Cloud Device Administrator

Privilegiada

Control PlaneEntraOps · EAMDevice

Dado verificado em 30/06/2026 · Fonte

Role Actions

Control Plane

Management Plane

User Access

Template ID

7698a772-787b-4ac8-901f-60d6b08affd2

Categoria

Device

EAM Tier

Control Plane (Tier 0)

Enterprise Access Model: Control Plane

Controle total do tenant. Comprometimento leva a takeover completo. Isole de planos inferiores.

Esta role é classificada como Control Plane porque 12 de 19 ações (63%) são desse tier — o tier da role acompanha sempre a ação de maior privilégio, não o conjunto.

12 Control Plane6 Management Plane1 User Access

Descrição

Limited access to manage devices in Microsoft Entra ID.

Role Definition (JSON)

{
  "@odata.type": "#microsoft.graph.unifiedRoleDefinition",
  "id": "7698a772-787b-4ac8-901f-60d6b08affd2",
  "displayName": "Cloud Device Administrator",
  "description": "Limited access to manage devices in Microsoft Entra ID.",
  "isBuiltIn": true,
  "isEnabled": true,
  "isPrivileged": true,
  "rolePermissions": [
    {
      "allowedResourceActions": [
        "microsoft.directory/bitlockerKeys/key/read",

Permissões completas

Todas as 19 role actions desta role, classificadas por tier do EAM.

Role Action	Categoria	Tier
`microsoft.directory/bitlockerKeys/key/read`	Global Endpoint Bitlocker Recovery	Tier 0
`microsoft.directory/deletedItems.devices/delete`	Global Endpoint Management	Tier 0
`microsoft.directory/deletedItems.devices/restore`	Global Endpoint Management	Tier 0
`microsoft.directory/deviceLocalCredentials/password/read`	Global Endpoint Local Admin	Tier 0
`microsoft.directory/deviceManagementPolicies/basic/update`	Global Endpoint Management	Tier 0
`microsoft.directory/deviceRegistrationPolicy/basic/update`	Global Endpoint Management	Tier 0
`microsoft.directory/deviceTemplates/owners/read`	Global Endpoint Management	Tier 0
`microsoft.directory/deviceTemplates/owners/update`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/delete`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/disable`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/enable`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/permissions/update`	Global Endpoint Management	Tier 0
`microsoft.azure.serviceHealth/allEntities/allTasks`	Support and Service Health	Tier 1
`microsoft.directory/auditLogs/allProperties/read`	Security and Compliance	Tier 1
`microsoft.directory/deviceManagementPolicies/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/deviceRegistrationPolicy/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/signInReports/allProperties/read`	Security and Compliance	Tier 1
`microsoft.office365.serviceHealth/allEntities/allTasks`	Microsoft 365 Support Operations	Tier 1
`microsoft.directory/authorizationPolicy/standard/read`	Default member	Tier 2

19 de 19 role actions

PowerShell

Get-MgRoleManagementDirectoryRoleDefinition `
  -UnifiedRoleDefinitionId "7698a772-787b-4ac8-901f-60d6b08affd2"

Microsoft Graph

GET https://graph.microsoft.com/v1.0/
  roleManagement/directory/
  roleDefinitions/7698a772-787b-4ac8-901f-60d6b08affd2

Ver a documentação oficial na Microsoft Learn

Roles relacionadas

Microsoft Entra Joined Device Local Administrator

IoT Device Administrator

Tier 0Device

AI Administrator

Tier 0Microsoft 365