Cloud Application Administrator

Privilegiada

Control PlaneEntraOps · EAMApplication

Dado verificado em 30/06/2026 · Fonte

Role Actions

Control Plane

Management Plane

User Access

Template ID

158c047a-c907-4556-b7ef-446551a6b5f7

Categoria

Application

EAM Tier

Control Plane (Tier 0)

Enterprise Access Model: Control Plane

Controle total do tenant. Comprometimento leva a takeover completo. Isole de planos inferiores.

Esta role é classificada como Control Plane porque 44 de 61 ações (72%) são desse tier — o tier da role acompanha sempre a ação de maior privilégio, não o conjunto.

44 Control Plane16 Management Plane1 User Access

Descrição

Can create and manage all aspects of app registrations and enterprise apps except App Proxy.

Role Definition (JSON)

{
  "@odata.type": "#microsoft.graph.unifiedRoleDefinition",
  "id": "158c047a-c907-4556-b7ef-446551a6b5f7",
  "displayName": "Cloud Application Administrator",
  "description": "Can create and manage all aspects of app registrations and enterprise apps except App Proxy.",
  "isBuiltIn": true,
  "isEnabled": true,
  "isPrivileged": true,
  "rolePermissions": [
    {
      "allowedResourceActions": [
        "microsoft.directory/adminConsentRequestPolicy/allProperties/allTasks",

Permissões completas

Todas as 61 role actions desta role, classificadas por tier do EAM.

Role Action	Categoria	Tier
`microsoft.directory/adminConsentRequestPolicy/allProperties/allTasks`	Application and Workload Identity	Tier 0
`microsoft.directory/applicationPolicies/basic/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applicationPolicies/create`	Application and Workload Identity	Tier 0
`microsoft.directory/applicationPolicies/delete`	Application and Workload Identity	Tier 0
`microsoft.directory/applicationPolicies/owners/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applicationTemplates/instantiate`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/appRoles/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/audience/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/authentication/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/create`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/credentials/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/delete`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/disablement/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/extensionProperties/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/notes/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/owners/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/permissions/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/policies/update`	Tenant Policy Management	Tier 0
`microsoft.directory/applications/tag/update`	Application and Workload Identity	Tier 0
`microsoft.directory/applications/verification/update`	Application and Workload Identity	Tier 0
`microsoft.directory/deletedItems.applications/delete`	Application and Workload Identity	Tier 0
`microsoft.directory/deletedItems.applications/restore`	Application and Workload Identity	Tier 0
`microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/appRoleAssignedTo/update`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/audience/update`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/authentication/update`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/create`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/credentials/update`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/delete`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/enable`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/getPasswordSingleSignOnCredentials`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/managePasswordSingleSignOnCredentials`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/managePermissionGrantsForAll.microsoft-application-admin`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/notes/update`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/owners/update`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/permissions/update`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/policies/update`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/credentials/manage`	User Lifecycle and Provisioning Management	Tier 0
`microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/jobs/manage`	User Lifecycle and Provisioning Management	Tier 0
`microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/schema/manage`	User Lifecycle and Provisioning Management	Tier 0
`microsoft.directory/servicePrincipals/synchronizationCredentials/manage`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/synchronizationJobs/manage`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/synchronizationSchema/manage`	Application and Workload Identity	Tier 0
`microsoft.directory/servicePrincipals/tag/update`	Application and Workload Identity	Tier 0
`microsoft.azure.serviceHealth/allEntities/allTasks`	Support and Service Health	Tier 1
`microsoft.azure.supportTickets/allEntities/allTasks`	Support and Service Health	Tier 1
`microsoft.directory/appConsent/appConsentRequests/allProperties/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/applicationPolicies/owners/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/applicationPolicies/policyAppliedTo/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/applications/basic/update`	Application and Workload Identity	Tier 1
`microsoft.directory/applications/synchronization/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/auditLogs/allProperties/read`	Security and Compliance	Tier 1
`microsoft.directory/provisioningLogs/allProperties/read`	Security and Compliance	Tier 1
`microsoft.directory/servicePrincipals/basic/update`	Application and Workload Identity	Tier 1
`microsoft.directory/servicePrincipals/disable`	Application and Workload Identity	Tier 1
`microsoft.directory/servicePrincipals/synchronization/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/signInReports/allProperties/read`	Security and Compliance	Tier 1
`microsoft.office365.serviceHealth/allEntities/allTasks`	Microsoft 365 Support Operations	Tier 1
`microsoft.office365.supportTickets/allEntities/allTasks`	Microsoft 365 Support Operations	Tier 1
`microsoft.office365.webPortal/allEntities/standard/read`	Microsoft 365 Support Operations	Tier 1
`microsoft.directory/applicationPolicies/standard/read`	Default member	Tier 2

61 de 61 role actions

PowerShell

Get-MgRoleManagementDirectoryRoleDefinition `
  -UnifiedRoleDefinitionId "158c047a-c907-4556-b7ef-446551a6b5f7"

Microsoft Graph

GET https://graph.microsoft.com/v1.0/
  roleManagement/directory/
  roleDefinitions/158c047a-c907-4556-b7ef-446551a6b5f7

Ver a documentação oficial na Microsoft Learn

Roles relacionadas

Application Administrator

Tier 0Application

Cloud App Security Administrator

Agent ID Administrator

Tier 0Identity