Azure AD administrator roles allow you to delegate various parts of Azure Active Directory management.
As an example you can delegate the Global Reader role to anyone who needs to investigate or audit your resources but don’t need to make any changes.
In large organizations it makes sense to delegate the authority to manage Azure AD elements to specialized admins. And even minor organizations with just a few admins may find Azure AD administrator roles to be useful.
This article shows you how to do the following using PowerShell:
- List all Azure Administrator Roles
- List all users with a specific Azure Administrator Role
- List all assigned Azure Administrator Role for all identities
- List all Azure Administrator Roles for a specific user
But first let’s take a look at the GUI to get a visual on the information.
Managing Azure Administrator Roles Using the Azure Portal
To view all roles and see what users or groups are assigned to the roles, log in to the Azure Portal, go to Azure Active Directory and click on Roles and Administrators:

To view what roles are assigned to an individual user go to Users, select the user and click Assigned Roles:

Managing Azure Administrator Roles Using PowerShell
In many cases you may want to uses PowerShell to manage Administrator Roles in Azure Active Directory. PowerShell has two prominent modules for managing Azure:
- Azure AD PowerShell for Graph
- Azure Active Directory Module for Windows PowerShell (MSOnline)
Which one you prefer is up to you. This article will demonstrate the use of the MSOnline module for PowerShell.
All code examples assume that you have a working PowerShell connection to Azure. Read this article to understand how to set up and use the MSOnline module for PowerShell.
Azure Administrator Roles Overview
First of all, let’s get an overview of all the Azure AD Administrator Roles:
Get-MsolRole | Sort-Object Name | ft Name,ObjectID,description
Nicely formatted in a table, the output will look like this:
Azure AD Administrator Roles
Role | ObjectId | Description |
---|---|---|
Application Administrator | 9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3 | Can create and manage all aspects of app registrations and enterprise apps. |
Application Developer | cf1c38e5-3621-4004-a7cb-879624dced7c | Can create application registrations independent of the ‘Users can register applications’ setting. |
Authentication Administrator | c4e39bd9-1100-46d3-8c65-fb160da0071f | Allowed to view, set and reset authentication method information for any non-admin user. |
Azure DevOps Administrator | e3973bdf-4987-49ae-837a-ba8e231c7286 | Can manage Azure DevOps organization policy and settings. |
Azure Information Protection Administrator | 7495fdc4-34c4-4d15-a289-98788ce399fd | Can manage all aspects of the Azure Information Protection product. |
B2C IEF Keyset Administrator | aaf43236-0c0d-4d5f-883a-6955382ac081 | Can manage secrets for federation and encryption in the Identity Experience Framework (IEF). |
B2C IEF Policy Administrator | 3edaf663-341e-4475-9f94-5c398ef6c070 | Can create and manage trust framework policies in the Identity Experience Framework (IEF). |
B2C User Flow Administrator | 6e591065-9bad-43ed-90f3-e9424366d2f0 | Can create and manage all aspects of user flows. |
B2C User Flow Attribute Administrator | 0f971eea-41eb-4569-a71e-57bb8a3eff1e | Can create and manage the attribute schema available to all user flows. |
Billing Administrator | b0f54661-2d74-4c50-afa3-1ec803f12efe | Can perform common billing related tasks like updating payment information. |
Cloud Application Administrator | 158c047a-c907-4556-b7ef-446551a6b5f7 | Can create and manage all aspects of app registrations and enterprise apps except App Proxy. |
Cloud Device Administrator | 7698a772-787b-4ac8-901f-60d6b08affd2 | Full access to manage devices in Azure AD. |
Company Administrator | 62e90394-69f5-4237-9190-012177145e10 | Can manage all aspects of Azure AD and Microsoft services that use Azure AD identities. |
Compliance Administrator | 17315797-102d-40b4-93e0-432062caca18 | Can read and manage compliance configuration and reports in Azure AD and Office 365. |
Compliance Data Administrator | e6d1a23a-da11-4be4-9570-befc86d067a7 | Creates and manages compliance content. |
Conditional Access Administrator | b1be1c3e-b65d-4f19-8427-f6fa0d97feb9 | Can manage conditional access capabilities. |
