3.1.1. Entra Roles and Effective Permissions
💡 First Principle: A role is a named bundle of directory permissions; assignment binds it to a principal at a scope. Least privilege means choosing the smallest sufficient bundle — and effective permissions means summing every bundle a principal holds before concluding what they can actually do.
The built-in roles you must distinguish on sight:
| Role | Can | Cannot (the discriminator) |
|---|---|---|
| Global Administrator | Everything in the directory | — (that's the problem; minimize + PIM) |
| User Administrator | Create/manage users & groups, reset passwords for non-admins and some admin roles | Reset passwords for most admins; manage apps or CA |
| Authentication Administrator | Reset non-admin passwords, manage users' auth methods (re-register MFA) | Privileged Authentication Admin powers (admins' methods) |
| Privileged Authentication Administrator | Manage auth methods/passwords for all users incl. admins | App management, CA |
| Application Administrator | Manage all app registrations & enterprise apps, incl. credentials | Directory roles, users |
| Cloud Application Administrator | Same as App Admin minus Application Proxy | App Proxy (needs on-prem reach) |
| Conditional Access Administrator | Manage CA policies and named locations | Users, apps |
| Privileged Role Administrator | Manage role assignments and PIM itself | (Effectively privileged — treat like GA) |
| Groups Administrator | Manage groups and group settings | Users' other properties |
| Helpdesk Administrator | Reset passwords for non-admins, monitor health | Create users |
| Global Reader | Read everything GA can read | Change anything |
Custom roles fill gaps: you compose granular microsoft.directory/... permissions (e.g., only users/basic/update) and assign at tenant scope, an administrative unit, or — for app-management roles — a single application object. Custom roles require P1; when a stem says "no built-in role matches; grant exactly these permissions," custom role is the answer.
Effective permissions is the union of all active assignments across roles (plus ownership rights — group owners and app owners have management power without any role). Evaluation questions hand you a user with two roles and ask what they can do: sum the bundles, remember deny doesn't exist in Entra roles (unlike Azure RBAC deny assignments), and check whether an assignment is PIM-eligible (no power until activated — Phase 5).
⚠️ Exam Trap: Application Administrator vs Cloud Application Administrator differ by exactly one thing — Application Proxy management. A scenario mentioning App Proxy connectors needs the former; "least privilege for managing cloud app registrations only" wants the latter.
Reflection Question: The helpdesk must re-register MFA for standard users after phone changes, but must never touch admin accounts. Which single built-in role fits, and which nearby role would violate least privilege?
