete users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/users/disable | Disable users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
MODIFIED docs/identity/role-based-access-control/includes/directory-writers.md
Modified by Faith Moraa Ombongi on Jun 27, 2025 9:35 PM
📖 View on learn.microsoft.com
+8 / -8 lines changed
Commit: June 26 pass
Changes:
Before
After
ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: include
ms.date: 06/25/2025
ms.custom: include file
---
 
> | microsoft.directory/groupSettings/basic/update | Update basic properties on group settings |
> | microsoft.directory/groupSettings/create | Create group settings |
> | microsoft.directory/groupSettings/delete | Delete group settings |
> | microsoft.directory/oAuth2PermissionGrants/basic/update | Update OAuth 2.0 permission grants<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/oAuth2PermissionGrants/create | Create OAuth 2.0 permission grants<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/servicePrincipals/appRoleAssignedTo/update | Update service principal role assignments |
> | microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/credentials/manage | Manage cloud tenant to cloud tenant application provisioning secrets and credentials. |
> | microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/jobs/manage | Start, restart, and pause cloud tenant to cloud tenant application provisioning synchronization jobs. |
> | microsoft.directory/servicePrincipals/synchronizationSchema/manage | Create and manage application provisioning synchronization jobs and schema |
> | microsoft.directory/users/assignLicense | Manage user licenses |
> | microsoft.directory/users/basic/update | Update basic properties on users |
> | microsoft.directory/users/create | Add users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/users/disable | Disable users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: include
ms.date: 06/27/2025
ms.custom: include file
---
 
> | microsoft.directory/groupSettings/basic/update | Update basic properties on group settings |
> | microsoft.directory/groupSettings/create | Create group settings |
> | microsoft.directory/groupSettings/delete | Delete group settings |
> | microsoft.directory/oAuth2PermissionGrants/basic/update | Update OAuth 2.0 permission grants<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/oAuth2PermissionGrants/create | Create OAuth 2.0 permission grants<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/servicePrincipals/appRoleAssignedTo/update | Update service principal role assignments |
> | microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/credentials/manage | Manage cloud tenant to cloud tenant application provisioning secrets and credentials. |
> | microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/jobs/manage | Start, restart, and pause cloud tenant to cloud tenant application provisioning synchronization jobs. |
> | microsoft.directory/servicePrincipals/synchronizationSchema/manage | Create and manage application provisioning synchronization jobs and schema |
> | microsoft.directory/users/assignLicense | Manage user licenses |
> | microsoft.directory/users/basic/update | Update basic properties on users |
> | microsoft.directory/users/create | Add users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/users/disable | Disable users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
MODIFIED docs/identity/role-based-access-control/includes/security-administrator.md
Modified by Faith Moraa Ombongi on Jun 27, 2025 9:35 PM
📖 View on learn.microsoft.com
+6 / -6 lines changed
Commit: June 26 pass
Changes:
Before
After
ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: include
ms.date: 06/25/2025
ms.custom: include file
---
 
> | microsoft.directory/applications/policies/update | Update policies of applications |
> | microsoft.directory/auditLogs/allProperties/read | Read all properties on audit logs, excluding custom security attributes audit logs |
> | microsoft.directory/authorizationPolicy/standard/read | Read standard properties of authorization policy |
> | microsoft.directory/bitlockerKeys/key/read | Read bitlocker metadata and key on devices<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/bulkJobs/standard/read | Read all bulk jobs in a directory |
> | microsoft.directory/conditionalAccessPolicies/basic/update | Update basic properties for Conditional Access policies |
> | microsoft.directory/conditionalAccessPolicies/create | Create Conditional Access policies |
> | microsoft.directory/crossTenantAccessPolicy/partners/tenantRestrictions/update | Update tenant restrictions of cross-tenant access policy for partners |
> | microsoft.directory/crossTenantAccessPolicy/standard/read | Read basic properties of cross-tenant access policy |
> | microsoft.directory/deviceLocalCredentials/standard/read | Read all properties of the backed up local administrator account credentials for Microsoft Entra joined devices, except the password |
> | microsoft.directory/domains/federation/update | Update federation property of domains<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/domains/federationConfiguration/basic/update | Update basic federation configuration for domains |
> | microsoft.directory/domains/federationConfiguration/create | Create federation configuration for domains |
ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: include
ms.date: 06/27/2025
ms.custom: include file
---
 
