Hybrid Identity Administrator

Privilegiada

Control PlaneEntraOps · EAMIdentity

Dado verificado em 30/06/2026 · Fonte

Role Actions

Control Plane

Management Plane

User Access

Template ID

8ac3fc64-6eca-42ea-9e69-59f4c7b60eb2

Categoria

Identity

EAM Tier

Control Plane (Tier 0)

Enterprise Access Model: Control Plane

Controle total do tenant. Comprometimento leva a takeover completo. Isole de planos inferiores.

Esta role é classificada como Control Plane porque 44 de 61 ações (72%) são desse tier — o tier da role acompanha sempre a ação de maior privilégio, não o conjunto.

44 Control Plane17 Management Plane

Descrição

Manage Active Directory to Microsoft Entra cloud provisioning, Microsoft Entra Connect, pass-through authentication (PTA), password hash synchronization (PHS), seamless single sign-on (seamless SSO), and federation settings. Does not have access to manage Microsoft Entra Connect Health.

Role Definition (JSON)

{
  "@odata.type": "#microsoft.graph.unifiedRoleDefinition",
  "id": "8ac3fc64-6eca-42ea-9e69-59f4c7b60eb2",
  "displayName": "Hybrid Identity Administrator",
  "description": "Manage Active Directory to Microsoft Entra cloud provisioning, Microsoft Entra Connect, pass-through authentication (PTA), password hash synchronization (PHS), seamless single sign-on (seamless SSO), and federation settings. Does not have access to manage Microsoft Entra Connect Health.",
  "isBuiltIn": true,
  "isEnabled": true,
  "isPrivileged": true,
  "rolePermissions": [
    {
      "allowedResourceActions": [
        "microsoft.directory/applicationTemplates/instantiate",

Permissões completas

Todas as 61 role actions desta role, classificadas por tier do EAM.

Role Action	Categoria	Tier
`microsoft.directory/applicationTemplates/instantiate`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/appRoles/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/audience/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/authentication/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/create`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/delete`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/disablement/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/notes/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/owners/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/permissions/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/policies/update`	Tenant Policy Management	Tier 0
`microsoft.directory/applications/tag/update`	Application and Workload Identity	Tier 0
`microsoft.directory/cloudProvisioning/allProperties/allTasks`	User Lifecycle and Provisioning Management	Tier 0
`microsoft.directory/deletedItems.applications/delete`	Application and Workload Identity	Tier 0
`microsoft.directory/deletedItems.applications/restore`	Application and Workload Identity	Tier 0
`microsoft.directory/domains/federation/update`	Authentication	Tier 0
`microsoft.directory/domains/federationConfiguration/basic/update`	Authentication	Tier 0
`microsoft.directory/domains/federationConfiguration/create`	Authentication	Tier 0
`microsoft.directory/domains/federationConfiguration/delete`	Authentication	Tier 0
`microsoft.directory/hybridAuthenticationPolicy/allProperties/allTasks`	Authentication	Tier 0
`microsoft.directory/onPremisesSynchronization/basic/update`	Hybrid Identity Synchronization	Tier 0
`microsoft.directory/organization/dirSync/update`	User Lifecycle and Provisioning Management	Tier 0
`microsoft.directory/passwordHashSync/allProperties/allTasks`	Authentication	Tier 0
`microsoft.directory/servicePrincipals/appRoleAssignedTo/update`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/audience/update`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/authentication/update`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/create`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/delete`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/enable`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/notes/update`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/owners/update`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/permissions/update`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/policies/update`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/credentials/manage`	User Lifecycle and Provisioning Management	Tier 0
`microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/jobs/manage`	User Lifecycle and Provisioning Management	Tier 0
`microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/schema/manage`	User Lifecycle and Provisioning Management	Tier 0
`microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/credentials/manage`	User Lifecycle and Provisioning Management	Tier 0
`microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/jobs/manage`	User Lifecycle and Provisioning Management	Tier 0
`microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/schema/manage`	User Lifecycle and Provisioning Management	Tier 0
`microsoft.directory/servicePrincipals/synchronizationCredentials/manage`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/synchronizationJobs/manage`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/synchronizationSchema/manage`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/tag/update`	Application and Workload Identity	Tier 0
`microsoft.directory/users/authorizationInfo/update`	Global User Management	Tier 0
`microsoft.azure.serviceHealth/allEntities/allTasks`	Support and Service Health	Tier 1
`microsoft.azure.supportTickets/allEntities/allTasks`	Support and Service Health	Tier 1
`microsoft.directory/applications/basic/update`	Application and Workload Identity	Tier 1
`microsoft.directory/applications/synchronization/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/auditLogs/allProperties/read`	Security and Compliance	Tier 1
`microsoft.directory/domains/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/domains/federationConfiguration/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/onPremisesSynchronization/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/provisioningLogs/allProperties/read`	Security and Compliance	Tier 1
`microsoft.directory/servicePrincipals/basic/update`	Application and Workload Identity	Tier 1
`microsoft.directory/servicePrincipals/disable`	Application and Workload Identity	Tier 1
`microsoft.directory/servicePrincipals/synchronization/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/signInReports/allProperties/read`	Security and Compliance	Tier 1
`microsoft.office365.messageCenter/messages/read`	Microsoft 365 Support Operations	Tier 1
`microsoft.office365.serviceHealth/allEntities/allTasks`	Microsoft 365 Support Operations	Tier 1
`microsoft.office365.supportTickets/allEntities/allTasks`	Microsoft 365 Support Operations	Tier 1
`microsoft.office365.webPortal/allEntities/standard/read`	Microsoft 365 Support Operations	Tier 1

61 de 61 role actions

PowerShell

Get-MgRoleManagementDirectoryRoleDefinition `
  -UnifiedRoleDefinitionId "8ac3fc64-6eca-42ea-9e69-59f4c7b60eb2"

Microsoft Graph

GET https://graph.microsoft.com/v1.0/
  roleManagement/directory/
  roleDefinitions/8ac3fc64-6eca-42ea-9e69-59f4c7b60eb2

Ver a documentação oficial na Microsoft Learn

Roles relacionadas

Agent ID Administrator

Tier 0Identity

Agent ID Developer

Tier 0Identity

Agent Registry Administrator

Tier 0Identity

Directory Synchronization Accounts

Tier 0Identity

Directory Writers

Tier 0Identity