Microsoft Entra ID

Permissions Reference

14 October 2026Feature update+1 / −1 lines

In brief

The permissions reference now states that Application Developer role holders can update applications they own, in addition to creating application registrations independently of the user registration setting.

What Entra admins need to know

Review this role’s assignment and scope when assessing who can modify applications.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

| AI Administrator | Manage all aspects of Microsoft Copilot and AI-related enterprise services in Microsoft 365.
| d2562ede-74db-457e-a7b6-544e236ebb61 | | AI Reader | Read all aspects of Microsoft Copilot and AI-related enterprise services in Microsoft 365.
| 1fe13547-53f6-408d-ac04-7f8eed167b38 | | Application Administrator | Can create and manage all aspects of app registrations and enterprise apps.
| 9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3 | | Application Developer | Can create application registrations independent of the 'Users can register applications' ~~setting.~~setting and update applications they own.
| cf1c38e5-3621-4004-a7cb-879624dced7c | | Attack Payload Author | Can create attack payloads that an administrator can initiate later. | 9c6df0f2-1e7c-4dc3-b195-66dfbd24aa8f | | Attack Simulation Administrator | Can create and manage all aspects of attack simulation campaigns. | c430b396-e693-46cc-96f3-db01bf8bb62a | | Attribute Assignment Administrator | Assign custom security attribute keys and values to supported Microsoft Entra objects. | 58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d |

@@ -29,7 +29,7 @@ This article lists the permissions used by **built-in** roles. Only a subset of > | [AI Administrator](#ai-administrator) | Manage all aspects of Microsoft Copilot and AI-related enterprise services in Microsoft 365.<br/>[![Privileged label icon.](./media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) | d2562ede-74db-457e-a7b6-544e236ebb61 | > | [AI Reader](#ai-reader) | Read all aspects of Microsoft Copilot and AI-related enterprise services in Microsoft 365.<br/>[![Privileged label icon.](./media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) | 1fe13547-53f6-408d-ac04-7f8eed167b38 | > | [Application Administrator](#application-administrator) | Can create and manage all aspects of app registrations and enterprise apps.<br/>[![Privileged label icon.](./media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) | 9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3 |-> | [Application Developer](#application-developer) | Can create application registrations independent of the 'Users can register applications' setting.<br/>[![Privileged label icon.](./media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) | cf1c38e5-3621-4004-a7cb-879624dced7c |+> | [Application Developer](#application-developer) | Can create application registrations independent of the 'Users can register applications' setting and update applications they own.<br/>[![Privileged label icon.](./media/permissions-reference/privileged-label.png)](privileged-roles-permissions.md) | cf1c38e5-3621-4004-a7cb-879624dced7c | > | [Attack Payload Author](#attack-payload-author) | Can create attack payloads that an administrator can initiate later. | 9c6df0f2-1e7c-4dc3-b195-66dfbd24aa8f | > | [Attack Simulation Administrator](#attack-simulation-administrator) | Can create and manage all aspects of attack simulation campaigns. | c430b396-e693-46cc-96f3-db01bf8bb62a | > | [Attribute Assignment Administrator](#attribute-assignment-administrator) | Assign custom security attribute keys and values to supported Microsoft Entra objects. | 58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d |