> | microsoft.directory/applications/policies/update | Update policies of applications |
> | microsoft.directory/auditLogs/allProperties/read | Read all properties on audit logs, excluding custom security attributes audit logs |
> | microsoft.directory/authorizationPolicy/standard/read | Read standard properties of authorization policy |
> | microsoft.directory/bitlockerKeys/key/read | Read bitlocker metadata and key on devices<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/bulkJobs/standard/read | Read all bulk jobs in a directory |
> | microsoft.directory/conditionalAccessPolicies/basic/update | Update basic properties for Conditional Access policies |
> | microsoft.directory/conditionalAccessPolicies/create | Create Conditional Access policies |
> | microsoft.directory/crossTenantAccessPolicy/partners/tenantRestrictions/update | Update tenant restrictions of cross-tenant access policy for partners |
> | microsoft.directory/crossTenantAccessPolicy/standard/read | Read basic properties of cross-tenant access policy |
> | microsoft.directory/deviceLocalCredentials/standard/read | Read all properties of the backed up local administrator account credentials for Microsoft Entra joined devices, except the password |
> | microsoft.directory/domains/federation/update | Update federation property of domains<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/domains/federationConfiguration/basic/update | Update basic federation configuration for domains |
> | microsoft.directory/domains/federationConfiguration/create | Create federation configuration for domains |
MODIFIED docs/id-governance/entitlement-management-access-package-resources.md
Modified by Ortagus Winfrey on Jun 27, 2025 3:08 AM
📖 View on learn.microsoft.com
+6 / -6 lines changed
Commit: updates
Changes:
Before
After
ms.service: entra-id-governance
ms.subservice: entitlement-management
ms.topic: how-to
ms.date: 08/23/2024
ms.author: owinfrey
#Customer intent: As an administrator, I want detailed information about how I can edit an access package so that requestors have the resources they need to perform their job.
---
When they lose an access package assignment, then they're removed from all the resource roles in the access package.
 
> [!NOTE]
> If users were added to the resources outside of entitlement management, and they need to retain access even if they later receive access package assignments and their access package assignments expire, then do not add the resource roles to an access package.
 
If you want some users to receive different resource roles than others, then you need to create multiple access packages in the catalog, with separate access packages for each of the resource roles. You can also mark the access packages as [incompatible](entitlement-management-access-package-incompatible.md) with each other so users can't request access to access packages that would give them excessive access.
 
In particular, applications can have multiple app roles. When you add an application's app role as a resource role to an access package, if that application has more than one app role, you need to specify the appropriate role for those users in the access package.
 
> [!NOTE]
> If an application has multiple app roles, and more than one role of that application are in an access package, then the user will receive all those application's included roles. If instead you want users to only have some of the application's roles, then you will need to create multiple access packages in the catalog, with separate access packages for each of the app roles.
 
In addition, applications can also rely upon security groups for expressing permissions. For example, an application might have a single app role `User` and also check the membership of two groups - a `Ordinary Users` group and a `Administrative Access` groups. A user of the application must be a member of exactly one of those two groups. If you wished to configure that users could request either permission, then you would put into a catalog three resources: the application, the group `Ordinary Users` and the group `Administrative Access`. Then, you would create in that catalog two access packages, and indicate each access package is [incompatible](entitlement-management-access-package-incompatible.md#scenarios-for-separation-of-duties-checks) with the other:
ms.service: entra-id-governance
ms.subservice: entitlement-management
ms.topic: how-to
ms.date: 06/25/2025
ms.author: owinfrey
#Customer intent: As an administrator, I want detailed information about how I can edit an access package so that requestors have the resources they need to perform their job.
---
When they lose an access package assignment, then they're removed from all the resource roles in the access package.
 
