Troubleshoot Microsoft Entra roles assigned to groups

Privileged Role Administrators can create a group that's eligible for role assignment. Users with this role can see this switch.

By default, Privileged Role Administrator manage the membership of a role-assignable group, but you can delegate the management of role-assignable groups by adding group owners.

The user might have gotten Directory Readers by way of a role-assignable group. All members and owners of role-assignable groups are protected. Users with the Privileged Authentication Administrator role can reset credentials for a protected user.

The user could be an owner of a role-assignable group. We protect owners of role-assignable groups to avoid elevation of privilege. An example might be if a group Contoso_Security_Admins is assigned to Security Administrator role, where Bob is the group owner and Alice is Password Administrator in the organization. If this protection weren't present, Alice could reset Bob's credentials and take over his identity. After that, Alice could add herself or anyone to the group Contoso_Security_Admins group to become a Security Administrator in the organization. To find out if a user is a group owner, get the list of owned objects of that user and see if any of the groups have isAssignableToRole set to true. If yes, then that user is protected and the behavior is by design. Refer to these documentations for getting owned objects:

• Get-MgUserOwnedObject
• List ownedObjects

Yes, you can. Privileged Role Administrators can create access reviews on role-assignable groups.

Yes, you can. User Administrator has the permissions to put any group in an access package. Nothing changes for Global Administrator, but there's a slight change in User Administrator role permissions. To put a role-assignable group into an access package, you must be a User Administrator and also owner of the role-assignable group. Here's the full table showing who can create access package in Enterprise License Management:

*Group isn't role-assignable; that is, isAssignableToRole = false. If a group is role-assignable, then the person creating the access package must also be owner of the role-assignable group.

This answer is applicable only to Microsoft Entra ID P1 organizations.

1. Sign in to the Microsoft Entra admin center as at least a Privileged Role Administrator.
2. Browse to Identity > Users > All users.
3. Select a user.
4. Select Assigned roles.
5. Select a role assignment you want to remove.
6. Select Remove assignments to remove direct role assignments.

To remove indirect role assignments, remove the user from the group that has been assigned the role.

Follow these steps:

1. Sign in to the Microsoft Entra admin center.
2. Browse to Identity > Groups > All groups.
3. Select Add filters.
4. Filter to Role assignable.

Follow these steps:

1. Sign in to the Microsoft Entra admin center.
2. Browse to Identity > Users > All users.
3. Select a user.
4. Select Assigned roles.
5. If you have a Microsoft Entra ID P1 license, view the Assignment Path column.
6. If you have a Microsoft Entra ID P2 license, view the Membership column.

If you assign an existing group to a role, the existing group owner could add other members to this group without the new members realizing that they'll have the role. Because role-assignable groups are powerful, we're putting lots of restrictions to protect them. You don't want changes to the group that would be surprising to the person managing the group.

Next steps

• Use Microsoft Entra groups to manage role assignments
• Create a role-assignable group