# RBACMap - Microsoft 365 RBAC Navigator

> Interactive visualization of 327 Microsoft 365 admin roles across 9 services. Free, open-source tool for finding least-privilege roles.

## About

RBACMap (https://rbacmap.com) is a free, open-source interactive tool that maps Microsoft 365 role-based access control (RBAC) roles. It helps IT administrators, security engineers, and compliance teams find the right least-privilege admin roles instead of over-using Global Administrator.

Created by Jacob Sheridan. Not affiliated with Microsoft.

## Key Features

- Interactive visual map of 327 Microsoft 365 admin roles across 9 services
- Role Builder: select tasks you need → get least-privilege role recommendations
- Role Comparison: compare permissions of multiple roles side-by-side
- Deep-linking: share direct URLs to any role or service view
- GDAP partner access awareness for Entra ID roles
- Role inheritance clarity showing which roles inherit from others
- License requirement guide for Microsoft 365 features
- Keyboard shortcuts for fast navigation

## Services Covered

RBACMap covers roles across these Microsoft 365 services:

### Microsoft Purview (108 roles, 18 categories)
URL: https://rbacmap.com/services/purview/

Categories: Global & Security Roles, eDiscovery, Audit, Records Management, Data Lifecycle Management, Communication Compliance, Purview Agents (Preview), Insider Risk Management, Data Loss Prevention, Information Protection, DSPM (Classic), DSPM (Preview), Privacy Management (Priva), Data Security Investigations.

Key roles include: Compliance Administrator, eDiscovery Manager, eDiscovery Administrator, Information Protection Administrator, Insider Risk Management Analyst, DLP Compliance Management, Records Management, Audit Manager, Communication Compliance Investigator, Privacy Management Administrator, Data Security Posture Management Administrator.

### Microsoft Entra ID (140 roles, 19 categories)
URL: https://rbacmap.com/services/entra/

Categories: Developer & Technical, B2C & External Identity, Hardware & Devices, Universal Print, Privileged Identity Management, Identity Protection, Identity Governance, Security & Compliance, Reporting & Knowledge, Global Secure Access, Conditional Access, Access Reviews, Entitlement Management, Teams Communication, Viva & Employee Experience, M365 & Platform Services, M365 Workloads & Services, Organizational Management, Remaining Built-in Roles.

Key roles include: Global Administrator, User Administrator, Security Administrator, Conditional Access Administrator, Privileged Role Administrator, Application Administrator, Authentication Administrator, Groups Administrator, Identity Governance Administrator, Cloud Application Administrator, Helpdesk Administrator, Exchange Administrator, SharePoint Administrator, Teams Administrator, Intune Administrator, Billing Administrator, License Administrator.

### Exchange Online (18 roles, 6 categories)
URL: https://rbacmap.com/services/exchange/

Categories: Organization Management, Recipient Management, Mail Flow, Compliance & Security, Permissions & Delegation, View-Only & Reporting.

Key roles include: Organization Management, Recipient Management, Mail Flow Administrator, Compliance Management, Help Desk, View-Only Organization Management, Discovery Management, Hygiene Management, Records Management.

### Microsoft Intune (11 roles, 6 categories)
URL: https://rbacmap.com/services/intune/

Categories: Device & Endpoint Management, Application Management, Support & Operations, Endpoint Privilege Management, Role Administration, Cloud PC (Windows 365).

Key roles include: Intune Administrator, Endpoint Security Manager, Help Desk Operator, Application Manager, Read Only Operator, Endpoint Privilege Manager, Cloud PC Administrator.

### SharePoint & OneDrive (16 roles, 6 categories)
URL: https://rbacmap.com/services/sharepoint/

Categories: Tenant Administration, Site Management, Content & Permissions, Sharing & External Access, OneDrive Management, Advanced Management.

Key roles include: SharePoint Administrator, Site Collection Administrator, Hub Site Administrator, Term Store Administrator, SharePoint Advanced Management Administrator.

### Microsoft Defender XDR (7 roles, 4 categories)
URL: https://rbacmap.com/services/defender/

Categories: Security Operations, Security Detections, XDR System Administration, Security Posture Management.

Key roles include: Security Administrator, Security Operator, Security Reader, Security Posture Management.

Defender uses the Unified RBAC model with custom permissions across workloads including Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, and Defender Vulnerability Management. RBACMap maps suggested role compositions for common Defender scenarios — these are guidance compositions, not Microsoft built-in role groups.

### Microsoft Fabric (8 roles, 4 categories)
URL: https://rbacmap.com/services/fabric/

Categories: Tenant Administration, Capacity Administration, Workspace Roles, Governance Domains.

Key roles include: Fabric Administrator (tenant), Capacity Administrator (per-capacity), Workspace Admin / Member / Contributor / Viewer (per-workspace), Domain Admin / Domain Contributor (governance domain). Fabric is built on OneLake; workspaces are the primary unit of permission and govern access to data engineering, data warehousing, real-time intelligence, data science, and BI workloads.

### Microsoft Security Copilot (3 roles, 2 categories)
URL: https://rbacmap.com/services/copilotsec/

Categories: Platform Roles, Bootstrap & Entry-Point Roles.

