2.2 Built-in & Custom Roles, Effective Permissions

Entra roles versus Azure RBAC

Microsoft Entra roles control who can manage identities and identity-related features in the directory: users, groups, applications, Conditional Access, authentication methods, domains, and more. Azure role-based access control (Azure RBAC) controls who can manage Azure resources such as subscriptions, virtual machines, and storage accounts.

SC-300 is an Identity and Access Administrator exam. Expect Entra roles as the primary authorization model, with occasional contrast questions so you do not assign Contributor on a subscription when the task is "reset MFA" or "create a Conditional Access policy."

A principal can hold both. A User Administrator may still need Reader on a subscription to view Azure resources, and a subscription Owner still cannot configure tenant-wide Conditional Access without an Entra role that includes those permissions.

Least privilege as an exam algorithm

When a question describes a job function, run this algorithm:

1. Identify the object class (users, groups, devices, apps, CA policies, auth methods, roles).
2. Identify the verb (read, create, update, delete, assign roles, reset credentials, manage settings).
3. Prefer a built-in role that matches that object/verb pair.
4. Only choose Global Administrator if the task truly requires broad tenant rights or no narrower role exists.
5. Prefer just-in-time elevation (PIM) for standing privilege in production design questions—even when the role name is correct.

Built-in roles you must distinguish

Microsoft publishes many built-in Entra roles. SC-300 focuses on identity-admin daily drivers and their boundary lines.

Global Administrator

• Full access to all Microsoft Entra ID administrative features and most Microsoft 365 services that rely on Entra roles.
• Can elevate to access all Azure subscriptions tied to the tenant in emergency patterns—treat as break glass.
• Wrong answer when a narrower role exists for the stated task.

Privileged Role Administrator

• Manages role assignments in Microsoft Entra ID, including assigning many privileged roles.
• Central to who can grant privilege, which is why it is itself highly privileged.
• Distinct from User Administrator: PRA manages roles, not everyday user attributes alone.

User Administrator

• Create and manage users and groups (with important limits on what can be done to higher-privileged users).
• Can reset passwords for non-admin users and some limited admin roles, but cannot reset passwords for Global Administrators or certain privileged roles—those require higher privilege such as Privileged Authentication Administrator / Global Administrator patterns depending on target.
• Common correct answer for helpdesk-style user lifecycle without Conditional Access or role-assignment rights.

Helpdesk Administrator (Password Administrator lineage)

• Password resets and limited support tasks for non-admin users.
• Narrower than User Administrator; cannot perform full user lifecycle management in many cases.
• Exam bait when the scenario only needs password reset for standard users.

Authentication Administrator vs Privileged Authentication Administrator

Scenario: "Helpdesk must require a user to re-register MFA, and the user is a Global Administrator." Authentication Administrator is insufficient; you need Privileged Authentication Administrator or Global Administrator-class rights.

Conditional Access Administrator

• Create and manage Conditional Access policies.
• Does not automatically grant broad user administration or Azure subscription ownership.
• Pair with Security Reader/Security Administrator knowledge when scenarios mix policy authoring with security monitoring.

Security Administrator / Security Reader

• Security Administrator manages security-related features and reads security information across Microsoft Entra ID and related portals.
• Security Reader is read-oriented for security features.
• Not the first choice for pure user creation or pure CA-only tasks if Conditional Access Administrator fits better.

Application Administrator vs Cloud Application Admin

If the scenario explicitly requires Microsoft Entra application proxy administration, Application Administrator (or a role that includes those permissions) is safer than Cloud Application Administrator.

Other high-yield roles

• Groups Administrator — manage groups and group settings without full user admin.
• License Administrator — assign licenses without broad user rights.
• Identity Governance Administrator — entitlement management, access reviews, lifecycle workflows (P2 / Governance features).
• Privileged Authentication / Authentication Policy Administrator family — authentication method policies at tenant scale (verify current role name on Learn if the question is policy-not-user specific).
• Global Reader — read-almost-everything without change rights; excellent for auditors.
• Reports Reader — sign-in and audit report visibility without configuration rights.

Custom roles

When no built-in role matches least privilege, create a custom Microsoft Entra role:

1. Start from the permissions catalog (resource actions such as microsoft.directory/users/standard/read).
2. Include only required actions.
3. Create the role definition.
4. Assign the custom role to users, groups, or service principals at supported scopes (tenant or administrative unit, depending on the permissions).

Custom roles are not free-form scripts; they are assembled from Microsoft-defined permission strings. If a permission is not available in custom roles, you must use a built-in role that includes it or accept a broader built-in role.

Exam cues for custom roles:

• "Grant only the ability to update user employee hire date and department."
• "Helpdesk needs to update mobile phone for MFA but not reset passwords for admins."
• "Regional admins need a subset of User Administrator permissions inside an administrative unit."

Do not invent Azure RBAC custom roles for directory object management—wrong control plane.

Role-assignable groups

Ordinary security groups can receive some Entra role assignments in modern tenants, but role-assignable groups are the enterprise pattern for privileged role membership:

• Created with Entra ID role can be assigned to the group enabled (isAssignableToRole).
• Only Privileged Role Administrators and Global Administrators can manage membership of these groups (stricter than normal group owner updates).
• Elevating group membership is elevating privilege; protect with PIM for groups / access reviews where licensed.

Use role-assignable groups when many people share the same Entra role and you want group-based assignment, auditability, and nested operational processes—not when a single break-glass account needs a direct assignment.

Evaluating effective permissions

Effective permissions answer: "What can this principal actually do right now?"

Sources of Entra authority:

1. Direct role assignments on the user or service principal.
2. Group-based role assignments for groups the principal belongs to (including role-assignable groups).
3. PIM eligible roles that are activated (eligible but not active means the permission is not currently effective for sign-in-time enforcement of admin APIs).
4. Scoped assignments (administrative unit) that limit which directory objects the role can touch.
5. Application permissions / OAuth grants for workload identities (related domain; do not confuse with user Entra roles).

Evaluation workflow for SC-300:

1. List all Entra roles assigned directly to the user.
2. List all groups and their Entra roles.
3. Subtract or note AU scope restrictions.
4. If PIM is in the scenario, check whether the role is eligible vs active and whether activation requirements (MFA, approval, ticket) are met.
5. Remember deny-like limits: User Administrator cannot treat Global Administrators as ordinary users for password reset; built-in protected actions and role restrictions matter.

Portal/Graph aids: Assigned roles blade on a user, download role assignments, Microsoft Graph role management APIs, and PIM assignment blades. On paper questions, you reason from the scenario text without clicking.

Comparison table for rapid recall

Common exam traps

• Choosing Global Administrator because it "works"—correct technically, wrong for least privilege scoring intent.
• Confusing Authentication Administrator with Privileged Authentication Administrator when the target user is privileged.
• Assigning Azure RBAC Owner to fix an MFA registration problem.
• Assuming group owners can add members to role-assignable groups (they generally cannot; privileged role admins manage those memberships).
• Forgetting that multiple roles add (union); one narrow role plus one broad role equals broad effective access.

Master the boundaries between Global Admin, Privileged Role Admin, User Admin, the authentication admin pair, Conditional Access Admin, and the application admin pair. That set covers the majority of SC-300 role-selection items in this domain.