Field Notes · Sheet 14 / 30 · Privileged access
Least-privileged role by task
Eight common admin tasks and the smallest built-in Entra role that covers each, toward Microsoft's target of fewer than five Global Administrators.
Bradley Baker · · 1 min read
Microsoft recommends giving Global Administrator to fewer than five people. Getting there mostly means knowing which smaller role covers each request. This is the longer version of Sheet 14.
Eight tasks, eight roles
| Task | Least-privileged role |
|---|---|
| Reset passwords for non-admin users | Password Administrator |
| Create and manage users | User Administrator |
| Manage groups | Groups Administrator |
| Manage Conditional Access policies | Conditional Access Administrator |
| Manage enterprise applications | Cloud Application Administrator |
| Create app registrations when users can't | Application Developer |
| Read sign-in and audit logs | Reports Reader |
| Assign licenses | License Administrator |
Two numbers to aim for
The same guidance says to keep privileged role assignments under 10 and to use PIM for just-in-time access. Put the smaller role behind PIM and most admin work happens without anyone holding a standing privileged role. Sheet 12 walks through what an activation does.
Every Global Administrator you remove is one fewer account that can take over the whole tenant.
Sources
- Least privileged roles by task in Microsoft Entra IDlearn.microsoft.com
- Best practices for Microsoft Entra roleslearn.microsoft.com
From the field reports
- Entra ID
- Least privilege
- Built-in roles
- Global Administrator
- Azure PIM