Microsoft Entra
built-in role privilege tree
Explore every role in the Microsoft Entra ID built-in role catalog, organized by privilege designation and functional area. Select a role for its template ID and Microsoft reference.
No roles match these filters. Clear the search or reset the filters.
How to read this tree
Broad-control highlights: Global Administrator, Privileged Role Administrator, and Privileged Authentication Administrator are drawn out for their extensive administrative, role-assignment, or authentication-method powers. This is not an exhaustive list of paths to tenant compromise. Other privileged roles can also have substantial impact.
Microsoft designation: "Marked privileged" reproduces the privileged-label flag in the source catalog. The designation is documented as preview. The other branch means only that this flag was absent in that snapshot; no independent safety rating is implied. Read access can still be privileged, so reader roles are not automatically placed in a lower band.
Scope: This includes the entire "All roles" table in Microsoft's Entra ID permissions reference. It excludes custom roles, default user/guest permissions, Azure resource RBAC, and separate workload-specific role catalogs. Actual access depends on assignment scope, activation, licensing, resource ownership, and other permissions. Functional-area grouping is editorial; roles can span multiple products.
Sources: Microsoft Entra built-in roles and Privileged roles and permissions. Source catalog updated --; retrieved 3 November 2026. Each role links to its full permission reference. This is a static public-documentation snapshot, not an inventory of assignments in your tenant.