CRM Service Administrator | 44367163-eba1-44c3-98af-f5787879f96a | Can manage all aspects of the Dynamics 365 product. |
Customer LockBox Access Approver | 5c4f9dcd-47dc-4cf7-8c9a-9e4207cbfc91 | Can approve Microsoft support requests to access customer organizational data. |
Desktop Analytics Administrator | 38a96431-2bdf-4b4c-8b6e-5d3d8abac1a4 | Can access and manage Desktop management tools and services. |
Device Administrators | 9f06204d-73c1-4d4c-880a-6edb90606fd8 | Device Administrators |
Device Join | 9c094953-4995-41c8-84c8-3ebb9b32c93f | Device Join |
Device Managers | 2b499bcd-da44-4968-8aec-78e1674fa64d | Deprecated – Do Not Use. |
Device Users | d405c6df-0af8-4e3b-95e4-4d06e542189e | Device Users |
Directory Readers | 88d8e3e3-8f55-4a1e-953a-9b9898b8876b | Can read basic directory information. Commonly used to grant directory read access to applications and guests. |
Directory Synchronization Accounts | d29b2b05-8046-44ba-8758-1e26182fcf32 | Only used by Azure AD Connect service. |
Directory Writers | 9360feb5-f418-4baa-8175-e2a00bac4301 | Can read and write basic directory information. For granting access to applications, not intended for users. |
Exchange Service Administrator | 29232cdf-9323-42fd-ade2-1d097af3e4de | Can manage all aspects of the Exchange product. |
External Identity Provider Administrator | be2f45a1-457d-42af-a067-6ec1fa63bc45 | Can configure identity providers for use in direct federation. |
Global Reader | f2ef992c-3afb-46b9-b7cf-a126ee74c451 | Can read everything that a global admin can read but not update anything. |
Groups Administrator | fdd7a751-b60b-444a-984c-02652fe8fa1c | Members of this role can create/manage groups, create/manage groups settings like naming and expiration policies, and view groups activity and audit reports. |
Guest Inviter | 95e79109-95c0-4d8e-aee3-d01accf2d47b | Can invite guest users independent of the ‘members can invite guests’ setting. |
Helpdesk Administrator | 729827e3-9c14-49f7-bb1b-9608f156bbb8 | Can reset passwords for non-administrators and Helpdesk Administrators. |
Intune Service Administrator | 3a2c62db-5318-420d-8d74-23affee5d9d5 | Can manage all aspects of the Intune product. |
Kaizala Administrator | 74ef975b-6605-40af-a5d2-b9539d836353 | Can manage settings for Microsoft Kaizala. |
License Administrator | 4d6ac14f-3453-41d0-bef9-a3e0c569773a | Can manage product licenses on users and groups. |
Lync Service Administrator | 75941009-915a-4869-abe7-691bff18279e | Can manage all aspects of the Skype for Business product. |
Message Center Privacy Reader | ac16e43d-7b2d-40e0-ac05-243ff356ab5b | Can read security messages and updates in Office 365 Message Center only. |
Message Center Reader | 790c1fb9-7f7d-4f88-86a1-ef1f95c05c1b | Can read messages and updates for their organization in Office 365 Message Center only. |
Office Apps Administrator | 2b745bdf-0803-4d80-aa65-822c4493daac | Can manage Office apps cloud services, including policy and settings management, and manage the ability to select, unselect and publish ‘what’s new’ feature content to end-user’s devices. |
Partner Tier1 Support | 4ba39ca4-527c-499a-b93d-d9b492c50246 | Do not use – not intended for general use. |
Partner Tier2 Support | e00e864a-17c5-4a4b-9c06-f5b95a8d5bd8 | Do not use – not intended for general use. |
Password Administrator | 966707d0-3269-4727-9be2-8c3a10f19b9d | Can reset passwords for non-administrators and Password Administrators. |
Power BI Service Administrator | a9ea8996-122f-4c74-9520-8edcd192826c | Can manage all aspects of the Power BI product. |
Power Platform Administrator | 11648597-926c-4cf3-9c36-bcebb0ba8dcc | Can create and manage all aspects of Microsoft Dynamics 365, PowerApps and Microsoft Flow. |
Printer Administrator | 644ef478-e28f-4e28-b9dc-3fdde9aa0b1f | Can manage all aspects of printers and printer connectors. |
Printer Technician | e8cef6f1-e4bd-4ea8-bc07-4b8d950f4477 | Can manage all aspects of printers and printer connectors. |
Privileged Authentication Administrator | 7be44c8a-adaf-4e2a-84d6-ab2649e08a13 | Allowed to view, set and reset authentication method information for any user (admin or non-admin). |
Privileged Role Administrator | e8611ab8-c189-46e8-94e1-60213ab1f814 | Can manage role assignments in Azure AD, and all aspects of Privileged Identity Management. |
Reports Reader | 4a5d8f65-41da-4de4-8968-e035b65339cf | Can read sign-in and audit reports. |
