{ "schemaVersion": "1.0.0", "catalogVersion": "2026-10-03.1", "publishedAt": "2026-10-03T15:20:12Z", "source": { "repository": "https://github.com/0125joel/PIM-Monitor", "path": "docs-site/src/data/eam-role-catalog.json" }, "roles": [ { "templateId": "db506228-d27e-4b7d-95e5-295956d6615f", "displayName": "Agent ID Administrator", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "adb2368d-a9be-41b5-8667-d96778e081b0", "displayName": "Agent ID Developer", "plane": "Control", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": "Creates agent identity blueprints and service principals and owns them. Writing identity principals is a Control-plane action with real blast radius, so Specialized rather than Enterprise.", "reviewNeeded": false }, { "templateId": "6b942400-691f-4bf0-9d12-d8a254a2baf5", "displayName": "Agent Registry Administrator", "plane": "Control", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": "Full administration of the agent registry, which governs agent identities, is a Control-plane write, so Specialized rather than Enterprise.", "reviewNeeded": false }, { "templateId": "d2562ede-74db-457e-a7b6-544e236ebb61", "displayName": "AI Administrator", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": "isPrivileged. Writes agent identities, agent identity blueprints and OAuth2 permission grants, which gate access, so the plane is Control like Agent ID Administrator.", "reviewNeeded": false }, { "templateId": "1fe13547-53f6-408d-ac04-7f8eed167b38", "displayName": "AI Reader", "plane": "Data", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": "Read-only data role, but Microsoft flags it isPrivileged, so the floor forces Privileged.", "reviewNeeded": false }, { "templateId": "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3", "displayName": "Application Administrator", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "cf1c38e5-3621-4004-a7cb-879624dced7c", "displayName": "Application Developer", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "9c6df0f2-1e7c-4dc3-b195-66dfbd24aa8f", "displayName": "Attack Payload Author", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "c430b396-e693-46cc-96f3-db01bf8bb62a", "displayName": "Attack Simulation Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d", "displayName": "Attribute Assignment Administrator", "plane": "Control", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "ffd52fa5-98dc-465c-991d-fc073eb59f8f", "displayName": "Attribute Assignment Reader", "plane": "Control", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "8424c6f0-a189-499e-bbd0-26c1753c96d4", "displayName": "Attribute Definition Administrator", "plane": "Control", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": "Defines custom security attribute sets and definitions, the schema behind attribute-based access. That security-configuration write makes it Specialized, not Enterprise.", "reviewNeeded": false }, { "templateId": "1d336d2c-4ae8-42ef-9711-b3604ce3fc2c", "displayName": "Attribute Definition Reader", "plane": "Control", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "5b784334-f94b-471a-a387-e7219fc49ca2", "displayName": "Attribute Log Administrator", "plane": "Control", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "9c99539d-8186-4804-835f-fd51ef9e2dcd", "displayName": "Attribute Log Reader", "plane": "Control", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "ecb2c6bf-0ab6-418e-bd87-7986f8d63bbe", "displayName": "Attribute Provisioning Administrator", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "422218e4-db15-4ef9-bbe0-8afb41546d79", "displayName": "Attribute Provisioning Reader", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": "Read-only, but isPrivileged: it reads provisioning configuration on service principals, so the floor forces Privileged.", "reviewNeeded": false }, { "templateId": "c4e39bd9-1100-46d3-8c65-fb160da0071f", "displayName": "Authentication Administrator", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "25a516ed-2fa0-40ea-a2d0-12923a21473a", "displayName": "Authentication Extensibility Administrator", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "0b00bede-4072-4d22-b441-e7df02a1ef63", "displayName": "Authentication Extensibility Password Administrator", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "0526716b-113d-4c15-b2c8-68e3c22b9f80", "displayName": "Authentication Policy Administrator", "plane": "Control", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "9f06204d-73c1-4d4c-880a-6edb90606fd8", "displayName": "Azure