Privileged Authentication Administrator

Privilegiada

Control PlaneEntraOps · EAMSecurity

Dado verificado em 30/06/2026 · Fonte

Role Actions

Control Plane

Management Plane

User Access

Template ID

7be44c8a-adaf-4e2a-84d6-ab2649e08a13

Categoria

Security

EAM Tier

Control Plane (Tier 0)

Enterprise Access Model: Control Plane

Controle total do tenant. Comprometimento leva a takeover completo. Isole de planos inferiores.

Esta role é classificada como Control Plane porque 14 de 20 ações (70%) são desse tier — o tier da role acompanha sempre a ação de maior privilégio, não o conjunto.

14 Control Plane6 Management Plane

Descrição

Can access to view, set and reset authentication method information for any user (admin or non-admin).

Role Definition (JSON)

{
  "@odata.type": "#microsoft.graph.unifiedRoleDefinition",
  "id": "7be44c8a-adaf-4e2a-84d6-ab2649e08a13",
  "displayName": "Privileged Authentication Administrator",
  "description": "Can access to view, set and reset authentication method information for any user (admin or non-admin).",
  "isBuiltIn": true,
  "isEnabled": true,
  "isPrivileged": true,
  "rolePermissions": [
    {
      "allowedResourceActions": [
        "microsoft.directory/deletedItems.users/restore",

Permissões completas

Todas as 20 role actions desta role, classificadas por tier do EAM.

Role Action	Categoria	Tier
`microsoft.directory/deletedItems.users/restore`	Global User Management	Tier 0
`microsoft.directory/users/authenticationMethods/basic/update`	Global User Management	Tier 0
`microsoft.directory/users/authenticationMethods/create`	Global User Management	Tier 0
`microsoft.directory/users/authenticationMethods/delete`	Global User Management	Tier 0
`microsoft.directory/users/authorizationInfo/update`	Global User Management	Tier 0
`microsoft.directory/users/basic/update`	Global User Management	Tier 0
`microsoft.directory/users/delete`	Global User Management	Tier 0
`microsoft.directory/users/disable`	Global User Management	Tier 0
`microsoft.directory/users/enable`	Global User Management	Tier 0
`microsoft.directory/users/invalidateAllRefreshTokens`	Global User Management	Tier 0
`microsoft.directory/users/manager/update`	Global User Management	Tier 0
`microsoft.directory/users/password/update`	Global User Management	Tier 0
`microsoft.directory/users/restore`	Global User Management	Tier 0
`microsoft.directory/users/userPrincipalName/update`	Global User Management	Tier 0
`microsoft.azure.serviceHealth/allEntities/allTasks`	Support and Service Health	Tier 1
`microsoft.azure.supportTickets/allEntities/allTasks`	Support and Service Health	Tier 1
`microsoft.directory/users/authenticationMethods/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.office365.serviceHealth/allEntities/allTasks`	Microsoft 365 Support Operations	Tier 1
`microsoft.office365.supportTickets/allEntities/allTasks`	Microsoft 365 Support Operations	Tier 1
`microsoft.office365.webPortal/allEntities/standard/read`	Microsoft 365 Support Operations	Tier 1

20 de 20 role actions

PowerShell

Get-MgRoleManagementDirectoryRoleDefinition `
  -UnifiedRoleDefinitionId "7be44c8a-adaf-4e2a-84d6-ab2649e08a13"

Microsoft Graph

GET https://graph.microsoft.com/v1.0/
  roleManagement/directory/
  roleDefinitions/7be44c8a-adaf-4e2a-84d6-ab2649e08a13

Ver a documentação oficial na Microsoft Learn

Roles relacionadas

Authentication Administrator

Tier 0Security

Authentication Extensibility Administrator

Tier 0Security

Authentication Extensibility Password Administrator

Tier 0Security

Authentication Policy Administrator

Tier 0Security

B2C IEF Keyset Administrator

Tier 0Security