Query on permissions

Question

Hi All

I have two requirements. I want to create a separate Role for a group users who can access service health in Microsoft 365 admin center and these users also should be able to open case with Microsoft Support in Microsoft 365 admin center. Please guide me, for the second requirement is it enough if i provide these users access to service support administrator role.

Answer 1

@Rising Flight

Thank you for posting this in Microsoft Q&A.

As per your requirement you need 2 specific permissions for user to access service health in Microsoft 365 admin center and also this user should be able to open case with Microsoft Support.

As Vasil Michev mentioned there is a default role in Entra ID "Service Support Administrator".

This role holds below permissions,

Actions	Description
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health
microsoft.azure.serviceHealth/allEntities/allTasks	Read and configure Azure Service Health
microsoft.azure.supportTickets/allEntities/allTasks	Create and manage Azure support tickets
microsoft.office365.network/performance/allProperties/read	Read all network performance properties in the Microsoft 365 admin center
microsoft.office365.serviceHealth/allEntities/allTasks	Read and configure Service Health in the Microsoft 365 admin center
microsoft.office365.supportTickets/allEntities/allTasks	Create and manage Microsoft 365 service requests
microsoft.office365.webPortal/allEntities/standard/read	Read basic properties on all resources in the Microsoft 365 admin center

Permissions that you are looking for are both available in this role. You can also refer below article,

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#service-support-administrator

If you want to only these 2 permissions for a specific role then currently this is not available in custom role. Entra ID custom roles are still worked upon by our PG team and they are still working on adding some more permission to user scope.

Let me know if you have any further questions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Both requirements can be met by assigning the Service support administrator role.