AD Joined Device Local Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": "Grants local administrator rights on Azure AD joined devices. The directory permissions are minimal, but the device-admin effect keeps it Management/Specialized.", "reviewNeeded": false }, { "templateId": "e3973bdf-4987-49ae-837a-ba8e231c7286", "displayName": "Azure DevOps Administrator", "plane": "Management", "securityLevel": "Privileged", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": "Not flagged isPrivileged, but full data-plane control over all Azure DevOps organizations and source code makes a compromise catastrophic, so the blast-radius escalation raises it to Privileged.", "reviewNeeded": false }, { "templateId": "7495fdc4-34c4-4d15-a289-98788ce399fd", "displayName": "Azure Information Protection Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "aaf43236-0c0d-4d5f-883a-6955382ac081", "displayName": "B2C IEF Keyset Administrator", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "3edaf663-341e-4475-9f94-5c398ef6c070", "displayName": "B2C IEF Policy Administrator", "plane": "Control", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "b0f54661-2d74-4c50-afa3-1ec803f12efe", "displayName": "Billing Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "892c5842-a9a6-463a-8041-72aa08ca3cf6", "displayName": "Cloud App Security Administrator", "plane": "Control", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "158c047a-c907-4556-b7ef-446551a6b5f7", "displayName": "Cloud Application Administrator", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "7698a772-787b-4ac8-901f-60d6b08affd2", "displayName": "Cloud Device Administrator", "plane": "Management", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "17315797-102d-40b4-93e0-432062caca18", "displayName": "Compliance Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "e6d1a23a-da11-4be4-9570-befc86d067a7", "displayName": "Compliance Data Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "b1be1c3e-b65d-4f19-8427-f6fa0d97feb9", "displayName": "Conditional Access Administrator", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "fc8ad4e2-40e4-4724-8317-bcda7503ecbf", "displayName": "Customer Delegated Admin Relationship Administrator", "plane": "Control", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": "Manages delegated admin privileges that grant external partners administrative access into the tenant. Controlling who can administer is elevated, so Specialized.", "reviewNeeded": false }, { "templateId": "5c4f9dcd-47dc-4cf7-8c9a-9e4207cbfc91", "displayName": "Customer LockBox Access Approver", "plane": "Control", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "38a96431-2bdf-4b4c-8b6e-5d3d8abac1a4", "displayName": "Desktop Analytics Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "9c094953-4995-41c8-84c8-3ebb9b32c93f", "displayName": "Device Join", "plane": "Data", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "2b499bcd-da44-4968-8aec-78e1674fa64d", "displayName": "Device Managers", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": "Writes device objects (microsoft.directory/devices), which is workload management, not read-only data. Plane corrected to Management and level to Specialized.", "reviewNeeded": false }, { "templateId": "d405c6df-0af8-4e3b-95e4-4d06e542189e", "displayName": "Device Users", "plane": "Data", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "88d8e3e3-8f55-4a1e-953a-9b9898b8876b", "displayName": "Directory Readers", "plane": "Control", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "d29b2b05-8046-44ba-8758-1e26182fcf32", "displayName": "Directory Synchronization Accounts", "plane": "Control", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": "Service-account-only role used by Entra Connect. No human should hold it; any human member is a finding.", "reviewNeeded": false }, { "templateId": "9360feb5-f418-4baa-8175-e2a00bac4301", "displayName": "Directory Writers", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "8329153b-31d0-4727-b945-745eb3bc5f31", "displayName": "Domain Name Administrator", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "e93e3737-fa85-474a-aee4-7d3fb86510f3", "displayName": "Dragon Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "44367163-eba1-44c3-98af-f5787879f96a", "displayName": "Dynamics 365 Administrator", "plane": "Management", "securityLevel": "Privileged", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": "Not flagged isPrivileged, but full data-plane control over all Dynamics 365 CRM and