Privileged Role Administrator is the Microsoft Entra ID directory role that can assign any directory role, including Global Administrator, to itself or to anyone else, so it counts as equivalent to Global Administrator in any admin count. Microsoft's role reference says holders can grant themselves or others additional privilege by assigning more roles, and lists it among about 30 built-in roles flagged privileged. This entry is part of the Orbitra glossary.
Why it matters to a lean team
Most teams count Global Administrators and stop. A Privileged Role Administrator holds a route to the same access, one role assignment away: a compromised holder can grant Global Administrator to itself or to any other account or service principal without touching an existing Global Administrator. Microsoft recommends fewer than five Global Administrators and fewer than 10 privileged role assignments in total, and a Privileged Role Administrator you did not count is a gap in both numbers. The role does not include other privileged abilities such as creating or updating users, so it reads like a delegation role. Assigning roles is the takeover.
How it shows up in Microsoft Entra ID
- Role name: "Privileged Role Administrator" under Roles and administrators in the Microsoft Entra admin center. The page has a Privileged column with a filter, and an Assignments column that shows the number of role assignments.
- Microsoft Graph: the role definition has
isPrivilegedset to true, and role assignments can be filtered withroleDefinition/isPrivileged eq true. Microsoft's documented examples use the beta endpoint. - Privileged Identity Management: for Entra roles, only Privileged Role Administrators or Global Administrators can manage PIM assignments for other administrators, and PIM protects against removing the last active Global Administrator and Privileged Role Administrator assignments.
- Scope: the role can manage role assignments in Entra ID and in PIM, create and manage role-assignable groups, and manage all aspects of PIM and administrative units.
What to do about it
- Count Privileged Role Administrator assignments together with Global Administrator assignments, including groups and service principals that hold the role, not only users. See how many Global Administrators a tenant should have.
- Where you have Entra ID P2 or Microsoft Entra ID Governance, make the assignments eligible in PIM rather than permanently active, as Microsoft recommends. Microsoft 365 Business Premium and E3 include Entra ID P1, not P2, so many tenants need the approach in Entra PIM without P2.
- Keep emergency access accounts with a permanent active Global Administrator assignment. Microsoft lists a PIM lockout, where every Global Administrator and Privileged Role Administrator assignment is eligible with approval required and no active approvers exist, as one reason those accounts exist.
- Treat a compromised holder as a compromised Global Administrator. The steps in responding to a compromised Entra admin account apply unchanged.
Related terms
- Global Administrator
- PIM eligible assignment
- Emergency access account
- Identity blast radius
- Attack path
- Privileged identity response
Orbitra connects Microsoft identity exposure analysis to approved response and evidence. It inventories human and workload access, prioritizes supported Entra privilege paths, and re-reads Microsoft state for supported actions. A named person approves every Orbitra-executed response today. See the workflow and coverage limits, or request a read-only exposure review.
Sources
- Microsoft Entra built-in roles: permissions reference, checked September 2026
- Privileged roles and permissions in Microsoft Entra ID, checked September 2026
- Best practices for Microsoft Entra roles, checked September 2026
- Manage emergency access accounts in Microsoft Entra ID, checked September 2026
- What is Microsoft Entra Privileged Identity Management?, checked September 2026
- Microsoft Entra ID Governance licensing fundamentals, checked September 2026