Entra ID Privileged Roles: Tier 0 Risk Map and Controls

Most Entra ID tenants protect Global Administrator carefully and leave a dozen other roles with equivalent reach under ordinary controls. Microsoft labels well over 30 built-in roles as privileged, and several of them, including Privileged Role Administrator, Privileged Authentication Administrator, Hybrid Identity Administrator and Application Administrator, can reach Global Administrator power by a short and documented path. This guide is a risk map of those roles: what each one can actually do, which belong in Tier 0 (the control plane), which are high-impact but containable, and the specific controls each tier needs. It is written for identity architects, PAM owners and security engineers deciding which assignments to remove, convert to just-in-time or scope down. How to configure Privileged Identity Management itself is covered in the Privileged Identity Management (PIM) Guide; this page decides what PIM should protect and how hard.

This is an independent guide from NHI Mgmt Group, based on Microsoft's public documentation as of November 2026. It is not sponsored or reviewed by Microsoft. Product features change, so confirm settings against Microsoft's current documentation.

Key takeaways

"Privileged" is a Microsoft label, Tier 0 is your decision. The PRIVILEGED label marks roles that can delegate administration, change credentials or authentication and authorisation policy, or read restricted data; Tier 0 is the subset that can take over the whole tenant.
Escalation paths make roles equivalent. A role that can reset an admin's MFA, assign roles, change federation or add credentials to a highly privileged app is effectively Global Administrator.
Microsoft's numbers are a ceiling, not a target. Keep Global Administrator below five assignments and privileged role assignments below ten, with two cloud-only emergency access accounts.
Tier 0 needs cloud-only, phishing-resistant, just-in-time admin accounts. Synced on-premises accounts, standing assignments and push MFA are the common gaps.
Non-human identities hold Tier 0 too. Service principals with role assignments or high Microsoft Graph application permissions, and the Entra Connect sync account, belong on the same map.

What makes an Entra role privileged

Microsoft defines a privileged permission as one that can be used to delegate management of directory resources to other users, modify credentials, authentication or authorisation policies, or access restricted data. A privileged role is any built-in or custom role containing at least one such permission. In the Microsoft Entra admin center the Roles and administrators page shows a Privileged column and an Assignments count, so the first inventory takes minutes.

Permissions follow the schema namespace/entity/propertySet/action, for example microsoft.directory/applications/credentials/update. The propertySet values standard and basic exclude privileged properties; allProperties includes them. When you build custom roles, that distinction is where most accidental privilege comes from.

The label is necessary but not sufficient for risk decisions. Global Reader is labelled privileged because it can read everything a Global Administrator can, yet it cannot change anything. Exchange Administrator is not labelled in the role table, yet it controls every mailbox. A useful tier model starts from the label and then asks one question per role: can a holder of this role, alone, gain control of the tenant or of every user?

Tier 0 roles: control of the tenant

Microsoft's enterprise access model replaces the old Active Directory tiers with planes: the control plane (centralised identity and access control, the old Tier 0), the management plane and the data or workload plane. Roles that control identity, authentication or role assignment are control plane. The table below is NHI Mgmt Group's assessment based on each role's documented capabilities; validate it against your tenant's custom roles.

Role	Documented capability	Why it is Tier 0
Global Administrator	All administrative capabilities	Full control by definition
Privileged Role Administrator	Manages role assignments and all aspects of Privileged Identity Management	Can assign Global Administrator to any account, including its own
Privileged Authentication Administrator	Views, sets and resets authentication method information for any user, admin or non-admin	Can reset a Global Administrator's methods and sign in as them
Hybrid Identity Administrator	Manages cloud provisioning from AD, Entra Connect, pass-through authentication, password hash sync, seamless SSO and federation settings	Authentication for synced and federated users can be redirected or trusted elsewhere (ATT&CK T1556.007)
Application Administrator	Manages all aspects of app registrations, enterprise apps and application proxy; can add credentials to an application	Microsoft states holders can impersonate an application's identity, which may be an elevation of privilege; any app holding a high Graph permission or a role is reachable
Cloud Application Administrator	As Application Administrator, except application proxy	Same credential impersonation path
Conditional Access Administrator	Manages Conditional Access capabilities	Can exclude accounts from MFA, device and location policy for the whole tenant
Security Administrator	Reads security information and manages security configuration in Entra ID and Office 365	Controls detection and protection settings that defenders depend on, including cross-tenant access settings
External Identity Provider Administrator	Configures identity providers for direct federation	Adds token issuers the tenant will trust
Domain Name Administrator	Manages domain names in cloud and on-premises	Domain configuration underpins federation and sign-in routing
Partner Tier1 / Tier2 Support	Microsoft marks both "Do not use", not intended for general use	Legacy partner roles; any assignment is a finding

Directory Synchronization Accounts is reserved for the Entra Connect service and is not labelled privileged in the role table, but the account that holds it writes to every synced object and, with password hash sync, handles password data. Treat it as Tier 0. See How to audit the Entra Connect sync account.

Tier 1 roles: high impact, containable

These roles can do severe damage to users, devices or data, but they cannot directly take over the role system. They can often be scoped with administrative units or service-specific RBAC.