ERP data makes a compromise catastrophic, so the blast-radius escalation raises it to Privileged.", "reviewNeeded": false }, { "templateId": "963797fb-eb3b-4cde-8ce3-5878b3f32a3f", "displayName": "Dynamics 365 Business Central Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "3f1acade-1e04-4fbc-9b69-f0302cd84aef", "displayName": "Edge Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "b6a27b2b-f905-4b2e-81b5-0d90e0ef1fdb", "displayName": "Entra Backup Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "f42252d9-5400-4d7b-b9ef-cc582dbb8577", "displayName": "Entra Backup Reader", "plane": "Data", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "d35481f7-cda1-4fa2-8344-5a21f7f3724d", "displayName": "Entra Customer Lockbox Approver", "plane": "Control", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "58f930cc-fcf4-4152-852c-1d7dbf502139", "displayName": "Entra SOC Identity Responder", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": "New built-in role (Microsoft, June 2026) for least-privilege SOC incident response: disable/enable users, revoke sessions, reset passwords. Deliberately scoped away from admin accounts, but Microsoft still flags isPrivileged=true, so the floor applies. Plane follows function: same identity-control namespace (microsoft.directory/users/*) as User Administrator and Password Administrator.", "reviewNeeded": false }, { "templateId": "29232cdf-9323-42fd-ade2-1d097af3e4de", "displayName": "Exchange Administrator", "plane": "Management", "securityLevel": "Privileged", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": "Not flagged isPrivileged, but full data-plane control over all mailbox content makes a compromise catastrophic, so the blast-radius escalation raises it to Privileged.", "reviewNeeded": false }, { "templateId": "49eb8f75-97e9-4e37-9b2b-6c3ebfcffa31", "displayName": "Exchange Backup Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "31392ffb-586c-42d1-9346-e59415a2cc4e", "displayName": "Exchange Recipient Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "dd13091a-6207-4fc0-82ba-3641e056ab95", "displayName": "Extended Directory User Administrator", "plane": "Control", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": "Creates and updates external user profiles, a directory identity-object write, so Specialized rather than Enterprise.", "reviewNeeded": false }, { "templateId": "6e591065-9bad-43ed-90f3-e9424366d2f0", "displayName": "External ID User Flow Administrator", "plane": "Control", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "0f971eea-41eb-4569-a71e-57bb8a3eff1e", "displayName": "External ID User Flow Attribute Administrator", "plane": "Control", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": "Writes the attribute schema used by external-identity user flows, an identity-configuration write, so Specialized rather than Enterprise.", "reviewNeeded": false }, { "templateId": "be2f45a1-457d-42af-a067-6ec1fa63bc45", "displayName": "External Identity Provider Administrator", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "a9ea8996-122f-4c74-9520-8edcd192826c", "displayName": "Fabric Administrator", "plane": "Management", "securityLevel": "Privileged", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": "Not flagged isPrivileged, but full data-plane control over all Microsoft Fabric and Power BI content makes a compromise catastrophic, so the blast-radius escalation raises it to Privileged.", "reviewNeeded": false }, { "templateId": "62e90394-69f5-4237-9190-012177145e10", "displayName": "Global Administrator", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "f2ef992c-3afb-46b9-b7cf-a126ee74c451", "displayName": "Global Reader", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": "Read-only, but Microsoft flags it isPrivileged: full visibility into the security and identity configuration is a tactical advantage, so the floor holds it at Privileged.", "reviewNeeded": false }, { "templateId": "ac434307-12b9-4fa1-a708-88bf58caabc1", "displayName": "Global Secure Access Administrator", "plane": "Control", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": "Writes conditional access and cross-tenant access policy as part of Global Secure Access. Touching authorization moves it to the Control plane even though it administers a network service.", "reviewNeeded": false }, { "templateId": "843318fb-79a6-4168-9e6f-aa9a07481cc4", "displayName": "Global Secure Access Log Reader", "plane": "Data", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "fdd7a751-b60b-444a-984c-02652fe8fa1c", "displayName": "Groups