Microsoft Entra roles
What it is
Microsoft Entra roles grant permission to manage identity-directory objects and settings: users, groups, applications, devices, domains, and tenant-wide identity features. They are distinct from Azure RBAC roles, which grant permission to manage Azure resources such as VMs and storage accounts.
Why it exists
An organization needs to delegate work such as resetting a password or managing an application without making every helper a Global Administrator. Entra built-in roles provide narrower directory permissions.
Key ideas
- Examples: Global Administrator manages all aspects of Entra ID and Microsoft services that use Entra identities; User Administrator manages users; Password Administrator resets eligible passwords; Application Administrator manages app registrations and enterprise apps; Groups Administrator manages groups and group settings.
- Scope: many roles are tenant-wide. Some can be scoped to an administrative unit, limiting which directory objects the administrator manages.
- Separate plane: Entra User Administrator does not grant access to a VM or storage account. Those actions require Azure RBAC at the appropriate Azure scope.
- Least privilege: use the narrowest role that accomplishes the delegated task, and reserve Global Administrator for the few people who truly need it.
Northwind example
Priya in the Northwind help desk receives a suitable directory role to reset eligible user passwords. She does not receive Global Administrator or Azure VM Contributor. When a developer needs to manage an Azure resource, Maya gives a separate Azure RBAC assignment at the smallest relevant scope. One person can hold both kinds of role, but one does not automatically create the other.
How it fits (diagram)
Diagrams courtesy of Microsoft Learn / Azure docs: entra/identity/role-based-access-control/rbac-and-directory-admin-roles
Exam notes
- Entra roles authorize the directory and identity plane; Azure RBAC authorizes Azure resources.
- Global Administrator is highly privileged; it is not an Azure
Ownerassignment.
Related
entraid · rbac · user-account · conditional-access