| title | Azure permissions for Identity - Azure RBAC |
|---|---|
| description | Lists the permissions for the Azure resource providers in the Identity category. |
| ms.service | role-based-access-control |
| ms.topic | generated-reference |
| author | rolyon |
| manager | pmwongera |
| ms.author | rolyon |
| ms.date | 04/09/2026 |
| ms.custom | generated |
This article lists the permissions for the Azure resource providers in the Identity category. You can use these permissions in your own Azure custom roles to provide granular access control to resources in Azure. Permission strings have the following format: {Company}.{ProviderName}/{resourceType}/{action}
Join Azure virtual machines to a domain without domain controllers.
Azure service: Microsoft Entra Domain Services
[!div class="mx-tableFixed"]
Action Description Microsoft.AAD/register/actionSubscription Registration Action Microsoft.AAD/unregister/actionUnregister Domain Service Microsoft.AAD/register/actionRegister Domain Service Microsoft.AAD/domainServices/readRead Domain Services Microsoft.AAD/domainServices/writeWrite Domain Service Microsoft.AAD/domainServices/deleteDelete Domain Service Microsoft.AAD/domainServices/oucontainer/readRead Ou Containers Microsoft.AAD/domainServices/oucontainer/writeWrite Ou Container Microsoft.AAD/domainServices/oucontainer/deleteDelete Ou Container Microsoft.AAD/domainServices/OutboundNetworkDependenciesEndpoints/readGet the network endpoints of all outbound dependencies Microsoft.AAD/domainServices/providers/Microsoft.Insights/diagnosticSettings/readGets the diagnostic setting for Domain Service Microsoft.AAD/domainServices/providers/Microsoft.Insights/diagnosticSettings/writeCreates or updates the diagnostic setting for the Domain Service resource Microsoft.AAD/domainServices/providers/Microsoft.Insights/logDefinitions/readGets the available logs for Domain Service Microsoft.AAD/domainServices/providers/Microsoft.Insights/metricDefinitions/readGets metrics for Domain Service Microsoft.AAD/locations/operationresults/readMicrosoft.AAD/Operations/read
Azure service: Azure Active Directory
[!div class="mx-tableFixed"]
Action Description microsoft.aadiam/azureADMetrics/readRead Azure AD Metrics Definition microsoft.aadiam/azureADMetrics/writeCreate and Update Azure AD Metrics Definition microsoft.aadiam/azureADMetrics/deleteDelete Azure AD Metrics Definition microsoft.aadiam/azureADMetrics/providers/Microsoft.Insights/diagnosticSettings/readGets the diagnostic setting for the resource microsoft.aadiam/azureADMetrics/providers/Microsoft.Insights/diagnosticSettings/writeCreates or updates the diagnostic setting for the resource microsoft.aadiam/azureADMetrics/providers/Microsoft.Insights/metricDefinitions/readGets the available metrics for azureADMetrics microsoft.aadiam/diagnosticsettings/writeWriting a diagnostic setting microsoft.aadiam/diagnosticsettings/readReading a diagnostic setting microsoft.aadiam/diagnosticsettings/deleteDeleting a diagnostic setting microsoft.aadiam/diagnosticsettingscategories/readReading a diagnostic setting categories microsoft.aadiam/metricDefinitions/readReading Tenant-Level Metric Definitions microsoft.aadiam/metrics/readReading Tenant-Level Metrics microsoft.aadiam/privateLinkForAzureAD/readRead Private Link Policy Definition microsoft.aadiam/privateLinkForAzureAD/writeCreate and Update Private Link Policy Definition microsoft.aadiam/privateLinkForAzureAD/deleteDelete Private Link Policy Definition microsoft.aadiam/privateLinkForAzureAD/privateEndpointConnectionsApproval/actionApprove PrivateEndpointConnections microsoft.aadiam/privateLinkForAzureAD/privateEndpointConnectionProxies/readRead Private Link Proxies microsoft.aadiam/privateLinkForAzureAD/privateEndpointConnectionProxies/deleteDelete Private Link Proxies microsoft.aadiam/privateLinkForAzureAD/privateEndpointConnectionProxies/validate/actionValidate Private Link Proxies microsoft.aadiam/privateLinkForAzureAD/privateEndpointConnections/readRead PrivateEndpointConnections microsoft.aadiam/privateLinkForAzureAD/privateEndpointConnections/writeCreate and Update PrivateEndpointConnections microsoft.aadiam/privateLinkForAzureAD/privateEndpointConnections/deleteDelete PrivateEndpointConnections microsoft.aadiam/privateLinkForAzureAD/privateLinkResources/readRead PrivateLinkResources microsoft.aadiam/privateLinkForAzureAD/privateLinkResources/writeCreate and Update PrivateLinkResources microsoft.aadiam/privateLinkForAzureAD/privateLinkResources/deleteDelete PrivateLinkResources microsoft.aadiam/tenants/providers/Microsoft.Insights/diagnosticSettings/readGets the diagnostic setting for the resource microsoft.aadiam/tenants/providers/Microsoft.Insights/diagnosticSettings/writeCreates or updates the diagnostic setting for the resource microsoft.aadiam/tenants/providers/Microsoft.Insights/logDefinitions/readGets the available logs for tenants
Robust monitoring of your on-premises identity infrastructure.