Administrator", "plane": "Control", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "95e79109-95c0-4d8e-aee3-d01accf2d47b", "displayName": "Guest Inviter", "plane": "Control", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "10dae51f-b6af-4016-8d66-8c2a99b929b3", "displayName": "Guest User", "plane": "Control", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "729827e3-9c14-49f7-bb1b-9608f156bbb8", "displayName": "Helpdesk Administrator", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": "Microsoft flags it isPrivileged (it can reset credentials and read BitLocker keys), so the floor sets Privileged even though SPA prose lists help desk as Specialized.", "reviewNeeded": false }, { "templateId": "8ac3fc64-6eca-42ea-9e69-59f4c7b60eb2", "displayName": "Hybrid Identity Administrator", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "45d8d3c5-c802-45c6-b32a-1d70b5e1e86e", "displayName": "Identity Governance Administrator", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "eb1f4a8d-243a-41f0-9fbd-c7cdf6c5ef7c", "displayName": "Insights Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "25df335f-86eb-4119-b717-0ff02de207e9", "displayName": "Insights Analyst", "plane": "Data", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "31e939ad-9672-4796-9c2e-873181342d2d", "displayName": "Insights Business Leader", "plane": "Data", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "3a2c62db-5318-420d-8d74-23affee5d9d5", "displayName": "Intune Administrator", "plane": "Management", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "2ea5ce4c-b2d8-4668-bd81-3680bd2d227a", "displayName": "IoT Device Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "74ef975b-6605-40af-a5d2-b9539d836353", "displayName": "Kaizala Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "b5a8dcf3-09d5-43a9-a639-8e29ef291470", "displayName": "Knowledge Administrator", "plane": "Management", "securityLevel": "Privileged", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": "Not flagged isPrivileged, but full data-plane control over the organization's knowledge network and topics makes a compromise catastrophic, so the blast-radius escalation raises it to Privileged.", "reviewNeeded": false }, { "templateId": "744ec460-397e-42ad-a462-8b3f9747a02c", "displayName": "Knowledge Manager", "plane": "Management", "securityLevel": "Privileged", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": "Not flagged isPrivileged, but full data-plane control over the organization's knowledge network and topics makes a compromise catastrophic, so the blast-radius escalation raises it to Privileged.", "reviewNeeded": false }, { "templateId": "4d6ac14f-3453-41d0-bef9-a3e0c569773a", "displayName": "License Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "59d46f88-662b-457b-bceb-5c3809e5908f", "displayName": "Lifecycle Workflows Administrator", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "ac16e43d-7b2d-40e0-ac05-243ff356ab5b", "displayName": "Message Center Privacy Reader", "plane": "Data", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "790c1fb9-7f7d-4f88-86a1-ef1f95c05c1b", "displayName": "Message Center Reader", "plane": "Data", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "1707125e-0aa2-4d4d-8655-a7c786c76a25", "displayName": "Microsoft 365 Backup Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "8c8b803f-96e1-4129-9349-20738d9f9652", "displayName": "Microsoft 365 Migration Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "ee67aa9c-e510-4759-b906-227085a7fd4d", "displayName": "Microsoft Graph Data Connect Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "1501b917-7653-4ff9-a4b5-203eaf33784f", "displayName": "Microsoft Hardware Warranty Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "281fe777-fb20-4fbb-b7a3-ccebce5b0d96", "displayName": "Microsoft Hardware Warranty Specialist", "plane": "Data", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "d37c8bed-0711-4417-ba38-b4abe66ce4c2", "displayName": "Network Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "2b745bdf-0803-4d80-aa65-822c4493daac", "displayName": "Office Apps Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "a92aed5d-d78a-4d16-b381-09adb37eb3b0", "displayName": "On Premises Directory Sync Account", "plane": "Control", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": "Service-account-only role used by Entra Connect sync. No human should hold it; any human member is a finding.", "reviewNeeded": false }, { "templateId": "92ed04bf-c94a-4b82-9729-b799a7a4c178", "displayName": "Organizational Branding Administrator", "plane": "Control", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "9d70768a-0cbc-4b4c-aea3-2e124b2477f4", "displayName": "Organizational Data Source Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "e48398e2-f4bb-4074-8f31-4586725e205b", "displayName": "Organizational Messages Approver", "plane": "Management", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": "Approves organizational messages shown to end users. This administers a messaging feature, not identity or access, so the plane is Management; approval-only keeps it Enterprise.", "reviewNeeded": false }, { "templateId": "507f53e4-4e52-4077-abd3-d2e1558b6ea2", "displayName": "Organizational Messages Writer", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": "Authors organizational messages broadcast to end users. This administers a messaging feature, not identity or access, so the plane is Management.", "reviewNeeded": false }, { "templateId": "4ba39ca4-527c-499a-b93d-d9b492c50246", "displayName": "Partner Tier1 Support", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": "Microsoft-internal 'do not use' role. Any tenant assignment is a finding regardless of plane or level.", "reviewNeeded": false }, { "templateId": "e00e864a-17c5-4a4b-9c06-f5b95a8d5bd8", "displayName": "Partner Tier2 Support", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": "Microsoft-internal 'do not use' role. Any tenant assignment is a finding regardless of plane or level.", "reviewNeeded": false }, { "templateId": "966707d0-3269-4727-9be2-8c3a10f19b9d", "displayName": "Password Administrator", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "024906de-61e5-49c8-8572-40335f1e0e10", "displayName": "People Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": "Configures the People service and profile data sources, not identity or access control. Plane corrected to Management; the service-config write makes it Specialized.", "reviewNeeded": false }, { "templateId": "af78dc32-cf4d-46f9-ba4e-4428526346b5", "displayName": "Permissions Management Administrator", "plane": "Control", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": "Administers Microsoft Entra Permissions Management (CIEM), which governs entitlements across clouds. That access-governance scope makes it Specialized rather than Enterprise.", "reviewNeeded": false }, { "templateId": "78b0ccd1-afc2-4f92-9116-b41aedd09592", "displayName": "Places Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "11648597-926c-4cf3-9c36-bcebb0ba8dcc", "displayName": "Power Platform Administrator", "plane": "Management", "securityLevel": "Privileged", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": "Not flagged isPrivileged, but full data-plane control over all Power Platform environments and their data makes a compromise catastrophic, so the blast-radius escalation raises it to Privileged.", "reviewNeeded": false }, { "templateId": "644ef478-e28f-4e28-b9dc-3fdde9aa0b1f", "displayName": "Printer Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "e8cef6f1-e4bd-4ea8-bc07-4b8d950f4477", "displayName": "Printer Technician", "plane": "Data", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "7be44c8a-adaf-4e2a-84d6-ab2649e08a13", "displayName": "Privileged Authentication Administrator", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "e8611ab8-c189-46e8-94e1-60213ab1f814", "displayName": "Privileged Role Administrator", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "3f04f91a-4ad7-4bd3-bcfa-49882ea1a88a", "displayName": "Purview Workload Content Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": "The role definition carries no allowedResourceActions in inventory, so plane and level follow its documented function (Purview workload content admin).", "reviewNeeded": false }, { "templateId": "e07494ad-1654-4dd2-922e-6f81a71bf00f", "displayName": "Purview Workload Content Reader", "plane": "Data", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": "The role definition carries no allowedResourceActions in inventory, so plane and level follow its documented function (Purview workload content reader).", "reviewNeeded": false }, { "templateId": "02d5655b-c1cf-4e5f-98da-5fb919085bf6", "displayName": "Purview Workload Content Writer", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": "The role definition carries no allowedResourceActions in inventory, so plane and level follow its documented function (Purview workload content writer).", "reviewNeeded": false }, { "templateId": "4a5d8f65-41da-4de4-8968-e035b65339cf", "displayName": "Reports Reader", "plane": "Data", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "2af84b1e-32c8-42b7-82bc-daa82404023b", "displayName": "Restricted Guest User", "plane": "Control", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "0964bb5e-9bdb-4d7b-ac29-58e794862a40", "displayName": "Search Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "8835291a-918c-4fd7-a9ce-faa49f0cf7d9", "displayName": "Search Editor", "plane": "Data", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "194ae4cb-b126-40b2-bd5b-6091b380977d", "displayName": "Security Administrator", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "5f2222b1-57c3-48ba-8ad5-d4759f1fde6f", "displayName": "Security Operator", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "5d6b6bb7-de71-4623-b4af-96380a352509", "displayName": "Security Reader", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": "Read-only, but isPrivileged: it sees detection and policy gaps across Entra and M365, so the floor holds it at Privileged.", "reviewNeeded": false }, { "templateId": "f023fd81-a637-4b56-95fd-791ac0226033", "displayName": "Service Support Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", "displayName": "SharePoint Administrator", "plane": "Management", "securityLevel": "Privileged", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": "Not flagged isPrivileged, but full data-plane control over all SharePoint site and OneDrive content makes a compromise catastrophic, so the blast-radius escalation raises it to Privileged.", "reviewNeeded": false }, { "templateId": "99009c4a-3b3f-4957-82a9-9d35e12db77e", "displayName": "SharePoint Advanced Management Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "9d3e04ba-3ee4-4d1b-a3a7-9aef423a09be", "displayName": "SharePoint Backup Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "1a7d78b6-429f-476b-b8eb-35fb715fffd4", "displayName": "SharePoint Embedded Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "75941009-915a-4869-abe7-691bff18279e", "displayName": "Skype for Business Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "69091246-20e8-4a56-aa4d-066075b2a7a8", "displayName": "Teams Administrator", "plane": "Management", "securityLevel": "Privileged", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": "Not flagged isPrivileged, but full data-plane control over all Teams content and configuration makes a compromise catastrophic, so the blast-radius escalation raises it to Privileged.", "reviewNeeded": false }, { "templateId": "baf37b3a-610e-45da-9e62-d9d1e5e8914b", "displayName": "Teams Communications Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "f70938a0-fc10-4177-9e90-2178f8765737", "displayName": "Teams Communications Support Engineer", "plane": "Data", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "fcf91098-03e3-41a9-b5ba-6f0ec8188a12", "displayName": "Teams Communications Support Specialist", "plane": "Data", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "3d762c5a-1b6c-493f-843e-55a3b42923d4", "displayName": "Teams Devices Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": "The directory actions in inventory are read-only, but the role administers Teams-certified devices in the Teams admin center, so it stays Management/Specialized.", "reviewNeeded": false }, { "templateId": "2fe872fb-daa8-4afc-8f6c-53c4565cfef4", "displayName": "Teams External Collaboration Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "1076ac91-f3d9-41a7-a339-dcdf5f480acc", "displayName": "Teams Reader", "plane": "Data", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "aa38014f-0993-46e9-9b45-30501a20909d", "displayName": "Teams Telephony Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "112ca1a2-15ad-4102-995e-45b0bc479a6a", "displayName": "Tenant Creator", "plane": "Control", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "1981f584-96e9-4a6f-95b0-f522373f8fae", "displayName": "Tenant Governance Administrator", "plane": "Control", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": "Writes cross-tenant access policy, which controls external access into the tenant. That authorization write makes it Specialized rather than Enterprise.", "reviewNeeded": false }, { "templateId": "e0a4caa6-fe82-443f-b92f-d87341d17b2e", "displayName": "Tenant Governance Reader", "plane": "Control", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "b8e31d83-1534-480f-9b10-0338ded51b7e", "displayName": "Tenant Governance Relationship