> [!NOTE]
> If users were added to the resources outside of entitlement management, and they need to retain access even if they later receive access package assignments and their access package assignments expire, then don't add the resource roles to an access package.
 
If you want some users to receive different resource roles than others, then you need to create multiple access packages in the catalog, with separate access packages for each of the resource roles. You can also mark the access packages as [incompatible](entitlement-management-access-package-incompatible.md) with each other so users can't request access to access packages that would give them excessive access.
 
In particular, applications can have multiple app roles. When you add an application's app role as a resource role to an access package, if that application has more than one app role, you need to specify the appropriate role for those users in the access package.
 
> [!NOTE]
> If an application has multiple app roles, and more than one role of that application are in an access package, then the user will receive all those application's included roles. If instead you want users to only have some of the application's roles, then you'll need to create multiple access packages in the catalog, with separate access packages for each of the app roles.
 
In addition, applications can also rely upon security groups for expressing permissions. For example, an application might have a single app role `User` and also check the membership of two groups - a `Ordinary Users` group and a `Administrative Access` groups. A user of the application must be a member of exactly one of those two groups. If you wished to configure that users could request either permission, then you would put into a catalog three resources: the application, the group `Ordinary Users` and the group `Administrative Access`. Then, you would create in that catalog two access packages, and indicate each access package is [incompatible](entitlement-management-access-package-incompatible.md#scenarios-for-separation-of-duties-checks) with the other:
MODIFIED docs/identity/role-based-access-control/includes/application-administrator.md
Modified by Faith Moraa Ombongi on Jun 27, 2025 9:35 PM
📖 View on learn.microsoft.com
+5 / -5 lines changed
Commit: June 26 pass
Changes:
Before
After
ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: include
ms.date: 06/25/2025
ms.custom: include file
---
 
> | microsoft.directory/applications/authentication/update | Update authentication on all types of applications |
> | microsoft.directory/applications/basic/update | Update basic properties for applications |
> | microsoft.directory/applications/create | Create all types of applications |
> | microsoft.directory/applications/credentials/update | Update application credentials<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/applications/delete | Delete all types of applications |
> | microsoft.directory/applications/extensionProperties/update | Update extension properties on applications |
> | microsoft.directory/applications/notes/update | Update notes of applications |
> | microsoft.directory/connectorGroups/delete | Delete application proxy connector groups |
> | microsoft.directory/connectors/allProperties/read | Read all properties of application proxy connectors |
> | microsoft.directory/connectors/create | Create application proxy connectors |
> | microsoft.directory/customAuthenticationExtensions/allProperties/allTasks | Create and manage custom authentication extensions<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/deletedItems.applications/delete | Permanently delete applications, which can no longer be restored |
> | microsoft.directory/deletedItems.applications/restore | Restore soft deleted applications to original state |
ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: include
ms.date: 06/27/2025
ms.custom: include file
---
 
