Windows 365 Administrator

Control PlaneEntraOps · EAMMicrosoft 365

Dado verificado em 30/06/2026 · Fonte

Role Actions

Control Plane

Management Plane

User Access

Template ID

11451d60-acb2-45eb-a7d6-43d0f0125c13

Categoria

M365

EAM Tier

Control Plane (Tier 0)

Enterprise Access Model: Control Plane

Controle total do tenant. Comprometimento leva a takeover completo. Isole de planos inferiores.

Esta role é classificada como Control Plane porque 21 de 28 ações (75%) são desse tier — o tier da role acompanha sempre a ação de maior privilégio, não o conjunto.

21 Control Plane7 Management Plane

Descrição

Can provision and manage all aspects of Cloud PCs.

Role Definition (JSON)

{
  "@odata.type": "#microsoft.graph.unifiedRoleDefinition",
  "id": "11451d60-acb2-45eb-a7d6-43d0f0125c13",
  "displayName": "Windows 365 Administrator",
  "description": "Can provision and manage all aspects of Cloud PCs.",
  "isBuiltIn": true,
  "isEnabled": true,
  "isPrivileged": false,
  "rolePermissions": [
    {
      "allowedResourceActions": [
        "microsoft.directory/deletedItems.devices/delete",

Permissões completas

Todas as 28 role actions desta role, classificadas por tier do EAM.

Role Action	Categoria	Tier
`microsoft.directory/deletedItems.devices/delete`	Global Endpoint Management	Tier 0
`microsoft.directory/deletedItems.devices/restore`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/basic/update`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/create`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/delete`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/disable`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/enable`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/extensionAttributeSet1/update`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/extensionAttributeSet2/update`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/extensionAttributeSet3/update`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/registeredOwners/update`	Global Endpoint Management	Tier 0
`microsoft.directory/devices/registeredUsers/update`	Global Endpoint Management	Tier 0
`microsoft.directory/groups.security/assignedLabels/update`	Group Management	Tier 0
`microsoft.directory/groups.security/basic/update`	Group Management	Tier 0
`microsoft.directory/groups.security/classification/update`	Group Management	Tier 0
`microsoft.directory/groups.security/create`	Group Management	Tier 0
`microsoft.directory/groups.security/delete`	Group Management	Tier 0
`microsoft.directory/groups.security/dynamicMembershipRule/update`	Group Management	Tier 0
`microsoft.directory/groups.security/members/update`	Group Management	Tier 0
`microsoft.directory/groups.security/owners/update`	Group Management	Tier 0
`microsoft.directory/groups.security/visibility/update`	Group Management	Tier 0
`microsoft.azure.supportTickets/allEntities/allTasks`	Support and Service Health	Tier 1
`microsoft.cloudPC/allEntities/allProperties/allTasks`	User Virtual Endpoint Management	Tier 1
`microsoft.directory/deviceManagementPolicies/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.directory/deviceRegistrationPolicy/standard/read`	Tenant Configuration (Reader)	Tier 1
`microsoft.office365.supportTickets/allEntities/allTasks`	Microsoft 365 Support Operations	Tier 1
`microsoft.office365.usageReports/allEntities/allProperties/read`	Microsoft 365 Support Operations	Tier 1
`microsoft.office365.webPortal/allEntities/standard/read`	Microsoft 365 Support Operations	Tier 1

28 de 28 role actions

PowerShell

Get-MgRoleManagementDirectoryRoleDefinition `
  -UnifiedRoleDefinitionId "11451d60-acb2-45eb-a7d6-43d0f0125c13"

Microsoft Graph

GET https://graph.microsoft.com/v1.0/
  roleManagement/directory/
  roleDefinitions/11451d60-acb2-45eb-a7d6-43d0f0125c13

Ver a documentação oficial na Microsoft Learn

Roles relacionadas

Knowledge Administrator

Tier 0Microsoft 365

Knowledge Manager

Tier 0Microsoft 365

Windows Update Deployment Administrator

Tier 0Microsoft 365