Administrator", "plane": "Control", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": "Creates tenantGovernance relationships, requests and policy templates, which shape cross-tenant access. Writing access-shaping configuration is Specialized, like Tenant Governance Administrator; the readers stay Enterprise.", "reviewNeeded": false }, { "templateId": "124577f8-48ed-456a-839f-13b419002e33", "displayName": "Tenant Governance Relationship Reader", "plane": "Control", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "75934031-6c7e-415a-99d7-48dbd49e875e", "displayName": "Usage Summary Reports Reader", "plane": "Data", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "a0b1b346-4d3e-4e8b-98f8-753987be4970", "displayName": "User", "plane": "Control", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "fe930be7-5e62-47db-91af-98c3a49a38b1", "displayName": "User Administrator", "plane": "Control", "securityLevel": "Privileged", "isPrivileged": true, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "27460883-1df1-4691-b032-3b79643e5e63", "displayName": "User Experience Success Manager", "plane": "Data", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": "Reads adoption and usage telemetry and service health. It serves data rather than controlling identity, so the plane is Data, not Control.", "reviewNeeded": false }, { "templateId": "e300d9e7-4a2b-4295-9eff-f1c78b36cc98", "displayName": "Virtual Visits Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "0ec3f692-38d6-4d14-9e69-0377ca7797ad", "displayName": "Viva Glint Tenant Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "92b086b3-e367-4ef2-b869-1de128fb986e", "displayName": "Viva Goals Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "87761b17-1ed2-4af3-9acd-92a150038160", "displayName": "Viva Pulse Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "11451d60-acb2-45eb-a7d6-43d0f0125c13", "displayName": "Windows 365 Administrator", "plane": "Management", "securityLevel": "Privileged", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": "Not flagged isPrivileged, but full data-plane control over all Cloud PCs makes a compromise catastrophic, so the blast-radius escalation raises it to Privileged.", "reviewNeeded": false }, { "templateId": "32696413-001a-46ae-978c-ce0f6b3620d2", "displayName": "Windows Update Deployment Administrator", "plane": "Management", "securityLevel": "Specialized", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT4H", "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireJustification": true, "requireApproval": true }, "note": null, "reviewNeeded": false }, { "templateId": "c34f683f-4d5a-4403-affd-6615e00e3a7f", "displayName": "Workplace Device Join", "plane": "Data", "securityLevel": "Enterprise", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT8H", "requireMFA": true, "requireJustification": true, "requireApproval": false }, "note": null, "reviewNeeded": false }, { "templateId": "810a2642-a034-447f-a5e8-41beaa378541", "displayName": "Yammer Administrator", "plane": "Management", "securityLevel": "Privileged", "isPrivileged": false, "expectedConfig": { "maxActivationDuration": "PT1H", "requireMFA": true, "authContext": "phish-resistant-sif", "requireJustification": true, "requireApproval": true }, "note": "Not flagged isPrivileged, but full data-plane control over the entire Viva Engage (Yammer) network makes a compromise catastrophic, so the blast-radius escalation raises it to Privileged.", "reviewNeeded": false } ], "levels": [ { "plane": "Control", "securityLevel": "Privileged", "expectedConfig": { "maxActivationDuration": "PT1H", "requireJustification": true, "requireMFA": true, "authContext": "phish-resistant-sif", "requireApproval": true, "allowPermanentEligible": false, "allowPermanentActive": false } }, { "plane": "Control", "securityLevel": "Specialized", "expectedConfig": { "maxActivationDuration": "PT4H", "requireJustification": true, "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireApproval": true, "allowPermanentEligible": false, "allowPermanentActive": false } }, { "plane": "Control", "securityLevel": "Enterprise", "expectedConfig": { "maxActivationDuration": "PT8H", "requireJustification": true, "requireMFA": true, "requireApproval": false, "allowPermanentActive": false } }, { "plane": "Management", "securityLevel": "Privileged", "expectedConfig": { "maxActivationDuration": "PT1H", "requireJustification": true, "requireMFA": true, "authContext": "phish-resistant-sif", "requireApproval": true, "allowPermanentEligible": false, "allowPermanentActive": false } }, { "plane": "Management", "securityLevel": "Specialized", "expectedConfig": { "maxActivationDuration": "PT4H", "requireJustification": true, "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireApproval": true, "allowPermanentEligible": false, "allowPermanentActive": false } }, { "plane": "Management", "securityLevel": "Enterprise", "expectedConfig": { "maxActivationDuration": "PT8H", "requireJustification": true, "requireMFA": true, "requireApproval": false, "allowPermanentActive": false } }, { "plane": "Data", "securityLevel": "Privileged", "expectedConfig": { "maxActivationDuration": "PT1H", "requireJustification": true, "requireMFA": true, "authContext": "phish-resistant-sif", "requireApproval": true, "allowPermanentEligible": false, "allowPermanentActive": false } }, { "plane": "Data", "securityLevel": "Specialized", "expectedConfig": { "maxActivationDuration": "PT4H", "requireJustification": true, "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireApproval": true, "allowPermanentEligible": false, "allowPermanentActive": false } }, { "plane": "Data", "securityLevel": "Enterprise", "expectedConfig": { "maxActivationDuration": "PT8H", "requireJustification": true, "requireMFA": true, "requireApproval": false, "allowPermanentActive": false } } ], "groups": [ { "plane": "Control", "securityLevel": "Privileged", "member": { "maxActivationDuration": "PT1H", "requireJustification": true, "requireMFA": true, "authContext": "phish-resistant-sif", "requireApproval": true, "allowPermanentEligible": false, "allowPermanentActive": false }, "owner": { "maxActivationDuration": "PT1H", "requireJustification": true, "requireMFA": true, "authContext": "phish-resistant-sif", "requireApproval": true, "allowPermanentEligible": false, "allowPermanentActive": false } }, { "plane": "Data", "securityLevel": "Enterprise", "member": { "maxActivationDuration": "PT8H", "requireJustification": true, "requireMFA": true, "requireApproval": false, "allowPermanentActive": false }, "owner": { "maxActivationDuration": "PT4H", "requireJustification": true, "requireMFA": true, "requireApproval": true, "allowPermanentActive": false } }, { "plane": "Management", "securityLevel": "Privileged", "member": { "maxActivationDuration": "PT1H", "requireJustification": true, "requireMFA": true, "authContext": "phish-resistant-sif", "requireApproval": true, "allowPermanentEligible": false, "allowPermanentActive": false }, "owner": { "maxActivationDuration": "PT1H", "requireJustification": true, "requireMFA": true, "authContext": "phish-resistant-sif", "requireApproval": true, "allowPermanentEligible": false, "allowPermanentActive": false } }, { "plane": "Management", "securityLevel": "Specialized", "member": { "maxActivationDuration": "PT4H", "requireJustification": true, "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireApproval": true, "allowPermanentEligible": false, "allowPermanentActive": false }, "owner": { "maxActivationDuration": "PT2H", "requireJustification": true, "requireMFA": true, "authContext": "phish-resistant-no-sif", "requireApproval": true, "allowPermanentEligible": false, "allowPermanentActive": false } } ], "authContexts": [ { "slug": "phish-resistant-sif", "description": "Phishing-resistant MFA with sign-in frequency set to every time. Used by the Privileged level.", "requireState": "enabled", "requireAuthStrengthId": "00000000-0000-0000-0000-000000000003", "requireSignInFrequencyEveryTime": true, "requireCompliantDevice": false }, { "slug": "phish-resistant-no-sif", "description": "Phishing-resistant MFA without a sign-in frequency requirement. Used by the Specialized level.", "requireState": "enabled", "requireAuthStrengthId": "00000000-0000-0000-0000-000000000003", "requireSignInFrequencyEveryTime": false, "requireCompliantDevice": false }, { "slug": "phish-resistant-compliant-device", "description": "Phishing-resistant MFA on a compliant device. Not used by the catalog; available for tenants that want it.", "requireState": "enabled", "requireAuthStrengthId": "00000000-0000-0000-0000-000000000003", "requireSignInFrequencyEveryTime": false, "requireCompliantDevice": true }, { "slug": "phish-resistant-compliant-device-sif", "description": "Phishing-resistant MFA on a compliant device with sign-in frequency set to every time. Not used by the catalog; available for tenants that want it.", "requireState": "enabled", "requireAuthStrengthId": "00000000-0000-0000-0000-000000000003", "requireSignInFrequencyEveryTime": true, "requireCompliantDevice": true } ] }