> | microsoft.directory/applications/authentication/update | Update authentication on all types of applications |
> | microsoft.directory/applications/basic/update | Update basic properties for applications |
> | microsoft.directory/applications/create | Create all types of applications |
> | microsoft.directory/applications/credentials/update | Update application credentials<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/applications/delete | Delete all types of applications |
> | microsoft.directory/applications/extensionProperties/update | Update extension properties on applications |
> | microsoft.directory/applications/notes/update | Update notes of applications |
> | microsoft.directory/connectorGroups/delete | Delete application proxy connector groups |
> | microsoft.directory/connectors/allProperties/read | Read all properties of application proxy connectors |
> | microsoft.directory/connectors/create | Create application proxy connectors |
> | microsoft.directory/customAuthenticationExtensions/allProperties/allTasks | Create and manage custom authentication extensions<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/deletedItems.applications/delete | Permanently delete applications, which can no longer be restored |
> | microsoft.directory/deletedItems.applications/restore | Restore soft deleted applications to original state |
MODIFIED docs/identity/role-based-access-control/permissions-reference.md
Modified by Faith Moraa Ombongi on Jun 27, 2025 9:35 PM
📖 View on learn.microsoft.com
+4 / -6 lines changed
Commit: June 26 pass
Changes:
Before
After
ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: reference
ms.date: 06/25/2025
ms.author: barclayn
ms.reviewer: abhijeetsinha
ms.custom: generated, it-pro, fasttrack-edit, has-azure-ad-ps-ref, azure-ad-ref-level-one-done, sfi-ga-nochange
> | [Authentication Administrator](#authentication-administrator) | Can access to view, set and reset authentication method information for any non-admin user.<br/>[![Privileged label icon.](./media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) | c4e39bd9-1100-46d3-8c65-fb160da0071f |
> | [Authentication Extensibility Administrator](#authentication-extensibility-administrator) | Customize sign in and sign up experiences for users by creating and managing custom authentication extensions.<br/>[![Privileged label icon.](./media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) | 25a516ed-2fa0-40ea-a2d0-12923a21473a |
> | [Authentication Policy Administrator](#authentication-policy-administrator) | Can create and manage the authentication methods policy, tenant-wide MFA settings, password protection policy, and verifiable credentials. | 0526716b-113d-4c15-b2c8-68e3c22b9f80 |
> | [Azure AD Joined Device Local Administrator](#azure-ad-joined-device-local-administrator) | Users assigned to this role are added to the local administrators group on Microsoft Entra joined devices. | 9f06204d-73c1-4d4c-880a-6edb90606fd8 |
> | [Azure DevOps Administrator](#azure-devops-administrator) | Can manage Azure DevOps policies and settings. | e3973bdf-4987-49ae-837a-ba8e231c7286 |
> | [Azure Information Protection Administrator](#azure-information-protection-administrator) | Can manage all aspects of the Azure Information Protection product. | 7495fdc4-34c4-4d15-a289-98788ce399fd |
> | [B2C IEF Keyset Administrator](#b2c-ief-keyset-administrator) | Can manage secrets for federation and encryption in the Identity Experience Framework (IEF).<br/>[![Privileged label icon.](./media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) | aaf43236-0c0d-4d5f-883a-6955382ac081 |
> | [Message Center Reader](#message-center-reader) | Can read messages and updates for their organization in Office 365 Message Center only. | 790c1fb9-7f7d-4f88-86a1-ef1f95c05c1b |
> | [Microsoft 365 Backup Administrator](#microsoft-365-backup-administrator) | Back up and restore content across supported services (SharePoint, OneDrive, and Exchange Online) in Microsoft 365 Backup | 1707125e-0aa2-4d4d-8655-a7c786c76a25 |
> | [Microsoft 365 Migration Administrator](#microsoft-365-migration-administrator) | Perform all migration functionality to migrate content to Microsoft 365 using Migration Manager. | 8c8b803f-96e1-4129-9349-20738d9f9652 |