Azure service: Microsoft Entra ID
[!div class="mx-tableFixed"]
Action Description Microsoft.ADHybridHealthService/configuration/actionUpdates Tenant Configuration. Microsoft.ADHybridHealthService/services/actionUpdates a service instance in the tenant. Microsoft.ADHybridHealthService/addsservices/actionCreate a new forest for the tenant. Microsoft.ADHybridHealthService/register/actionRegisters the ADHybrid Health Service Resource Provider and enables the creation of ADHybrid Health Service resource. Microsoft.ADHybridHealthService/unregister/actionUnregisters the subscription for ADHybrid Health Service Resource Provider. Microsoft.ADHybridHealthService/addsservices/writeCreates or Updates the ADDomainService instance for the tenant. Microsoft.ADHybridHealthService/addsservices/servicemembers/actionAdd a server instance to the service. Microsoft.ADHybridHealthService/addsservices/readGets Service details for the specified service name. Microsoft.ADHybridHealthService/addsservices/deleteDeletes a Service and it's servers along with Health data. Microsoft.ADHybridHealthService/addsservices/addomainservicemembers/readGets all servers for the specified service name. Microsoft.ADHybridHealthService/addsservices/alerts/readGets alerts details for the forest like alertid, alert raised date, alert last detected, alert description, last updated, alert level, alert state, alert troubleshooting links etc. . Microsoft.ADHybridHealthService/addsservices/configuration/readGets Service Configuration for the forest. Example- Forest Name, Functional Level, Domain Naming master FSMO role, Schema master FSMO role etc. Microsoft.ADHybridHealthService/addsservices/dimensions/readGets the domains and sites details for the forest. Example- health status, active alerts, resolved alerts, properties like Domain Functional Level, Forest, Infrastructure Master, PDC, RID master etc. Microsoft.ADHybridHealthService/addsservices/features/userpreference/readGets the user preference setting for the forest.
Example- MetricCounterName like ldapsuccessfulbinds, ntlmauthentications, kerberosauthentications, addsinsightsagentprivatebytes, ldapsearches.
Settings for the UI Charts etc.Microsoft.ADHybridHealthService/addsservices/forestsummary/readGets forest summary for the given forest like forest name, number of domains under this forest, number of sites and sites details etc. Microsoft.ADHybridHealthService/addsservices/metricmetadata/readGets the list of supported metrics for a given service.
For example Extranet Account Lockouts, Total Failed Requests, Outstanding Token Requests (Proxy), Token Requests /sec etc for ADFS service.
NTLM Authentications/sec, LDAP Successful Binds/sec, LDAP Bind Time, LDAP Active Threads, Kerberos Authentications/sec, ATQ Threads Total etc for ADDomainService.
Run Profile Latency, TCP Connections Established, Insights Agent Private Bytes,Export Statistics to Azure AD for ADSync service.Microsoft.ADHybridHealthService/addsservices/metrics/groups/readGiven a service, this API gets the metrics information.