Key roles include: Copilot Owner, Copilot Contributor, Security Administrator (bootstrap entry-point — used to provision the Security Copilot tenant before native roles take over).

### Microsoft Power Platform (14 roles, 3 categories)
URL: https://rbacmap.com/services/powerplatform/

Categories: Tenant Administration, Environment Roles, Dataverse Security Roles.

Key roles include: Power Platform Administrator, Dynamics 365 Administrator, Power Apps Administrator, Environment Admin, Environment Maker, and the Dataverse security roles (System Administrator, System Customizer, Basic User, Delegate, App Opener, Office Collaborator, Support User, Website Owner). Covers Power Apps, Power Automate, Power BI, Power Pages, and Dataverse.

## Role Builder (Least-Privilege Recommendations)

The Role Builder helps find the minimum-permission roles for specific tasks:

1. Select the tasks you need to perform (from 49 task categories)
2. RBACMap's algorithm recommends the least-privilege role combination
3. Review permission coverage and privilege level scores

Task categories include: eDiscovery operations, audit log management, DLP policy management, sensitivity label management, insider risk investigation, records management, identity management, conditional access, application management, device management, mail flow administration, SharePoint site management, security operations, and many more.

URL: https://rbacmap.com (click Role Builder or press B)

## URL Deep-Linking

Share direct links to any role or service. Clean paths are the canonical URLs (use these when citing); legacy `?service=` / `?role=` query strings still work via 301 redirects.

- Service view: https://rbacmap.com/services/entra/
- Specific role: https://rbacmap.com/roles/entra-ca-admin/
- Pre-filled search: https://rbacmap.com/?search=compliance

## Common Questions

### What is the least privilege role for managing Microsoft Purview compliance?
Use specific roles like Compliance Administrator for policies, eDiscovery Manager for investigations, or Information Protection Administrator for sensitivity labels. Avoid Global Administrator. Use the Role Builder to find minimum permissions for your specific tasks.

### What Microsoft 365 admin roles are available in Entra ID?
Microsoft Entra ID includes 140 built-in admin roles across 19 categories including Identity Management, Security, Application Management, Conditional Access, Tenant Governance, Entra Backup, and more. Key roles include Global Administrator, User Administrator, Security Administrator, Conditional Access Administrator, and Privileged Role Administrator.

### How do I find the right Microsoft 365 admin role for a specific task?
Use RBACMap's Role Builder: select the tasks you need to perform (like managing users, configuring compliance policies, or administering Exchange), and the tool recommends the least-privilege roles that cover those permissions.

### What is the difference between Global Administrator and other Microsoft 365 admin roles?
Global Administrator has unrestricted access to all Microsoft 365 services. Other roles follow least-privilege principles: Exchange Administrator only manages Exchange, SharePoint Administrator only manages SharePoint, etc. Microsoft recommends limiting Global Administrators to 2-4 per organization.

### What roles are needed for eDiscovery in Microsoft 365?
For eDiscovery: eDiscovery Manager can run searches and manage cases; eDiscovery Administrator has full eDiscovery access including managing other users' cases; Content Search role provides search-only access. These roles are in Microsoft Purview.

### What roles manage sensitivity labels?
Information Protection Administrator in Microsoft Purview can create, configure, and publish sensitivity labels. Information Protection Reader provides read-only access. Information Protection Analyst can view DLP alerts and activity.

### What is GDAP in Microsoft 365?
Granular Delegated Admin Privileges (GDAP) allows Microsoft partners to access customer tenants with specific, limited roles. RBACMap shows which Entra ID roles support GDAP and which workloads they can access (15 workloads mapped for 40+ roles).

### How many admin roles does Microsoft 365 have?
RBACMap currently maps 327 admin roles across 9 Microsoft 365 services: approximately 140 in Entra ID, 108 in Purview, 18 in Exchange Online, 16 in SharePoint/OneDrive, 11 in Intune, 7 suggested Defender XDR role compositions, 14 in Power Platform, 8 in Microsoft Fabric, and 3 in Microsoft Security Copilot (plus 2 cross-service global roles surfaced on the M365 hub).

### What is RBAC in Microsoft 365?
RBAC (Role-Based Access Control) is a security model where administrators are assigned specific roles granting only the permissions needed for their job functions. This implements least privilege, reducing security risks. Each Microsoft 365 service has its own built-in roles.

### Which role can manage Conditional Access policies?
The Conditional Access Administrator role in Entra ID can create, modify, and delete Conditional Access policies. Security Administrator also has this capability but with broader permissions. For read-only access, use Security Reader.

### What roles are needed for Microsoft Defender XDR?
Defender XDR uses Unified RBAC. Security Administrator has broad access, Security Operator can manage incidents and take response actions, Security Reader has view-only access. Granular permissions are available for Defender for Endpoint, Office 365, Identity, Cloud Apps, and Vulnerability Management.

### What role manages Microsoft Intune devices?
Intune Administrator (or Intune Service Administrator in Entra) has full access to Microsoft Intune. For least privilege, use Endpoint Security Manager for security policies, Help Desk Operator for remote actions, or Application Manager for app deployment.

## For More Details

- Full documentation: https://rbacmap.com/llms-full.txt
- Live tool: https://rbacmap.com
- Source code: https://github.com/AzureJSheridan/purview-map