Microsoft Entra roles
What it is
Microsoft Entra (formerly Azure AD) roles govern permissions on the identity/directory plane — managing users, groups, apps, tenants, and directory-wide settings. They are distinct from RBAC roles, which govern the Azure resource plane.
Why it exists
Operating a tenant requires delegating directory-level administration (create users, reset passwords, manage groups, configure SSPR/MFA) without handing out Global Administrator to everyone. Entra built-in roles scope that delegation.
Key ideas
- Examples — Global Administrator, Application Administrator, User Administrator, Password Administrator, Group Administrator, and [more built-in roles].
- Scope — roles apply at directory level (whole tenant) or, with [administrative units][scopeable roles], to a subset.
- Distinct from RBAC — granting Entra User Administrator does not grant rights to Azure resources (VMs, storage); those need RBAC. The two planes are separate.
- Least privilege — use the most specific role (e.g. Password Administrator vs Global Administrator).
How it fits (diagram)
Diagrams courtesy of Microsoft Learn / Azure docs: entra/identity/role-based-access-control/rbac-and-directory-admin-roles
Exam notes
- This is a classic AZ-104 differentiator: Entra roles authorize the direct / M365/identity plane; RBAC authorizes Azure resources.
- Know the purpose of common roles and that Global Administrator is the equivalent of Entra “owner.”
- Assign to groups, exclude break-glass accounts from Conditional Access.
Related
entraid · rbac · user-account · conditional-access
📘 Source: Microsoft Learn — Azure Ad Roles