Microsoft Entra ID · M365 Workloads & Services
Microsoft Graph Data Connect Administrator
Manages Microsoft Graph Data Connect settings including dataset configuration and application authorization.
Scope: Full administration of Microsoft Graph Data Connect
Permissions
- Enable/disable Data Connect
- Configure dataset workloads
- Manage cross-tenant data movement
- Approve application requests
- Manage app registrations
Common use cases
- Data pipeline configuration
- Analytics enablement
- Application authorization
- Cross-tenant data governance
- Bulk data access management
Best practices
- Review applications carefully
- Limit data exposure
- Monitor data movement
- Document approvals
Security considerations
- Bulk data access is sensitive
- Cross-tenant implications
- Application trust assessment
- PII exposure risk
Common questions
When should I assign the Microsoft Graph Data Connect Administrator role?
Assign Microsoft Graph Data Connect Administrator when you need to: Data pipeline configuration; Analytics enablement; Application authorization; Cross-tenant data governance; and Bulk data access management. It is part of Microsoft Entra ID and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the Microsoft Graph Data Connect Administrator role do?
The Microsoft Graph Data Connect Administrator role grants permissions including: Enable/disable Data Connect; Configure dataset workloads; Manage cross-tenant data movement; Approve application requests; and Manage app registrations. See the Permissions section above for the full list.
What are the security risks of the Microsoft Graph Data Connect Administrator role?
Key considerations when assigning Microsoft Graph Data Connect Administrator: Bulk data access is sensitive; Cross-tenant implications; Application trust assessment; and PII exposure risk. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.