Groups Administrator

Control PlaneEntraOps · EAMIdentity

Dado verificado em 30/06/2026 · Fonte

Role Actions

Control Plane

Management Plane

User Access

Template ID

fdd7a751-b60b-444a-984c-02652fe8fa1c

Categoria

Identity

EAM Tier

Control Plane (Tier 0)

Enterprise Access Model: Control Plane

Controle total do tenant. Comprometimento leva a takeover completo. Isole de planos inferiores.

Esta role é classificada como Control Plane porque 20 de 26 ações (77%) são desse tier — o tier da role acompanha sempre a ação de maior privilégio, não o conjunto.

20 Control Plane6 Management Plane

Descrição

Members of this role can create/manage groups, create/manage groups settings like naming and expiration policies, and view groups activity and audit reports.

Role Definition (JSON)

{
  "@odata.type": "#microsoft.graph.unifiedRoleDefinition",
  "id": "fdd7a751-b60b-444a-984c-02652fe8fa1c",
  "displayName": "Groups Administrator",
  "description": "Members of this role can create/manage groups, create/manage groups settings like naming and expiration policies, and view groups activity and audit reports.",
  "isBuiltIn": true,
  "isEnabled": true,
  "isPrivileged": false,
  "rolePermissions": [
    {
      "allowedResourceActions": [
        "microsoft.directory/bulkJobs.groups/basic/update",

Permissões completas

Todas as 26 role actions desta role, classificadas por tier do EAM.

Role Action	Categoria	Tier
`microsoft.directory/bulkJobs.groups/basic/update`	Group Management	Tier 0
`microsoft.directory/bulkJobs.groups/create`	Group Management	Tier 0
`microsoft.directory/bulkJobs.groups/standard/read`	Group Management	Tier 0
`microsoft.directory/deletedItems.groups/delete`	Group Management	Tier 0
`microsoft.directory/deletedItems.groups/restore`	Group Management	Tier 0
`microsoft.directory/groups/assignLicense`	License Management	Tier 0
`microsoft.directory/groups/assignedLabels/update`	Group Management	Tier 0
`microsoft.directory/groups/basic/update`	Group Management	Tier 0
`microsoft.directory/groups/classification/update`	Group Management	Tier 0
`microsoft.directory/groups/create`	Group Management	Tier 0
`microsoft.directory/groups/delete`	Group Management	Tier 0
`microsoft.directory/groups/dynamicMembershipRule/update`	Group Management	Tier 0
`microsoft.directory/groups/groupType/update`	Group Management	Tier 0
`microsoft.directory/groups/members/update`	Group Management	Tier 0
`microsoft.directory/groups/onPremWriteBack/update`	Group Management	Tier 0
`microsoft.directory/groups/owners/update`	Group Management	Tier 0
`microsoft.directory/groups/reprocessLicenseAssignment`	License Management	Tier 0
`microsoft.directory/groups/restore`	Group Management	Tier 0
`microsoft.directory/groups/settings/update`	Group Management	Tier 0
`microsoft.directory/groups/visibility/update`	Group Management	Tier 0
`microsoft.azure.serviceHealth/allEntities/allTasks`	Support and Service Health	Tier 1
`microsoft.azure.supportTickets/allEntities/allTasks`	Support and Service Health	Tier 1
`microsoft.directory/groups/hiddenMembers/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.office365.serviceHealth/allEntities/allTasks`	Microsoft 365 Support Operations	Tier 1
`microsoft.office365.supportTickets/allEntities/allTasks`	Microsoft 365 Support Operations	Tier 1
`microsoft.office365.webPortal/allEntities/standard/read`	Microsoft 365 Support Operations	Tier 1

26 de 26 role actions

PowerShell

Get-MgRoleManagementDirectoryRoleDefinition `
  -UnifiedRoleDefinitionId "fdd7a751-b60b-444a-984c-02652fe8fa1c"

Microsoft Graph

GET https://graph.microsoft.com/v1.0/
  roleManagement/directory/
  roleDefinitions/fdd7a751-b60b-444a-984c-02652fe8fa1c

Ver a documentação oficial na Microsoft Learn

Roles relacionadas

Agent ID Administrator

Tier 0Identity

Agent ID Developer

Tier 0Identity

Agent Registry Administrator

Tier 0Identity

Directory Synchronization Accounts

Tier 0Identity

Directory Writers

Tier 0Identity