Device Managers

Control PlaneEntraOps · EAMDevice

Dado verificado em 30/06/2026 · Fonte

Role Actions

Control Plane

Management Plane

User Access

Template ID

2b499bcd-da44-4968-8aec-78e1674fa64d

Categoria

Device

EAM Tier

Control Plane (Tier 0)

Enterprise Access Model: Control Plane

Controle total do tenant. Comprometimento leva a takeover completo. Isole de planos inferiores.

Esta role é classificada como Control Plane porque 6 de 10 ações (60%) são desse tier — o tier da role acompanha sempre a ação de maior privilégio, não o conjunto.

6 Control Plane4 User Access

Descrição

Legacy role that grants users the ability to manage settings on Microsoft Entra ID-joined devices. Users are added as local administrators on managed devices.

Role Definition (JSON)

{
  "@odata.type": "#microsoft.graph.unifiedRoleDefinition",
  "id": "2b499bcd-da44-4968-8aec-78e1674fa64d",
  "displayName": "Device Managers",
  "description": "Legacy role that grants users the ability to manage settings on Microsoft Entra ID-joined devices. Users are added as local administrators on managed devices.",
  "isBuiltIn": true,
  "isEnabled": true,
  "isPrivileged": false,
  "rolePermissions": [
    {
      "allowedResourceActions": [
        "microsoft.directory/devices/basic/update",

Permissões completas

Todas as 10 role actions desta role, classificadas por tier do EAM.

Role Action	Categoria	Tier
`microsoft.directory/devices/basic/update`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/extensionAttributeSet1/update`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/extensionAttributeSet2/update`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/extensionAttributeSet3/update`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/registeredOwners/update`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/registeredUsers/update`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/memberOf/read`	Default member	Tier 2
`microsoft.directory/devices/registeredOwners/read`	Default member	Tier 2
`microsoft.directory/devices/registeredUsers/read`	Default member	Tier 2
`microsoft.directory/devices/standard/read`	Default member	Tier 2

10 de 10 role actions

PowerShell

Get-MgRoleManagementDirectoryRoleDefinition `
  -UnifiedRoleDefinitionId "2b499bcd-da44-4968-8aec-78e1674fa64d"

Microsoft Graph

GET https://graph.microsoft.com/v1.0/
  roleManagement/directory/
  roleDefinitions/2b499bcd-da44-4968-8aec-78e1674fa64d

Ver a documentação oficial na Microsoft Learn

Roles relacionadas

Microsoft Entra Joined Device Local Administrator

Tier 0Device

Cloud Device Administrator

Tier 0Device

Intune Administrator

Tier 0Device

IoT Device Administrator

Tier 0Device

AI Administrator

Tier 0Microsoft 365