What is the least privilege role for managing Microsoft Purview compliance?

For Microsoft Purview, use specific roles like Compliance Administrator for policies, eDiscovery Manager for investigations, or Information Protection Administrator for sensitivity labels. Avoid Global Administrator - use RBACMap's Role Builder to find the minimum permissions needed for your specific tasks.

What Microsoft 365 admin roles are available in Entra ID?

Microsoft Entra ID includes 143 mapped admin roles across 19 categories including Identity Management, Security, Conditional Access, Application Management, Identity Governance, and more. Key roles include Global Administrator, User Administrator, Security Administrator, Conditional Access Administrator, and Privileged Role Administrator.

How do I find the right Microsoft 365 admin role for a specific task?

Use RBACMap's Role Builder feature: select the tasks you need to perform (like managing users, configuring compliance policies, or administering Exchange), and the tool recommends the least-privilege roles that cover those permissions. This helps implement zero-trust principles by avoiding over-privileged accounts.

What is the difference between Global Administrator and other Microsoft 365 admin roles?

Global Administrator has unrestricted access to all Microsoft 365 services and can manage any setting. Other roles follow least-privilege principles: Exchange Administrator only manages Exchange, SharePoint Administrator only manages SharePoint, etc. Microsoft recommends limiting Global Administrators to 2-4 per organization and using service-specific roles for daily administration.

What roles are needed to manage Microsoft Defender XDR?

Microsoft Defender XDR uses Unified RBAC with roles like Security Administrator, Security Operator, and Security Reader. Specific permissions include managing incidents, configuring detection rules, and accessing threat analytics. The Security Administrator role in Entra ID grants broad Defender access, while more granular control is available through Defender's built-in role assignments.

How many admin roles does Microsoft 365 have?

RBACMap maps 328 Microsoft 365 role and responsibility entries across nine services. It separately catalogs 504 Azure built-in roles across 19 categories; 462 independently approved Azure roles currently participate in Role Builder, comparison, grounded chat, full LLM export, and indexing.

What is RBAC in Microsoft 365?

RBAC (Role-Based Access Control) in Microsoft 365 is a security model where administrators are assigned specific roles that grant only the permissions needed for their job functions. This implements the principle of least privilege, reducing security risks from over-privileged accounts. Each Microsoft 365 service (Entra ID, Purview, Exchange, etc.) has its own set of built-in roles.

Which role can manage sensitivity labels in Microsoft 365?

To manage sensitivity labels, use the Information Protection Administrator role in Microsoft Purview. This role can create, configure, and publish sensitivity labels without requiring Global Administrator access. For read-only access to label configurations, use Information Protection Reader.

Which role can manage Conditional Access policies in Microsoft 365?

The Conditional Access Administrator role in Entra ID can create, modify, and delete Conditional Access policies. Security Administrator also has this capability but with broader permissions. For read-only access, use Security Reader. RBACMap shows the full permission details for each role.

What roles are needed for eDiscovery in Microsoft 365?

For Microsoft 365 eDiscovery: eDiscovery Manager can run searches and manage cases within Microsoft Purview. eDiscovery Administrator has full access including managing other users' cases. Content Search role provides search-only capability. These are Purview compliance roles, not Entra ID roles.

What is GDAP and which roles support it?

Granular Delegated Admin Privileges (GDAP) allows Microsoft partners to access customer tenants with specific, limited Entra ID roles instead of full Delegated Admin Privileges (DAP). Over 40 Entra ID roles support GDAP across 15 workloads including Exchange, SharePoint, Intune, and Security. RBACMap shows GDAP compatibility for each Entra role.

What role manages Microsoft Intune devices?

Intune Administrator (also called Intune Service Administrator in Entra ID) has full access to Microsoft Intune. For least privilege, use Endpoint Security Manager for security policies, Help Desk Operator for remote actions on devices, or Application Manager for app deployment only.

What is the difference between Exchange Administrator and Organization Management in Exchange Online?

Exchange Administrator is an Entra ID role that grants access to Exchange Online administration. Organization Management is an Exchange Online RBAC role group with the broadest permissions within Exchange. Exchange Administrator maps to Organization Management in Exchange. For least privilege, use specific Exchange roles like Recipient Management or Mail Flow Administrator.

How do I implement least privilege for Microsoft 365 administration?

To implement least privilege: 1) Identify specific admin tasks needed, 2) Use RBACMap's Role Builder to find the minimum integrated roles required, 3) Prefer job-function roles over broad administrator roles, 4) Assign at the narrowest practical scope, and 5) Use Privileged Identity Management (PIM) for just-in-time human access where available.

Microsoft 365 & Azure RBAC Role Library

Microsoft 365 and Azure RBAC Role Library