Search Administrator | 0964bb5e-9bdb-4d7b-ac29-58e794862a40 | Can create and manage all aspects of Microsoft Search settings. |
Search Editor | 8835291a-918c-4fd7-a9ce-faa49f0cf7d9 | Can create and manage the editorial content such as bookmarks, Q and As, locations, floorplan. |
Security Administrator | 194ae4cb-b126-40b2-bd5b-6091b380977d | Security Administrator allows ability to read and manage security configuration and reports. |
Security Operator | 5f2222b1-57c3-48ba-8ad5-d4759f1fde6f | Creates and manages security events. |
Security Reader | 5d6b6bb7-de71-4623-b4af-96380a352509 | Can read security information and reports in Azure AD and Office 365. |
Service Support Administrator | f023fd81-a637-4b56-95fd-791ac0226033 | Can read service health information and manage support tickets. |
SharePoint Service Administrator | f28a1f50-f6e7-4571-818b-6a12f2af6b6c | Can manage all aspects of the SharePoint service. |
Teams Communications Administrator | baf37b3a-610e-45da-9e62-d9d1e5e8914b | Can manage calling and meetings features within the Microsoft Teams service. |
Teams Communications Support Engineer | f70938a0-fc10-4177-9e90-2178f8765737 | Can troubleshoot communications issues within Teams using advanced tools. |
Teams Communications Support Specialist | fcf91098-03e3-41a9-b5ba-6f0ec8188a12 | Can troubleshoot communications issues within Teams using basic tools. |
Teams Service Administrator | 69091246-20e8-4a56-aa4d-066075b2a7a8 | Can manage the Microsoft Teams service. |
User Account Administrator | fe930be7-5e62-47db-91af-98c3a49a38b1 | Can manage all aspects of users and groups, including resetting passwords for limited admins. |
Workplace Device Join | c34f683f-4d5a-4403-affd-6615e00e3a7f | Workplace Device Join |
For a detailed description of all Administrator Roles and the permissions included in them, please refer to the official documentation from Microsoft.
List All Users With a Specific Azure Administrator Role
The Get-MsolRoleMember cmdlet will list members of a given role. It uses RoleObjectId to identify the Role GUID so you need to find the role GUID first using the Get-MsolRole cmdlet (or use the above table as reference).
To list all the users that have the Global Administrator (which is actually called ‘Company Administrator’!) role assigned, use the following PowerShell command:
Get-MsolRoleMember -RoleObjectId 62e90394-69f5-4237-9190-012177145e10
Output from this command may look like this:
PS C:\> Get-MsolRoleMember -RoleObjectId 62e90394-69f5-4237-9190-012177145e10 RoleMemberType EmailAddress DisplayName isLicensed -------------- ------------ ----------- ---------- User tycho.brahe@observatory.dk Tycho Brahe True User jens.m.knudsen@observatory.dk Jens Martin Knudsen True
List All Assigned Azure Administrator Role For All Identities
To list all assigned Azure Administrator Roles you can use the next script. To format the output nicely with the “real” Role name instead of the Guid requires some logic:
$RolesCollection = @()
$Roles = Get-MsolRole
ForEach ($Role In $Roles){
$Members = Get-MsolRoleMember -RoleObjectId $Role.ObjectId
ForEach ($Member In $Members) {
$obj = New-Object PSObject -Property @{
RoleName = $Role.Name
MemberName = $Member.DisplayName
MemberType = $Member.RoleMemberType
}
$RolesCollection += $obj
}
}
Write-Output $RolesCollection | Sort-Object RoleName,MemberName | ft RoleName,MemberName,MemberType
The output from this code is going to look similar to this:
RoleName MemberName MemberType -------- ---------- ---------- Company Administrator Tycho Brahe User Application Administrator Jens Martin Knudsen User Directory Synchronization Accounts On-Premises Directory Synchronization Service Account User License Administrator Ole Roemer User
List All Azure Administrator Roles For a Specific User
To view Azure Administrator Roles assigned to an individual user (or group), add some filtering to the output by replacing the last line of code in the previous script with the following:
Write-Output $RolesCollection | Where-Object MemberName -eq 'Tycho Brahe' | Sort-Object RoleName | ft RoleName,MemberName,MemberType
Summary
I hope you now have a good grip on PowerShell’ing your way through Azure Administrator Roles. Hopefully the above building blocks can help you put together some awesome automation to make your daily admin tasks easier and less error prone.
Check our PowerShell section for more ideas on automation.