Privileged Role Administrator is the Microsoft Entra ID directory role that can assign any directory role, including Global Administrator, to itself or to anyone else, so it counts as equivalent to Global Administrator in any admin count. Microsoft's role reference says holders can grant themselves or others additional privilege by assigning more roles, and lists it among about 30 built-in roles flagged privileged. This entry is part of the Orbitra glossary.
Why it matters to a lean team
Most teams count Global Administrators and stop. A Privileged Role Administrator holds a route to the same access, one role assignment away: a compromised holder can grant Global Administrator to itself or to any other account or service principal without touching an existing Global Administrator. Microsoft recommends fewer than five Global Administrators and fewer than 10 privileged role assignments in total, and a Privileged Role Administrator you did not count is a gap in both numbers. The role does not include other privileged abilities such as creating or updating users, so it reads like a delegation role. Assigning roles is the takeover.
How it shows up in Microsoft Entra ID
- Role name: "Privileged Role Administrator" under Roles and administrators in the Microsoft Entra admin center. The page has a Privileged column with a filter, and an Assignments column that shows the number of role assignments.
- Microsoft Graph: the role definition has
isPrivilegedset to true, and role assignments can be filtered withroleDefinition/isPrivileged eq true. Microsoft's documented examples use the beta endpoint. - Privileged Identity Management: for Entra roles, only Privileged Role Administrators or Global Administrators can manage PIM assignments for other administrators, and PIM protects against removing the last active Global Administrator and Privileged Role Administrator assignments.
- Scope: the role can manage role assignments in Entra ID and in PIM, create and manage role-assignable groups, and manage all aspects of PIM and administrative units.
What to do about it
- Count Privileged Role Administrator assignments together with Global Administrator assignments, including groups and service principals that hold the role, not only users. See how many Global Administrators a tenant should have.
- Where you have Entra ID P2 or Microsoft Entra ID Governance, make the assignments eligible in PIM rather than permanently active, as Microsoft recommends. Microsoft 365 Business Premium and E3 include Entra ID P1, not P2, so many tenants need the approach in Entra PIM without P2.
- Keep emergency access accounts with a permanent active Global Administrator assignment. Microsoft lists a PIM lockout, where every Global Administrator and Privileged Role Administrator assignment is eligible with approval required and no active approvers exist, as one reason those accounts exist.
- Treat a compromised holder as a compromised Global Administrator. The steps in responding to a compromised Entra admin account apply unchanged.
Related terms
- Global Administrator
- PIM eligible assignment
- Emergency access account
- Identity blast radius
- Attack path
- Privileged identity response
Where Orbitra fits
Orbitra maps human and non-human identities in one graph with blast radius traversal across users, groups, apps, service principals, roles, and Azure RBAC, so a Privileged Role Administrator assignment shows up as part of what an identity can reach before you act, and what remains reachable after. It works at any Microsoft license level, alongside Microsoft native controls. When a holder is compromised, the response comes from an allowlisted catalog of more than two dozen governed response actions. In Recommend mode, your team executes it; in Approve mode, a named person signs off before Orbitra executes. Orbitra independently re-reads Microsoft after supported response actions to verify the final state. Entra directory role removals can be restored within the undo window (24 hours by default). See how it works.
Sources
- Microsoft Entra built-in roles: permissions reference, checked September 2026
- Privileged roles and permissions in Microsoft Entra ID, checked September 2026
- Best practices for Microsoft Entra roles, checked September 2026
- Manage emergency access accounts in Microsoft Entra ID, checked September 2026
- What is Microsoft Entra Privileged Identity Management?, checked September 2026
- Microsoft Entra ID Governance licensing fundamentals, checked September 2026