Roles with tenant admin access

This document defines all of the roles with tenant admin access, which grant permission to the tenant scope view.

For descriptions of each role, see Microsoft Entra built-in roles.

Role
Application Administrator
Authentication Administrator
Authentication Policy Administrator
Azure Information Protection Administrator
B2C IEF Keyset Administrator
B2C IEF Policy Administrator
Billing Administrator
Cloud App Security Administrator
Cloud Application Administrator
Cloud Device Administrator
Compliance Administrator
Compliance Data Administrator
Conditional Access Administrator
Customer LockBox Access Approver
Desktop Analytics Administrator
Directory Reviewer
Domain Name Administrator
Dynamics 365 Administrator
Exchange Administrator
Exchange Recipient Administrator
External ID User Flow Administrator
External ID User Flow Attribute Administrator
External Identity Provider Administrator
Global Administrator
Global Reader
Groups Administrator
Helpdesk Administrator
Hybrid Identity Administrator
Identity Governance Administrator
Insights Administrator
Intune Administrator
Kaizala Administrator
Knowledge Administrator
License Administrator
Message Center Privacy Reader
Message Center Reader
Network Administrator
Office Apps Administrator
Password Administrator
Power BI Administrator
Power Platform Administrator
Privileged Authentication Administrator
Privileged Role Administrator
Reports Reader
Search Administrator
Security Administrator
Security Operator
Security Reader
Service Support Administrator
SharePoint Administrator
Skype for Business Administrator
Teams Administrator
Teams Communications Administrator
Teams Communications Support Engineer
Teams Communications Support Specialist
Teams Devices Administrator
User Administrator