Entra ID Role Lookup
Searchable reference for Microsoft Entra ID built-in roles - what each one can actually do, its risk level, and a lower-privilege alternative where one exists.
Showing all roles.
Scope of this list
This covers the built-in roles that come up most in day-to-day access reviews and helpdesk delegation, with a plain-English read on what each one actually lets someone do. It is not the complete built-in role catalogue - Microsoft has well over a hundred, most of them narrow, product-specific roles. For the authoritative and current list, including exact permitted actions, see Microsoft's Entra built-in roles reference.
Risk level here is about blast radius if the account holding the role is compromised or misused, not a Microsoft rating. Where Privileged Identity Management is available, treat every High and most Medium roles as eligible/just-in-time assignments rather than standing ones.