Microsoft Entra ID
GeneralLeast privileged roles by task
In brief
The task delegation table now maps identity containment actions for SOC incident response to the Entra SOC Identity Responder role.
What Entra admins need to know
Administrators can identify the appropriate role for delegating SOC identity containment actions. No action is required.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Task Least privileged role Additional roles Dismiss all events Security Administrator Perform identity containment actions for SOC incident response Entra SOC Identity Responder Read all configuration Security Reader Read users flagged for risk Security Reader
@@ -2,7 +2,7 @@ title: Least privileged roles by task description: Least privileged roles to delegate for tasks in Microsoft Entra ID ms.topic: reference-ms.date: 06/20/2025+ms.date: 06/17/2026 ms.custom: it-pro, sfi-ga-nochange #Customer intent: As a Microsoft Entra administrator, I want to know which role has the least privilege for a given task to make my Microsoft Entra organization more secure. ---@@ -451,6 +451,7 @@ Here are the least privileged roles you should use when performing tasks for [us > | Task | Least privileged role | Additional roles | > | ---- | --------------------- | ---------------- | > | Dismiss all events | [Security Administrator](permissions-reference.md#security-administrator) | |+> | Perform identity containment actions for SOC incident response | [Entra SOC Identity Responder](permissions-reference.md#entra-soc-identity-responder) | | > | Read all configuration | [Security Reader](permissions-reference.md#security-reader) | | > | Read users flagged for risk | [Security Reader](permissions-reference.md#security-reader) | |