> | [Microsoft Graph Data Connect Administrator](#microsoft-graph-data-connect-administrator) | Manage aspects of Microsoft Graph Data Connect service in a tenant. | ee67aa9c-e510-4759-b906-227085a7fd4d |
> | [Microsoft Hardware Warranty Administrator](#microsoft-hardware-warranty-administrator) | Create and manage all aspects warranty claims and entitlements for Microsoft manufactured hardware, like Surface and HoloLens. | 1501b917-7653-4ff9-a4b5-203eaf33784f |
> | [Microsoft Hardware Warranty Specialist](#microsoft-hardware-warranty-specialist) | Create and read warranty claims for Microsoft manufactured hardware, like Surface and HoloLens. | 281fe777-fb20-4fbb-b7a3-ccebce5b0d96 |
ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: reference
ms.date: 06/27/2025
ms.author: barclayn
ms.reviewer: abhijeetsinha
ms.custom: generated, it-pro, fasttrack-edit, has-azure-ad-ps-ref, azure-ad-ref-level-one-done, sfi-ga-nochange
> | [Authentication Administrator](#authentication-administrator) | Can access to view, set and reset authentication method information for any non-admin user.<br/>[![Privileged label icon.](./media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) | c4e39bd9-1100-46d3-8c65-fb160da0071f |
> | [Authentication Extensibility Administrator](#authentication-extensibility-administrator) | Customize sign in and sign up experiences for users by creating and managing custom authentication extensions.<br/>[![Privileged label icon.](./media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) | 25a516ed-2fa0-40ea-a2d0-12923a21473a |
> | [Authentication Policy Administrator](#authentication-policy-administrator) | Can create and manage the authentication methods policy, tenant-wide MFA settings, password protection policy, and verifiable credentials. | 0526716b-113d-4c15-b2c8-68e3c22b9f80 |
> | [Azure DevOps Administrator](#azure-devops-administrator) | Can manage Azure DevOps policies and settings. | e3973bdf-4987-49ae-837a-ba8e231c7286 |
> | [Azure Information Protection Administrator](#azure-information-protection-administrator) | Can manage all aspects of the Azure Information Protection product. | 7495fdc4-34c4-4d15-a289-98788ce399fd |
> | [B2C IEF Keyset Administrator](#b2c-ief-keyset-administrator) | Can manage secrets for federation and encryption in the Identity Experience Framework (IEF).<br/>[![Privileged label icon.](./media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) | aaf43236-0c0d-4d5f-883a-6955382ac081 |
> | [Message Center Reader](#message-center-reader) | Can read messages and updates for their organization in Office 365 Message Center only. | 790c1fb9-7f7d-4f88-86a1-ef1f95c05c1b |
> | [Microsoft 365 Backup Administrator](#microsoft-365-backup-administrator) | Back up and restore content across supported services (SharePoint, OneDrive, and Exchange Online) in Microsoft 365 Backup | 1707125e-0aa2-4d4d-8655-a7c786c76a25 |
> | [Microsoft 365 Migration Administrator](#microsoft-365-migration-administrator) | Perform all migration functionality to migrate content to Microsoft 365 using Migration Manager. | 8c8b803f-96e1-4129-9349-20738d9f9652 |
> | [Microsoft Entra Joined Device Local Administrator](#microsoft-entra-joined-device-local-administrator) | Users assigned to this role are added to the local administrators group on Microsoft Entra joined devices. | 9f06204d-73c1-4d4c-880a-6edb90606fd8 |
> | [Microsoft Graph Data Connect Administrator](#microsoft-graph-data-connect-administrator) | Manage aspects of Microsoft Graph Data Connect service in a tenant. | ee67aa9c-e510-4759-b906-227085a7fd4d |
> | [Microsoft Hardware Warranty Administrator](#microsoft-hardware-warranty-administrator) | Create and manage all aspects warranty claims and entitlements for Microsoft manufactured hardware, like Surface and HoloLens. | 1501b917-7653-4ff9-a4b5-203eaf33784f |
> | [Microsoft Hardware Warranty Specialist](#microsoft-hardware-warranty-specialist) | Create and read warranty claims for Microsoft manufactured hardware, like Surface and HoloLens. | 281fe777-fb20-4fbb-b7a3-ccebce5b0d96 |
MODIFIED docs/identity/role-based-access-control/includes/cloud-application-administrator.md
Modified by Faith Moraa Ombongi on Jun 27, 2025 9:35 PM
📖 View on learn.microsoft.com
+4 / -4 lines changed
Commit: June 26 pass
Changes:
Before
After
ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: include
ms.date: 06/25/2025
ms.custom: include file
---
 
