Azure Information Protection Administrator

Management PlaneEntraOps · EAMSecurity

Dado verificado em 30/06/2026 · Fonte

Role Actions

Control Plane

Management Plane

User Access

Template ID

7495fdc4-34c4-4d15-a289-98788ce399fd

Categoria

Security

EAM Tier

Management Plane (Tier 1)

Enterprise Access Model: Management Plane

Funcoes de gestao de TI enterprise-wide. Alto impacto, mas sem controle total do tenant.

Esta role é classificada como Management Plane porque 6 de 7 ações (86%) são desse tier — o tier da role acompanha sempre a ação de maior privilégio, não o conjunto.

6 Management Plane1 User Access

Descrição

Can manage all aspects of the Azure Information Protection product.

Role Definition (JSON)

{
  "@odata.type": "#microsoft.graph.unifiedRoleDefinition",
  "id": "7495fdc4-34c4-4d15-a289-98788ce399fd",
  "displayName": "Azure Information Protection Administrator",
  "description": "Can manage all aspects of the Azure Information Protection product.",
  "isBuiltIn": true,
  "isEnabled": true,
  "isPrivileged": false,
  "rolePermissions": [
    {
      "allowedResourceActions": [
        "microsoft.azure.informationProtection/allEntities/allTasks",

Permissões completas

Todas as 7 role actions desta role, classificadas por tier do EAM.

Role Action	Categoria	Tier
`microsoft.azure.informationProtection/allEntities/allTasks`	Microsoft Information Protection	Tier 1
`microsoft.azure.serviceHealth/allEntities/allTasks`	Support and Service Health	Tier 1
`microsoft.azure.supportTickets/allEntities/allTasks`	Support and Service Health	Tier 1
`microsoft.office365.serviceHealth/allEntities/allTasks`	Microsoft 365 Support Operations	Tier 1
`microsoft.office365.supportTickets/allEntities/allTasks`	Microsoft 365 Support Operations	Tier 1
`microsoft.office365.webPortal/allEntities/standard/read`	Microsoft 365 Support Operations	Tier 1
`microsoft.directory/authorizationPolicy/standard/read`	Default member	Tier 2

7 de 7 role actions

PowerShell

Get-MgRoleManagementDirectoryRoleDefinition `
  -UnifiedRoleDefinitionId "7495fdc4-34c4-4d15-a289-98788ce399fd"

Microsoft Graph

GET https://graph.microsoft.com/v1.0/
  roleManagement/directory/
  roleDefinitions/7495fdc4-34c4-4d15-a289-98788ce399fd

Ver a documentação oficial na Microsoft Learn

Roles relacionadas

Attack Payload Author

Tier 1Security

Attack Simulation Administrator

Tier 1Security

Customer Lockbox Access Approver

Tier 1Security

Network Administrator

Tier 1Security

Purview Workload Content Administrator

Tier 1Security