Configuring and Managing Built-In and Custom Microsoft Entra Roles

Entra ID roles are used to delegate permissions to perform tasks in Entra ID, Microsoft 365, and Azure. Many people are familiar with the Global Administrator role, as it is the first role that’s granted when you create a tenant. However, there are dozens of other roles available that can be used to provide a refined level of delegation throughout the environment. As the number of applications and services available in the Microsoft 365 ecosystem has grown, so has the number of security and administrative roles.

Roles for applications, services, and functions are intuitively named and generally split into two groups: Administrator and Reader. However, there are some roles that either don’t follow that nomenclature or have additional levels of permission associated with them (such as Printer Technician or Attack Simulator Payload Author).

The Global Administrator role can administer all parts of the tenant organization, including creating and modifying users or groups and delegating other administrative roles. In most cases, users with the Global Administrator role can access and modify all parts of an individual Microsoft 365 service—for example, editing Exchange transport rules, creating SharePoint Online sites, or setting up directory synchronization. Some features, such as eDiscovery, require specific roles in order to use them. Even though the Global Administrator role doesn’t have the ability to perform all tasks initially, the role does allow you to grant application- or workload-specific roles to enable their use.

Further reading

There are currently over 70 built-in administrative roles specific to Entra ID services and applications. For an up-to-date list of the roles available, see https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference.

For the SC-300 exam, you should be familiar with the core Microsoft 365 and Entra ID roles, as described in Table 1.2:

Table 1.2: Core Entra ID and Microsoft 365 roles

Planning for Role Assignments

One of the core tenets of security is the use of a least-privilege model. Least privilege means delegating the minimum level of permissions to accomplish a particular task, such as creating a user or resetting a password. In the context of Microsoft 365 and Entra ID, this translates to using the built-in roles for services, applications, and features where possible instead of granting the Global Administrator role. Limiting the administrative scope for services based on roles is commonly referred to as role-based access control (RBAC).

In order to help organizations plan for a least-privileged deployment, Microsoft currently maintains a list of least-privileged roles necessary to accomplish certain tasks, grouped by application or content area: https://learn.microsoft.com/en-us/azure/active-directory/roles/delegate-by-task. Related tasks are grouped into roles. These roles can then be assigned to users based on their job duties.

When planning for role assignments in your organization, you can choose to assign roles directly to users or via a specially designated Entra ID group. If you have several users that need a variety of roles, you may want to create a group to ease the administrative burden of adding multiple users to multiple roles.

If you want to create and use groups for role assignment, you must enable the group for role assignment (the Entra ID isAssignableToRole property) during the group creation. For example, when using the Azure portal to create a group as shown in Figure 1.4, the Azure AD roles can be assigned to the group toggle needs to be set to Yes in order for the group to be provisioned with that capability.

Note

The role assignment property cannot be updated once the group has been created. If you create a group that you want to be used for role assignment and you fail to set this option during group creation, you’ll need to delete the group and start over. This is to prevent privilege escalation attempts.

Figure 1.4: Configuring the isAssignableToRole property on a new group

If you want to create role-eligible groups in Entra ID, those groups must be configured to use assigned membership. As soon as you move the slider to enable a role-assignable group, the ability to change the membership type is grayed out to prevent accidentally elevating a user to a privileged role through a dynamic rule.

Managing Roles in the Microsoft 365 Admin Center

Roles can be easily managed within the Microsoft 365 admin center by expanding the navigation menu, expanding Roles, and then selecting Role assignments.

Figure 1.5: Role assignments

Roles are displayed across four tabs: Azure AD, Exchange, Intune, and Billing, as shown in Figure 1.6:

Figure 1.6: The Role assignments page

To add people to a role, simply select the role from the list, choose the Assigned tab, and then add either users or groups to the particular role.

Figure 1.7: Making role assignments

Depending on the role being granted through this interface, you may be able to use Microsoft 365 groups, role-assignable security groups, or mail-enabled security groups.

Managing Role Groups for Microsoft Defender, Microsoft Purview, and Microsoft 365 Workloads

Now that you’re familiar with role groups and concepts, you will learn how to manage roles for the following specific workload and feature areas of Microsoft 365:

• Microsoft Defender
• Microsoft Purview
• Microsoft 365 workloads

There are some nuances of managing each that are covered in the following sub-sections.

Microsoft Defender

Like other products in the Microsoft 365 suite, Defender uses roles to manage groups of permissions for tasks. All of the Microsoft Defender roles can be administered from either the Entra admin center (https://entra.microsoft.com) or the Azure portal (https://portal.azure.com). Both interfaces also provide the ability to define custom roles or role groups. Microsoft 365 Defender also has a new RBAC model available. The Microsoft 365 Defender RBAC model is in preview and is subject to change.