> | microsoft.directory/applications/authentication/update | Update authentication on all types of applications |
> | microsoft.directory/applications/basic/update | Update basic properties for applications |
> | microsoft.directory/applications/create | Create all types of applications |
> | microsoft.directory/applications/credentials/update | Update application credentials<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/applications/delete | Delete all types of applications |
> | microsoft.directory/applications/extensionProperties/update | Update extension properties on applications |
> | microsoft.directory/applications/notes/update | Update notes of applications |
> | microsoft.directory/auditLogs/allProperties/read | Read all properties on audit logs, excluding custom security attributes audit logs |
> | microsoft.directory/deletedItems.applications/delete | Permanently delete applications, which can no longer be restored |
> | microsoft.directory/deletedItems.applications/restore | Restore soft deleted applications to original state |
> | microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks | Create and delete OAuth 2.0 permission grants, and read and update all properties<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/provisioningLogs/allProperties/read | Read all properties of provisioning logs |
> | microsoft.directory/servicePrincipals/appRoleAssignedTo/update | Update service principal role assignments |
ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: include
ms.date: 06/27/2025
ms.custom: include file
---
 
> | microsoft.directory/applications/authentication/update | Update authentication on all types of applications |
> | microsoft.directory/applications/basic/update | Update basic properties for applications |
> | microsoft.directory/applications/create | Create all types of applications |
> | microsoft.directory/applications/credentials/update | Update application credentials<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/applications/delete | Delete all types of applications |
> | microsoft.directory/applications/extensionProperties/update | Update extension properties on applications |
> | microsoft.directory/applications/notes/update | Update notes of applications |
> | microsoft.directory/auditLogs/allProperties/read | Read all properties on audit logs, excluding custom security attributes audit logs |
> | microsoft.directory/deletedItems.applications/delete | Permanently delete applications, which can no longer be restored |
> | microsoft.directory/deletedItems.applications/restore | Restore soft deleted applications to original state |
> | microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks | Create and delete OAuth 2.0 permission grants, and read and update all properties<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/provisioningLogs/allProperties/read | Read all properties of provisioning logs |
> | microsoft.directory/servicePrincipals/appRoleAssignedTo/update | Update service principal role assignments |
MODIFIED docs/identity/role-based-access-control/includes/cloud-device-administrator.md
Modified by Faith Moraa Ombongi on Jun 27, 2025 9:35 PM
📖 View on learn.microsoft.com
+4 / -4 lines changed
Commit: June 26 pass
Changes:
Before
After
ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: include
ms.date: 06/25/2025
ms.custom: include file
---
 
> | microsoft.azure.serviceHealth/allEntities/allTasks | Read and configure Azure Service Health |
> | microsoft.directory/auditLogs/allProperties/read | Read all properties on audit logs, excluding custom security attributes audit logs |
> | microsoft.directory/authorizationPolicy/standard/read | Read standard properties of authorization policy |
> | microsoft.directory/bitlockerKeys/key/read | Read bitlocker metadata and key on devices<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/deletedItems.devices/delete | Permanently delete devices, which can no longer be restored |
> | microsoft.directory/deletedItems.devices/restore | Restore soft deleted devices to original state |
> | microsoft.directory/deviceLocalCredentials/password/read | Read all properties of the backed up local administrator account credentials for Microsoft Entra joined devices, including the password |
> | microsoft.directory/deviceManagementPolicies/basic/update | Update basic properties on mobile device management and mobile app management policies<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/deviceManagementPolicies/standard/read | Read standard properties on mobile device management and mobile app management policies |
> | microsoft.directory/deviceRegistrationPolicy/basic/update | Update basic properties on device registration policies<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/deviceRegistrationPolicy/standard/read | Read standard properties on device registration policies |
> | microsoft.directory/devices/delete | Delete devices from Microsoft Entra ID |
> | microsoft.directory/devices/disable | Disable devices in Microsoft Entra ID |
ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: include
ms.date: 06/27/2025
ms.custom: include file
---
 
