Roles with tenant admin access
This document defines all of the roles with tenant admin access, which grant permission to the tenant scope view.
For descriptions of each role, see Microsoft Entra built-in roles.
| Role |
|---|
| Application Administrator |
| Authentication Administrator |
| Authentication Policy Administrator |
| Azure Information Protection Administrator |
| B2C IEF Keyset Administrator |
| B2C IEF Policy Administrator |
| Billing Administrator |
| Cloud App Security Administrator |
| Cloud Application Administrator |
| Cloud Device Administrator |
| Compliance Administrator |
| Compliance Data Administrator |
| Conditional Access Administrator |
| Customer LockBox Access Approver |
| Desktop Analytics Administrator |
| Directory Reviewer |
| Domain Name Administrator |
| Dynamics 365 Administrator |
| Exchange Administrator |
| Exchange Recipient Administrator |
| External ID User Flow Administrator |
| External ID User Flow Attribute Administrator |
| External Identity Provider Administrator |
| Global Administrator |
| Global Reader |
| Groups Administrator |
| Helpdesk Administrator |
| Hybrid Identity Administrator |
| Identity Governance Administrator |
| Insights Administrator |
| Intune Administrator |
| Kaizala Administrator |
| Knowledge Administrator |
| License Administrator |
| Message Center Privacy Reader |
| Message Center Reader |
| Network Administrator |
| Office Apps Administrator |
| Password Administrator |
| Power BI Administrator |
| Power Platform Administrator |
| Privileged Authentication Administrator |
| Privileged Role Administrator |
| Reports Reader |
| Search Administrator |
| Security Administrator |
| Security Operator |
| Security Reader |
| Service Support Administrator |
| SharePoint Administrator |
| Skype for Business Administrator |
| Teams Administrator |
| Teams Communications Administrator |
| Teams Communications Support Engineer |
| Teams Communications Support Specialist |
| Teams Devices Administrator |
| User Administrator |