Recognize the roles in Azure Active Directory

Ganesh Chauhan, Technical Support Specialist, Microsoft Azure.

There are around 60 built-in roles in Azure Active Directory (Azure AD), which are roles with a predetermined set of rights. Azure AD now enables bespoke roles in addition to the built-in roles. Choose the role permissions you want by using custom roles. For instance, you may establish one to manage specific Azure AD resources, like applications or service principles.


What Azure AD roles are and how to use them are described in this article.

How the responsibilities in Azure AD differ from those in Microsoft 365

Microsoft 365 offers a wide range of services, including Azure AD and Intune. These services, specifically some of them, have their own role-based access control systems, including:

  • Azure Active Directory (Azure AD)
  • Microsoft Exchange
  • Microsoft Intune
  • Microsoft Defender for Cloud Apps
  • Microsoft 365 Defender portal
  • Compliance portal
  • Cost Management + Billing


Role-based access control systems are not different from other services like Teams, SharePoint, and Managed Desktop. They gain administrative access through Azure AD roles. In contrast to Azure AD roles, Azure offers its own role-based access control mechanism for resources like virtual machines.


Role-based access control is a different system. It implies that the definitions and allocations of roles are kept in a distinct data store. The decision point for access checks in a policy also differs. See Azure roles, Azure AD roles, and Roles for Microsoft 365 services in Administrator roles in Azure AD and Classic Subscription for further details.

What causes some Azure AD roles to be for other services?

Every role-based access control system in Microsoft 365 has its own service portal. These systems independently evolved over time. We have included some service-specific built-in roles that each allow administrative access to a Microsoft 365 service in order to make it simple for you to manage identity across Microsoft 365 from the Azure interface. The Azure AD Exchange Administrator position is one illustration of this development. This position, which has full Exchange management capabilities, corresponds to the Organization Management role group in the Exchange role-based access control system. In a similar manner, we also added the Administrator roles for Teams, SharePoint, and Intune. In the section that follows, one category of built-in roles for Azure AD is called “service-specific roles.”

Role categories in Azure AD

Roles related to Azure AD: These roles only provide access to manage resources within Azure AD. For instance, permissions to administer resources located in Azure AD are granted by User Administrator, Application Administrator, and Groups Administrator.

Service-specific roles: We have created service-specific roles for the main Microsoft 365 services (non-Azure AD) that grant access to handle every feature of the service. Examples of roles that can manage features with their associated services include Exchange Administrator, Intune Administrator, SharePoint Administrator, and Teams Administrator. Mailboxes can be managed by Exchange administrators, device policies can be managed by Intune administrators, site collections can be managed by SharePoint administrators, call quality can be managed by Teams administrators, and so on.

Roles that cross services: Some roles do so. Worldwide Administrator and Global Reader are our two global positions. These two duties are respected by every Microsoft 365 service. Additionally, some security-related positions like Security Administrator and Security Reader inside Microsoft 365 provide access to various security services. You can control the Microsoft 365 Defender portal, Microsoft Defender Advanced Threat Protection, and Microsoft Defender for Cloud Apps, for instance, using the Security Administrator roles in Azure AD. Similar to this, the Compliance Administrator role allows you to control settings for the Compliance portal, Exchange, and other places.


To help with comprehension of various role classifications, the following table is provided. The categories’ names are arbitrary and aren’t meant to indicate any capabilities other than those listed in the corresponding Azure AD role permissions.

Category Role
Azure AD-specific roles Application Administrator
Application Developer
Authentication Administrator
B2C IEF Keyset Administrator
B2C IEF Policy Administrator
Cloud Application Administrator
Cloud Device Administrator
Conditional Access Administrator
Device Administrators
Directory Readers
Directory Synchronization Accounts
Directory Writers
External ID User Flow Administrator
External ID User Flow Attribute Administrator
External Identity Provider Administrator
Groups Administrator
Guest Inviter
Helpdesk Administrator
Hybrid Identity Administrator
License Administrator
Partner Tier1 Support
Partner Tier2 Support
Password Administrator
Privileged Authentication Administrator
Privileged Role Administrator
Reports Reader
User Administrator
Cross-service roles Global Administrator
Compliance Administrator
Compliance Data Administrator
Global Reader
Security Administrator
Security Operator
Security Reader
Service Support Administrator
Service-specific roles Azure DevOps Administrator
Azure Information Protection Administrator
Billing Administrator
CRM Service Administrator
Customer Lockbox Access Approver
Desktop Analytics Administrator
Exchange Service Administrator
Insights Administrator
Insights Business Leader
Intune Service Administrator
Kaizala Administrator
Lync Service Administrator
Message Center Privacy Reader
Message Center Reader
Modern Commerce User
Network Administrator
Office Apps Administrator
Power BI Service Administrator
Power Platform Administrator
Printer Administrator
Printer Technician
Search Administrator
Search Editor
SharePoint Service Administrator
Teams Communications Administrator
Teams Communications Support Engineer
Teams Communications Support Specialist
Teams Devices Administrator
Teams Administrator

Professional Labs is the Best Cloud Managed Services Provider in Qatar, for more details contact
Contact Us | Professional labs (