Role	Documented capability	Main risk	Containment option
User Administrator	Manages all aspects of users and groups, including password reset for limited admins	Mass account changes; takeover of lower admins	Administrative unit scope; restricted management units for sensitive accounts
Authentication Administrator	Sets and resets authentication methods for non-admin users	Takeover of any non-admin user, including owners of privileged apps	Administrative unit scope; strict help desk verification
Helpdesk Administrator / Password Administrator	Reset passwords for non-administrators (and Helpdesk Administrators)	Social engineering of the reset process	Administrative unit scope; verified caller procedure
Intune Administrator	Manages all aspects of Intune	Destructive device actions (wipe, retire) and script deployment to every managed device	Intune RBAC scope tags; multi admin approval
Exchange Administrator	Manages all aspects of Exchange (not labelled privileged)	Mailbox access, transport rules and forwarding for every user	Exchange RBAC roles; management scopes
Groups Administrator / Directory Writers	Manage groups and directory objects	Membership of groups used for app access and policy	Role-assignable groups for anything tied to roles
Identity Governance Administrator / Lifecycle Workflows Administrator	Manage access packages, reviews and joiner-mover-leaver workflows	Bulk access grants or workflows that act on many users	Approval on catalog changes; review of workflow tasks
Cloud Device Administrator	Enables, disables and deletes devices in Entra ID	Device trust used by Conditional Access	Just-in-time only

Escalation paths to watch

Tier boundaries fail where a lower role can act on a higher identity. These are the paths to test in your own tenant.

Credentials on privileged apps: an Application or Cloud Application Administrator adds a secret or certificate to a service principal that holds a directory role or a high Microsoft Graph application permission, then signs in as the app (T1098.001). Inventory such apps with How to find high-privilege Microsoft Graph application permissions.
App ownership: owners of an app registration can also add credentials. A non-admin user who owns a privileged app is effectively Tier 0.
Group ownership: owners of a role-assignable group control who holds the roles assigned to it. Microsoft recommends an owner for each such group and managing these groups with PIM for Groups so there are no standing owners or members.
Method reset on role holders: if a Tier 0 admin is not protected from lower reset roles (for example because it is a synced user or sits outside a restricted management administrative unit), help desk roles become a path to Tier 0.
Policy exclusion: Conditional Access Administrator can exclude an account or location from the policies that protect admins (T1556.006 for MFA changes).
On-premises compromise: Microsoft advises against synced on-premises accounts for Entra role assignments because a compromised on-premises account can compromise Entra resources.
New role assignments: once any Tier 0 path is used, attackers typically add a role to an account they control (T1098.003) for persistence.

Protecting each tier

Control	Tier 0	Tier 1
Account type	Dedicated cloud-only admin account, no mailbox or licence for productivity apps	Dedicated admin account; cloud-only preferred
Assignment	Eligible only in PIM, short activation, approval for Global Administrator and Privileged Role Administrator	Eligible in PIM; scoped by administrative unit or service RBAC where possible
Authentication	Phishing-resistant MFA (FIDO2 security keys, passkeys, Windows Hello for Business or certificate-based) via authentication strength	Phishing-resistant MFA
Device	Privileged access workstation, enforced by Conditional Access device filter	Compliant managed device
Session	Short sign-in frequency; protected actions for Conditional Access and hard delete changes	Standard admin sign-in frequency
Review	Monthly or quarterly access review of eligible and active assignments	Quarterly access review
Count	Global Administrator fewer than five, privileged assignments fewer than ten (Microsoft guidance)	As few as the operating model allows

Protected actions add a second layer that applies whatever role grants the permission: a Conditional Access authentication context is attached to specific permissions, such as creating, updating or deleting Conditional Access policies, changing cross-tenant access settings, editing named locations or hard deleting directory objects, and the user must satisfy it at the moment of the action. Protected actions need Microsoft Entra ID P1. See the Phishing-Resistant MFA Guide and the Privileged Access Workstations Guide.

Scoping instead of tenant-wide roles: administrative units let you assign User, Authentication, Helpdesk and Groups Administrator over a subset of users, and restricted management administrative units go further: only administrators with an explicit assignment at the unit's scope can change the Entra properties of users, devices and security groups inside it, and tenant-scoped roles, including Global Administrator, are blocked from those changes (though Global Administrator and Privileged Role Administrator can still manage the unit and its role assignments). That is how Tier 0 admin accounts are shielded from help desk resets. See the Entra ID Administrative Units Guide and Delegated Administration vs Global Admin.