> | microsoft.azure.serviceHealth/allEntities/allTasks | Read and configure Azure Service Health |
> | microsoft.directory/auditLogs/allProperties/read | Read all properties on audit logs, excluding custom security attributes audit logs |
> | microsoft.directory/authorizationPolicy/standard/read | Read standard properties of authorization policy |
> | microsoft.directory/bitlockerKeys/key/read | Read bitlocker metadata and key on devices<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/deletedItems.devices/delete | Permanently delete devices, which can no longer be restored |
> | microsoft.directory/deletedItems.devices/restore | Restore soft deleted devices to original state |
> | microsoft.directory/deviceLocalCredentials/password/read | Read all properties of the backed up local administrator account credentials for Microsoft Entra joined devices, including the password |
> | microsoft.directory/deviceManagementPolicies/basic/update | Update basic properties on mobile device management and mobile app management policies<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/deviceManagementPolicies/standard/read | Read standard properties on mobile device management and mobile app management policies |
> | microsoft.directory/deviceRegistrationPolicy/basic/update | Update basic properties on device registration policies<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/deviceRegistrationPolicy/standard/read | Read standard properties on device registration policies |
> | microsoft.directory/devices/delete | Delete devices from Microsoft Entra ID |
> | microsoft.directory/devices/disable | Disable devices in Microsoft Entra ID |
MODIFIED docs/identity/role-based-access-control/includes/helpdesk-administrator.md
Modified by Faith Moraa Ombongi on Jun 27, 2025 9:35 PM
📖 View on learn.microsoft.com
+4 / -4 lines changed
Commit: June 26 pass
Changes:
Before
After
ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: include
ms.date: 06/25/2025
ms.custom: include file
---
 
> | --- | --- |
> | microsoft.azure.serviceHealth/allEntities/allTasks | Read and configure Azure Service Health |
> | microsoft.azure.supportTickets/allEntities/allTasks | Create and manage Azure support tickets |
> | microsoft.directory/bitlockerKeys/key/read | Read bitlocker metadata and key on devices<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/deviceLocalCredentials/standard/read | Read all properties of the backed up local administrator account credentials for Microsoft Entra joined devices, except the password |
> | microsoft.directory/users/invalidateAllRefreshTokens | Force sign-out by invalidating user refresh tokens<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.directory/users/password/update | Reset passwords for all users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) |
> | microsoft.office365.serviceHealth/allEntities/allTasks | Read and configure Service Health in the Microsoft 365 admin center |
> | microsoft.office365.supportTickets/allEntities/allTasks | Create and manage Microsoft 365 service requests |
> | microsoft.office365.webPortal/allEntities/standard/read | Read basic properties on all resources in the Microsoft 365 admin center |
ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: include
ms.date: 06/27/2025
ms.custom: include file
---
 
> | --- | --- |
> | microsoft.azure.serviceHealth/allEntities/allTasks | Read and configure Azure Service Health |
> | microsoft.azure.supportTickets/allEntities/allTasks | Create and manage Azure support tickets |
> | microsoft.directory/bitlockerKeys/key/read | Read bitlocker metadata and key on devices<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/deviceLocalCredentials/standard/read | Read all properties of the backed up local administrator account credentials for Microsoft Entra joined devices, except the password |
> | microsoft.directory/users/invalidateAllRefreshTokens | Force sign-out by invalidating user refresh tokens<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.directory/users/password/update | Reset passwords for all users<br/>[![Privileged label icon.](../media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) |
> | microsoft.office365.serviceHealth/allEntities/allTasks | Read and configure Service Health in the Microsoft 365 admin center |
> | microsoft.office365.supportTickets/allEntities/allTasks | Create and manage Microsoft 365 service requests |
> | microsoft.office365.webPortal/allEntities/standard/read | Read basic properties on all resources in the Microsoft 365 admin center |

🤖 This historical report was generated by the Entra Docs Monitor

🔗 Visit Repository

📅 ← Back to All Reports