Attribute Assignment Administrator

Control PlaneEntraOps · EAMCompliance

Dado verificado em 30/06/2026 · Fonte

Role Actions

Control Plane

Management Plane

User Access

Template ID

58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d

Categoria

Compliance

EAM Tier

Control Plane (Tier 0)

Enterprise Access Model: Control Plane

Controle total do tenant. Comprometimento leva a takeover completo. Isole de planos inferiores.

Esta role é classificada como Control Plane porque 9 de 10 ações (90%) são desse tier — o tier da role acompanha sempre a ação de maior privilégio, não o conjunto.

9 Control Plane1 Management Plane

Descrição

Assign custom security attribute keys and values to supported Microsoft Entra objects.

Role Definition (JSON)

{
  "@odata.type": "#microsoft.graph.unifiedRoleDefinition",
  "id": "58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d",
  "displayName": "Attribute Assignment Administrator",
  "description": "Assign custom security attribute keys and values to supported Microsoft Entra objects.",
  "isBuiltIn": true,
  "isEnabled": true,
  "isPrivileged": false,
  "rolePermissions": [
    {
      "allowedResourceActions": [
        "microsoft.directory/attributeSets/allProperties/read",

Permissões completas

Todas as 10 role actions desta role, classificadas por tier do EAM.

Role Action	Categoria	Tier
`microsoft.directory/attributeSets/allProperties/read`	Privileged ABAC	Tier 0
`microsoft.directory/azureManagedIdentities/customSecurityAttributes/update`	Privileged ABAC	Tier 0
`microsoft.directory/customSecurityAttributeDefinitions/allProperties/read`	Privileged ABAC	Tier 0
`microsoft.directory/devices/customSecurityAttributes/read`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/customSecurityAttributes/update`	Privileged ABAC	Tier 0
`microsoft.directory/servicePrincipals/customSecurityAttributes/read`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/customSecurityAttributes/update`	Application and Workload Identity	Tier 0
`microsoft.directory/users/customSecurityAttributes/read`	Global User Management	Tier 0
`microsoft.directory/users/customSecurityAttributes/update`	Global User Management	Tier 0
`microsoft.directory/azureManagedIdentities/customSecurityAttributes/read`	Tenant Configuration (Reader)	Tier 1

10 de 10 role actions

PowerShell

Get-MgRoleManagementDirectoryRoleDefinition `
  -UnifiedRoleDefinitionId "58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d"

Microsoft Graph

GET https://graph.microsoft.com/v1.0/
  roleManagement/directory/
  roleDefinitions/58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d

Ver a documentação oficial na Microsoft Learn

Roles relacionadas

Attribute Assignment Reader

Tier 0Compliance

Attribute Definition Administrator

Tier 0Compliance

Attribute Definition Reader

Tier 0Compliance

Attribute Log Administrator

Tier 0Compliance

Attribute Provisioning Administrator

Tier 0Compliance