IoT Device Administrator

Control PlaneEntraOps · EAMDevice

Dado verificado em 30/06/2026 · Fonte

Role Actions

Control Plane

Management Plane

User Access

Template ID

2ea5ce4c-b2d8-4668-bd81-3680bd2d227a

Categoria

Device

EAM Tier

Control Plane (Tier 0)

Enterprise Access Model: Control Plane

Controle total do tenant. Comprometimento leva a takeover completo. Isole de planos inferiores.

Esta role é classificada como Control Plane porque todas as suas 10 ações são desse tier.

10 Control Plane

Descrição

Provision new IoT devices, manage their lifecycle, configure certificates, and manage device templates.

Role Definition (JSON)

{
  "@odata.type": "#microsoft.graph.unifiedRoleDefinition",
  "id": "2ea5ce4c-b2d8-4668-bd81-3680bd2d227a",
  "displayName": "IoT Device Administrator",
  "description": "Provision new IoT devices, manage their lifecycle, configure certificates, and manage device templates.",
  "isBuiltIn": true,
  "isEnabled": true,
  "isPrivileged": false,
  "rolePermissions": [
    {
      "allowedResourceActions": [
        "microsoft.directory/certificateBasedDeviceAuthConfigurations/create",

Permissões completas

Todas as 10 role actions desta role, classificadas por tier do EAM.

Role Action	Categoria	Tier
`microsoft.directory/certificateBasedDeviceAuthConfigurations/create`	Global Endpoint Management	Tier 0
`microsoft.directory/certificateBasedDeviceAuthConfigurations/credentials/update`	Global Endpoint Management	Tier 0
`microsoft.directory/certificateBasedDeviceAuthConfigurations/delete`	Global Endpoint Management	Tier 0
`microsoft.directory/certificateBasedDeviceAuthConfigurations/standard/read`	Global Endpoint Management	Tier 0
`microsoft.directory/deviceTemplates/create`	Global Endpoint Management	Tier 0
`microsoft.directory/deviceTemplates/createDeviceFromTemplate`	Global Endpoint Management	Tier 0
`microsoft.directory/deviceTemplates/delete`	Global Endpoint Management	Tier 0
`microsoft.directory/deviceTemplates/deviceInstances/read`	Global Endpoint Management	Tier 0
`microsoft.directory/deviceTemplates/owners/read`	Global Endpoint Management	Tier 0
`microsoft.directory/deviceTemplates/owners/update`	Global Endpoint Management	Tier 0

10 de 10 role actions

PowerShell

Get-MgRoleManagementDirectoryRoleDefinition `
  -UnifiedRoleDefinitionId "2ea5ce4c-b2d8-4668-bd81-3680bd2d227a"

Microsoft Graph

GET https://graph.microsoft.com/v1.0/
  roleManagement/directory/
  roleDefinitions/2ea5ce4c-b2d8-4668-bd81-3680bd2d227a

Ver a documentação oficial na Microsoft Learn

Roles relacionadas

Microsoft Entra Joined Device Local Administrator

Tier 0Device

Cloud Device Administrator