Microsoft 365 Defender users can be configured to use either the global Entra ID roles or custom roles from the Microsoft 365 Defender portal. When using Entra ID’s global roles to assign permissions for Microsoft 365 Defender, it’s important to note that the Entra ID roles will grant access to multiple workloads.

By default, Global Administrators and Security Administrators have access to Microsoft 365 Defender features. To delegate individual administrative duties where a broader Microsoft 365 Defender role might not be appropriate for your organization’s needs, you can use custom roles, as shown in Figure 1.8:

Figure 1.8: Microsoft 365 Defender permissions

To create a custom role, follow these steps:

1. Navigate to the Microsoft 365 Defender portal (https://security.microsoft.com) with an account that is either a member of Global Administrators or Security Administrators.
2. In the navigation menu, select Permissions.
3. Click Create custom role.
4. On the Basics page, enter a Role name value and click Next.

Figure 1.9: Creating a new custom role

5. Select permissions from the available permissions groups. For example, select Security Operations, then choose the Select all read-only permissions radio button as shown in Figure 1.10, and click Apply. Then, click Next.

Figure 1.10: Selecting permissions

6. On the Assignments page, click Add assignment.

Figure 1.11: Adding user and data assignments

7. On the Add assignment page, enter an Assignment name value for this permissions assignment.
8. On the Add assignment page, select the data sources to which this assignment applies. You can select Choose all data sources (including current and future supported data sources) to make a broadly scoped role or select specific individual data sources.
9. On the Add assignment page, select which users or groups will be configured with this assignment, as shown in Figure 1.12. Click Add when finished.

Figure 1.12: Selecting assignment options

10. Add any other assignments if necessary and then click Next to continue.
11. On the Review and finish page, confirm the selections and then click Submit. See Figure 1.13.

Figure 1.13: Confirming configuration

Once roles and assignments have been configured, users can log in and view or manage the features to which they’ve been granted permission.

Further reading

For more information on the nuances of the Microsoft 365 Defender custom roles and available permissions, see https://learn.microsoft.com/en-us/microsoft-365/security/defender/custom-permissions-details.

Next, you will explore the roles and permissions for Microsoft Purview.

Microsoft Purview

Like Microsoft 365 Defender, Microsoft Purview can leverage both Entra ID global roles (available throughout the Microsoft 365 platform) as well as roles and role groups specifically designed for Microsoft Purview that are only available in Microsoft Purview. Some features (such as eDiscovery) can only be configured using the Purview-specific roles.

You can view the global Entra ID roles by navigating to the Microsoft Purview compliance center, expanding Roles & scopes, selecting Permissions, and then selecting Roles under Azure AD. See Figure 1.14:

Figure 1.14: Azure AD roles in Microsoft Purview permissions

The Microsoft Purview-specific roles can be seen in the Microsoft Purview compliance center (https://compliance.microsoft.com) by expanding Roles & scopes, selecting Permissions, and then selecting Roles under Microsoft Purview solutions. See Figure 1.15:

Figure 1.15: Microsoft Purview solutions roles

Like Microsoft 365 Defender, you can also create custom role groups for Microsoft Purview solutions. Microsoft Purview roles also support scoping with administrative units. Currently, the following features support administrative units:

Solution or feature	Configuration areas
Data life cycle management	Retention policies, retention label policies, role groups
Data loss prevention (DLP)	DLP policies, role groups
Communications compliance	Adaptive scopes
Records management	Retention policies, retention label policies, adaptive scopes, role groups
Sensitivity labels	Sensitivity label policies, auto-labeling policies, role groups

Table 1.3: Microsoft Purview support for administrative units

Next, you will review role groups for Microsoft 365 workloads and how they can be managed.

Microsoft 365 Workloads

The core Microsoft 365 workloads, such as Exchange Online and SharePoint Online, have built-in support for a number of role groups. In the case of Exchange Online, there are additional management roles that can be assigned within the Exchange admin center’s existing RBAC mechanisms. They’re only visible inside the Exchange service and only apply to Exchange-specific features.

Figure 1.16: Microsoft 365 workload roles

While many workloads will have a single role group (such as Kaizala Administrator or SharePoint Administrator), some workloads such as Teams have multiple role groups that can be used to further delegate administration. You can review the current list of roles available in the Microsoft 365 admin center by navigating to the admin center (https://admin.microsoft.com), expanding Roles, and selecting Role assignments.

Next, we’ll explore the role administrative units play in delegated administration.