Cloud App Security Administrator

Control PlaneEntraOps · EAMApplication

Dado verificado em 30/06/2026 · Fonte

Role Actions

Control Plane

Management Plane

User Access

Template ID

892c5842-a9a6-463a-8041-72aa08ca3cf6

Categoria

Application

EAM Tier

Control Plane (Tier 0)

Enterprise Access Model: Control Plane

Controle total do tenant. Comprometimento leva a takeover completo. Isole de planos inferiores.

Esta role é classificada como Control Plane porque 1 de 2 ações (50%) são desse tier — o tier da role acompanha sempre a ação de maior privilégio, não o conjunto.

1 Control Plane1 Management Plane

Ação responsável:

microsoft.directory/cloudAppSecurity/allProperties/allTasks

Descrição

Manage all aspects of the Defender for Cloud Apps product.

Role Definition (JSON)

{
  "@odata.type": "#microsoft.graph.unifiedRoleDefinition",
  "id": "892c5842-a9a6-463a-8041-72aa08ca3cf6",
  "displayName": "Cloud App Security Administrator",
  "description": "Manage all aspects of the Defender for Cloud Apps product.",
  "isBuiltIn": true,
  "isEnabled": true,
  "isPrivileged": false,
  "rolePermissions": [
    {
      "allowedResourceActions": [
        "microsoft.directory/cloudAppSecurity/allProperties/allTasks",

Permissões completas

Todas as 2 role actions desta role, classificadas por tier do EAM.

Role Action	Categoria	Tier
`microsoft.directory/cloudAppSecurity/allProperties/allTasks`	Cloud Access Security Broker	Tier 0
`microsoft.office365.webPortal/allEntities/standard/read`	Microsoft 365 Support Operations	Tier 1

2 de 2 role actions

PowerShell

Get-MgRoleManagementDirectoryRoleDefinition `
  -UnifiedRoleDefinitionId "892c5842-a9a6-463a-8041-72aa08ca3cf6"

Microsoft Graph

GET https://graph.microsoft.com/v1.0/
  roleManagement/directory/
  roleDefinitions/892c5842-a9a6-463a-8041-72aa08ca3cf6

Ver a documentação oficial na Microsoft Learn

Roles relacionadas

Application Administrator

Tier 0Application

Cloud Application Administrator

Agent ID Administrator

Tier 0Identity