How to implement a tier model

Inventory assignments. Export every active and eligible assignment for privileged roles, including those to groups and service principals, and every custom role containing privileged permissions.
Classify. Map each role to Tier 0, Tier 1 or other using the tables above, adding your custom roles and any app holding Tier 0 Graph permissions.
Secure emergency access first. Create two cloud-only emergency access accounts with permanent Global Administrator, phishing-resistant credentials stored separately, excluded from policies that could lock them out, and alerted on every sign-in. See the Break-Glass Account Guide.
Separate admin identities. Move Tier 0 roles to dedicated cloud-only accounts; remove roles from synced and daily-use accounts.
Pilot just-in-time. Convert one Tier 1 role to eligible-only with a small pilot group, then Tier 0 roles one at a time. Test activation, approval and break-glass before removing the last permanent assignment.
Enforce authentication and device. Apply a Conditional Access policy requiring phishing-resistant authentication strength for directory roles, report-only first, then on. Add protected actions for Conditional Access and hard delete permissions.
Close escalation paths. Remove unnecessary owners from privileged apps and role-assignable groups, rotate or remove app secrets in favour of certificates or federated credentials, and place Tier 0 accounts in a restricted management administrative unit.
Roll back safely. If activation or approvals block operations, restore an eligible assignment or use emergency access; never re-add permanent assignments to daily-use accounts as a fix.

Small versus large organisations: a small tenant may have only two or three administrators; the priority is cloud-only admin accounts, phishing-resistant MFA, PIM eligibility and two emergency accounts, and accepting that one person may hold several Tier 1 roles. A large tenant should add administrative units, restricted management units, approval workflows, privileged access workstations and a separate review cadence for Tier 0.

Detection and measurement

Entra audit logs record role changes under the RoleManagement category. Stream them to a SIEM and alert in near real time on Tier 0 changes.

Role assignment: "Add member to role" and "Add eligible member to role" for any Tier 0 role, and any assignment made outside PIM.
App credential and ownership changes: credential additions on service principals and app registrations with privileged permissions, and "Add owner to service principal".
Policy changes: Conditional Access policy creation, update or deletion, and authentication methods policy changes.
Emergency access use: any sign-in by an emergency access account.
Federation and hybrid changes: domain authentication changes and Entra Connect configuration changes.

Query patterns are in the Entra ID Audit Log Detection Guide.

Metrics:

Number of Global Administrator assignments (target below five, including emergency accounts).
Percentage of Tier 0 assignments that are eligible rather than permanently active (target 100% apart from emergency accounts).
Number of synced on-premises accounts holding any privileged role (target zero).
Percentage of privileged role holders registered for phishing-resistant methods and covered by an authentication strength policy.
Applications with Tier 0 permissions that have password credentials or non-admin owners.
Access review completion rate for privileged roles, and assignments removed per review.

Common failure patterns

Protecting only Global Administrator. Privileged Role Administrator and Privileged Authentication Administrator are left permanent and lightly monitored, though either reaches Global Administrator in one step.
Treating Application Administrator as a developer role. It is granted widely for convenience, opening the credential impersonation path to every privileged app.
Synced admin accounts. Roles assigned to on-premises synced accounts let an Active Directory compromise flow straight into the cloud.
Help desk reaches admins. Admin accounts outside restricted management administrative units can have methods reset by lower roles, and social engineering of the help desk becomes a Tier 0 attack.
Service principals forgotten. Role assignments and high Graph permissions on apps are excluded from reviews because PIM and reviews were scoped to users only.
Legacy roles left assigned. Partner Tier1 and Tier2 Support assignments, marked "Do not use" by Microsoft, remain from old partner relationships.

Framework mapping

Framework	Reference	How it applies
NIST SP 800-53 Rev 5	AC-2(7), AC-6(1), AC-6(5), AC-6(7), AC-6(9)	Privileged accounts, least privilege for security functions, review and logging of privileged use
NIST SP 800-53 Rev 5	IA-2(1), AC-5	MFA for privileged accounts; separation of duties between role assignment and use
NIST CSF 2.0	PR.AA-05, PR.AA-03, DE.CM-03	Permission governance, authentication and monitoring of privileged activity
CIS Controls v8.1	Control 5 Account Management; Control 6 Access Control Management	Dedicated admin accounts, MFA for administrative access, role-based access
ISO/IEC 27001:2022 Annex A	8.2 Privileged access rights; 5.18 Access rights	Restriction and review of privileged access
MITRE ATT&CK v20	T1098.003, T1098.001, T1078.004, T1556.007, T1556.006	Role and credential additions, cloud account abuse, hybrid identity and MFA changes

Practitioner checklist

Export all privileged role assignments, including groups, service principals and custom roles, and classify them as Tier 0 or Tier 1.
Keep Global Administrator below five assignments and privileged assignments below ten, with two cloud-only emergency access accounts.
Move every Tier 0 role to dedicated cloud-only accounts with eligible-only PIM assignments.
Require phishing-resistant authentication strength and a privileged access workstation for Tier 0 activation.
Add protected actions for Conditional Access, cross-tenant access settings and hard delete permissions.
Restrict Application Administrator and Cloud Application Administrator, and remove non-admin owners from privileged apps.
Place Tier 0 admin accounts in a restricted management administrative unit.
Remove any Partner Tier1 or Tier2 Support assignments.
Alert on Tier 0 role assignments, privileged app credential changes and emergency account sign-ins.
Run access reviews on privileged roles at least quarterly, including assignments to service principals.

Entra ID Privileged Roles Guide: Which Roles Are Tier 0 and How to Protect Them