IT Services Reference
Powered by

Privileged role reference

In 

Look up the roles, scopes and activation distinctions recorded for school IT technicians and administrators. These notes describe the captured assignments, not an access grant or current approval roster.

%school% : Role - IT Technician

%school short code% : Role - IT Technician

AKA

DALCC: Role - IT Technician WHICC: Role - IT Technician etc…

Screenshot retained for review

Authentication Administrator (scoped)

This role is scoped down to an individual school administrative unit.

Commonly students are active with the IT Technician role. Staff require the second stage activation.

A privileged identity role that allows a user to view, set, and reset authentication method information (such as phone numbers, FIDO2 keys, and authenticator app settings) for non-administrative users

Groups Administrator (Scoped)

That role is scoped to each college's groups. The un-scoped role is available as a second stage activation.

Allows users to manage group settings and lifecycle tasks across the organization without needing full Global Administrator permissions.

Core Responsibilities

  • Group Lifecycle Management: Create, edit, delete, and restore Microsoft 365 Groups and Microsoft Entra security groups.
  • Policy Management: Create, update, and manage group creation policies, expiration policies, and naming policies.
  • Admin Center Access: Manage groups and related settings via the Microsoft 365 Admin Center, the Microsoft Entra admin center, or PowerShell.

Cloud Device Administrator

A privileged administrative role with limited access to manage device objects in InTune and Entra.

This role is scoped to the devices specific to a school device Administrative Units. **Provide screenshot or link to where this is managed.

Key Permissions & Capabilities

Users assigned to the Cloud Device Administrator role can:

  • Enable, Disable, and Delete Devices: Manage the lifecycle state of device objects registered or joined in Microsoft Entra ID.
  • Read BitLocker Keys: View Windows 10/11 BitLocker recovery keys (if present) inside the Azure/Microsoft Entra portal.
  • Manage Device Settings: Read and modify device registration and join settings in the Microsoft Entra admin center.
  • Group Membership: Add members (users, devices, or other groups) to groups that they personally own

Entra device deletion workflow

There is a catch where the 'Delete' option is greyed out under in the Devices - Microsoft Intune admin center portal under devices.

Screenshot retained for review

Delete option is exposed in Entra -> Devices: Devices - Microsoft Entra admin center

Screenshot retained for review

Reports Reader

A read-only Microsoft Entra ID role that lets users view usage, activity, and audit reports across Microsoft services without granting administrative or configuration rights

Key Permissions & What Users Can Do

  • Microsoft 365 Admin Center: View usage reporting data, the reports dashboard, and activity reports.
  • Agent Overview: View agent overviews, agent registry data, and rich agent metadata details for the tenant.
  • Power BI: Get access to the Power BI adoption content pack.
  • Microsoft Entra ID: Read sign-in reports and audit logs.
  • Microsoft Graph API: View reporting data returned by the Microsoft Graph reporting API.
  • Microsoft Intune: Read-only access to specific reporting features where applicable.

LAPS Password Viewer

To view Windows Local Administrator Password Solution (Windows LAPS) passwords in Microsoft Entra ID and Microsoft Intune.

*Is this scoped to device administrative units? Confirm

Bitlocker Recovery Key Reader

A specialized role used to grant support staff permission to view BitLocker metadata and recovery keys

Application Administrator

Screenshot retained for review

Authentication Administrator

**** This is a second stage activation. Must have IT Technician activated first. May take 5-10min to be visible after activating the IT Technician role***

This role is scoped down to an individual school administrative unit.

Commonly students are active with the IT Technician role. Staff require the second stage activation.

a privileged identity role that allows a user to view, set, and reset authentication method information (such as phone numbers, FIDO2 keys, and authenticator app settings) for non-administrative users

Security Operator

**** This is a second stage activation. Must have IT Technician activated first. May take 5-10min to be visible after activating the IT Technician role***

Allows SOC (Security Operations Center) analysts to create and manage security events, handle alerts, and perform identity containment actions during security incidents without requiring full administrator privileges

Key Permissions & Capabilities

  • Alert & Incident Management: View, investigate, manage, and respond to security threats and alerts across supported portals.
  • Global Read-Only Access: Inherits read-only permissions from the Security Reader role across multiple security services, including:
  • Microsoft Defender portal (Defender for Endpoint, etc.)
  • Microsoft Entra ID Protection
  • Privileged Identity Management (PIM)
  • Microsoft Purview portal
  • Microsoft Security Exposure Management
  • Identity Containment Actions: Perform targeted identity and security containment tasks during live incidents (such as handling risk states or sign-in risks), subject to specific scoping limits. (Note: Full risk-based policy configuration, administrative password resets, and alert email changes in Entra ID Protection remain restricted).

Groups Administrator

**** This is a second stage activation. Must have IT Technician activated first. May take 5-10min to be visible after activating the IT Technician role***

A scoped version of this role is available under the IT Technician role. That role is scoped to each college's groups. This role allows access to all groups.

