Application Administrator

Privilegiada

Control PlaneEntraOps · EAMApplication

Dado verificado em 30/06/2026 · Fonte

Role Actions

Control Plane

Management Plane

User Access

Template ID

9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3

Categoria

Application

EAM Tier

Control Plane (Tier 0)

Enterprise Access Model: Control Plane

Controle total do tenant. Comprometimento leva a takeover completo. Isole de planos inferiores.

Esta role é classificada como Control Plane porque 53 de 73 ações (73%) são desse tier — o tier da role acompanha sempre a ação de maior privilégio, não o conjunto.

53 Control Plane19 Management Plane1 User Access

Descrição

Can create and manage all aspects of app registrations and enterprise apps.

Role Definition (JSON)

{
  "@odata.type": "#microsoft.graph.unifiedRoleDefinition",
  "id": "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3",
  "displayName": "Application Administrator",
  "description": "Can create and manage all aspects of app registrations and enterprise apps.",
  "isBuiltIn": true,
  "isEnabled": true,
  "isPrivileged": true,
  "rolePermissions": [
    {
      "allowedResourceActions": [
        "microsoft.directory/adminConsentRequestPolicy/allProperties/allTasks",

Permissões completas

Todas as 73 role actions desta role, classificadas por tier do EAM.

Role Action	Categoria	Tier
`microsoft.directory/adminConsentRequestPolicy/allProperties/allTasks`	Application and Workload Identity	Tier 0
`microsoft.directory/applicationPolicies/basic/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applicationPolicies/create`	Application and Workload Identity	Tier 0
`microsoft.directory/applicationPolicies/delete`	Application and Workload Identity	Tier 0
`microsoft.directory/applicationPolicies/owners/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applicationTemplates/instantiate`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/appRoles/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/applicationProxy/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/applicationProxyAuthentication/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/applicationProxySslCertificate/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/applicationProxyUrlSettings/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/audience/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/authentication/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/create`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/credentials/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/delete`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/disablement/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/extensionProperties/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/notes/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/owners/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/permissions/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/policies/update`	Tenant Policy Management	Tier 0
`microsoft.directory/applications/tag/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/verification/update`	Application and Workload Identity	Tier 0
`microsoft.directory/connectorGroups/allProperties/update`	Private Secure Access	Tier 0
`microsoft.directory/connectorGroups/create`	Private Secure Access	Tier 0
`microsoft.directory/connectorGroups/delete`	Private Secure Access	Tier 0
`microsoft.directory/connectors/create`	Private Secure Access	Tier 0
`microsoft.directory/customAuthenticationExtensions/allProperties/allTasks`	Authentication	Tier 0
`microsoft.directory/deletedItems.applications/delete`	Application and Workload Identity	Tier 0
`microsoft.directory/deletedItems.applications/restore`	Application and Workload Identity	Tier 0
`microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/appRoleAssignedTo/update`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/audience/update`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/authentication/update`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/create`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/credentials/update`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/delete`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/enable`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/getPasswordSingleSignOnCredentials`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/managePasswordSingleSignOnCredentials`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/managePermissionGrantsForAll.microsoft-application-admin`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/notes/update`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/owners/update`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/permissions/update`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/policies/update`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/credentials/manage`	User Lifecycle and Provisioning Management	Tier 0
`microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/jobs/manage`	User Lifecycle and Provisioning Management	Tier 0
`microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/schema/manage`	User Lifecycle and Provisioning Management	Tier 0
`microsoft.directory/servicePrincipals/synchronizationCredentials/manage`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/synchronizationJobs/manage`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/synchronizationSchema/manage`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/tag/update`	Application and Workload Identity	Tier 0
`microsoft.azure.serviceHealth/allEntities/allTasks`	Support and Service Health	Tier 1
`microsoft.azure.supportTickets/allEntities/allTasks`	Support and Service Health	Tier 1
`microsoft.directory/appConsent/appConsentRequests/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/applicationPolicies/owners/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/applicationPolicies/policyAppliedTo/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/applications/applicationProxy/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/applications/basic/update`	Application and Workload Identity	Tier 1
`microsoft.directory/applications/synchronization/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/auditLogs/allProperties/read`	Security and Compliance	Tier 1
`microsoft.directory/connectorGroups/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/connectors/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/provisioningLogs/allProperties/read`	Security and Compliance	Tier 1
`microsoft.directory/servicePrincipals/basic/update`	Application and Workload Identity	Tier 1
`microsoft.directory/servicePrincipals/disable`	Application and Workload Identity	Tier 1
`microsoft.directory/servicePrincipals/synchronization/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/signInReports/allProperties/read`	Security and Compliance	Tier 1
`microsoft.office365.serviceHealth/allEntities/allTasks`	Microsoft 365 Support Operations	Tier 1
`microsoft.office365.supportTickets/allEntities/allTasks`	Microsoft 365 Support Operations	Tier 1
`microsoft.office365.webPortal/allEntities/standard/read`	Microsoft 365 Support Operations	Tier 1
`microsoft.directory/applicationPolicies/standard/read`	Default member	Tier 2

73 de 73 role actions

PowerShell

Get-MgRoleManagementDirectoryRoleDefinition `
  -UnifiedRoleDefinitionId "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3"

Microsoft Graph

GET https://graph.microsoft.com/v1.0/
  roleManagement/directory/
  roleDefinitions/9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3

Ver a documentação oficial na Microsoft Learn

Roles relacionadas

Cloud App Security Administrator

Tier 0Application

Cloud Application Administrator

Agent ID Administrator

Tier 0Identity