Allows users to manage group settings and lifecycle tasks across the organization without needing full Global Administrator permissions

Core Responsibilities

  • Group Lifecycle Management: Create, edit, delete, and restore Microsoft 365 Groups and Microsoft Entra security groups.
  • Policy Management: Create, update, and manage group creation policies, expiration policies, and naming policies.
  • Admin Center Access: Manage groups and related settings via the Microsoft 365 Admin Center, the Microsoft Entra admin center, or PowerShell.

Exchange Recipient Administrator

**** This is a second stage activation. Must have IT Technician activated first. May take 5-10min to be visible after activating the IT Technician role***

Key Responsibilities & Capabilities

  • Mailbox Management: Create, configure, and manage user mailboxes, shared mailboxes, and Microsoft 365 groups.
  • Delegation & Permissions: Set up "Send As" and "Send on behalf" permissions, as well as mailbox sharing and archive/deletion policies.
  • Data Recovery: Recover deleted items inside user mailboxes.
  • Mail Flow & Security: Manage anti-spam and anti-malware filters, accepted domains, and transport/mail flow rules

Before activating Exchange Recipient Administrator https://admin.exchange.microsoft.com/

Screenshot retained for review

Once Exchange Recipient Administrator is activated the Groups tab becomes available

Screenshot retained for review

SharePoint Administrator

**** This is a second stage activation. Must have Microsoft Application Administrator activated first. May take 5-10min to be visible after activating the first role***

This role requires CCMCO to directly approve the activation.

Please have a conversation with Josh or Jason prior to activation.

Manages the organization's SharePoint environment, sharing settings, site collections, and related Microsoft 365 groups

Core Responsibilities

  • Admin Center Access: Accesses and manages the Microsoft Learn SharePoint Admin Center to configure global settings.
  • Site Management: Creates, deletes, and manages SharePoint sites and designates site administrators.
  • Sharing & Security: Manages external and internal sharing policies, storage quotas, and compliance rules.
  • Microsoft 365 Groups: Creates, deletes, restores, and updates owners for Microsoft 365 groups connected to SharePoint.
  • Access Control: Does not have automatic access to every user's OneDrive or private site, but can self-assign access or manage permissions via PowerShell.
  • Monitoring & Support: Tracks storage usage, monitors service health, and troubleshoots collaboration or sync issues.

Edge Administrator

Manages all aspects of the Microsoft Edge browser within an organization

Key Responsibilities

  • Policy Management: Configure and deploy browser policies, settings, and enterprise configurations for Microsoft Edge.
  • Internet Explorer Mode: Create, edit, publish, and manage the enterprise site list required for Internet Explorer (IE) mode on Microsoft Edge.
  • Support Management: Handle and manage support tickets related to browser deployment and administrative features.
  • Cloud & Group Integration: Work with cloud-based policy assignments and management services via the Microsoft 365 admin center.

CCM: Role - Global Administrator

Activates the Global Administrator role

The source records an approval process for group activation, including a reason and an optional start time. It names primary and backup approvers and reports rapid activation after approval; the current approvers and activation timing have not been verified here.

The source requires a discussion about the need for Global Administrator access before an activation request, rather than relying on the notification email as the initial contact. This note does not grant access or establish the current approval contact.

CCM: Role - Entra Application Administrator

Activates the "Application Administrator" role

Lets you create and manage all aspects of enterprise applications, application registrations, and application proxy settings without granting full tenant-wide Global Administrator rights

Core Responsibilities

  • Application Registrations: Create, configure, and delete app registrations.
  • Enterprise Applications: Manage service principals, app credentials, and enterprise application configurations.
  • Application Proxy: Configure and manage application proxy settings for publishing on-premises apps remotely.
  • Permissions & Consent: Grant delegated permissions and application permissions (note: excludes application permissions for Microsoft Graph and Azure AD Graph).
  • Credentials: Add, delete, and reset secrets or certificates for service principals and application registrations.

CCM: Role - Teams Configuration Reader

Activates the "Teams Reader" role

A read-only administrative role in Microsoft Entra ID and the Microsoft Teams admin center

Role Purpose & Overview

  • Primary Function: Provides read-only visibility into settings and administrative information in the Microsoft Teams admin center without allowing any edits, creation, or management actions.
  • Call Quality Data: Grants read-only access to the Microsoft Call Quality Dashboard (CQD) to view reporting metrics, but blocks troubleshooting or active diagnostic capabilities.
  • Target Audience: Designed for auditors, compliance officers, analysts, and stakeholders who need oversight and reporting access without administrative privileges.

What a Teams Reader Can Do

  • Read settings, policies, and configurations across the Microsoft Teams admin center.
  • View team and channel management details, user team tabs, and reporting data via the admin center, PowerShell, and Microsoft Graph APIs.
  • View overview data and metrics in the Call Quality Dashboard (CQD).

What a Teams Reader Cannot Do

  • Modify, update, create, delete, or configure any Teams settings or policies.
  • Perform troubleshooting, alter call quality reports, or access deep user-level call analytics tools.
  • Make changes to Microsoft 365 groups, user licenses, or tenant security settings