For example, this API can be used to get information related to: Extranet Account Lockouts, Total Failed Requests, Outstanding Token Requests (Proxy), Token Requests /sec etc for ADFederation service.
NTLM Authentications/sec, LDAP Successful Binds/sec, LDAP Bind Time, LDAP Active Threads, Kerberos Authentications/sec, ATQ Threads Total etc for ADDomain Service.
Run Profile Latency, TCP Connections Established, Insights Agent Private Bytes,Export Statistics to Azure AD for Sync Service.Microsoft.ADHybridHealthService/addsservices/premiumcheck/readThis API gets the list of all onboarded ADDomainServices for a premium tenant. Microsoft.ADHybridHealthService/addsservices/replicationdetails/readGets replication details for all the servers for the specified service name. Microsoft.ADHybridHealthService/addsservices/replicationstatus/readGets the number of domain controllers and their replication errors if any. Microsoft.ADHybridHealthService/addsservices/replicationsummary/readGets complete domain controller list along with replication details for the given forest. Microsoft.ADHybridHealthService/addsservices/servicemembers/deleteDeletes a server for a given service and tenant. Microsoft.ADHybridHealthService/addsservices/servicemembers/credentials/readDuring server registration of ADDomainService, this api is called to get the credentials for onboarding new servers. Microsoft.ADHybridHealthService/configuration/writeCreates a Tenant Configuration. Microsoft.ADHybridHealthService/configuration/readReads the Tenant Configuration. Microsoft.ADHybridHealthService/logs/readGets agent installation and registration logs for the tenant. Microsoft.ADHybridHealthService/logs/contents/readGets the content of agent installation and registration logs stored in blob. Microsoft.ADHybridHealthService/operations/readGets list of operations supported by system. Microsoft.ADHybridHealthService/reports/availabledeployments/readGets list of available regions, used by DevOps to support customer incidents. Microsoft.ADHybridHealthService/reports/badpassword/readGets the list of bad password attempts for all the users in Active Directory Federation Service. Microsoft.ADHybridHealthService/reports/badpassworduseridipfrequency/readGets Blob SAS URI containing status and eventual result of newly enqueued report job for frequency of Bad Username/Password attempts per UserId per IPAddress per Day for a given Tenant. Microsoft.ADHybridHealthService/reports/consentedtodevopstenants/readGets the list of DevOps consented tenants. Typically used for customer support. Microsoft.ADHybridHealthService/reports/isdevops/readGets a value indicating whether the tenant is DevOps Consented or not. Microsoft.ADHybridHealthService/reports/selectdevopstenant/readUpdates userid(objectid) for the selected dev ops tenant. Microsoft.ADHybridHealthService/reports/selecteddeployment/readGets selected deployment for the given tenant. Microsoft.ADHybridHealthService/reports/tenantassigneddeployment/readGiven a tenant id gets the tenant storage location. Microsoft.ADHybridHealthService/reports/updateselecteddeployment/readGets the geo location from which data will be accessed. Microsoft.ADHybridHealthService/services/writeCreates a service instance in the tenant. Microsoft.ADHybridHealthService/services/readReads the service instances in the tenant. Microsoft.ADHybridHealthService/services/deleteDeletes a service instance in the tenant. Microsoft.ADHybridHealthService/services/servicemembers/actionCreates or updates a server instance in the service. Microsoft.ADHybridHealthService/services/alerts/readReads the alerts for a service. Microsoft.ADHybridHealthService/services/alerts/readReads the alerts for a service. Microsoft.ADHybridHealthService/services/checkservicefeatureavailibility/readGiven a feature name verifies if a service has everything required to use that feature. Microsoft.ADHybridHealthService/services/exporterrors/readGets the export errors for a given sync service. Microsoft.ADHybridHealthService/services/exportstatus/readGets the export status for a given service. Microsoft.ADHybridHealthService/services/feedbacktype/feedback/readGets alerts feedback for a given service and server. Microsoft.ADHybridHealthService/services/ipAddressAggregates/readReads the bad IPs which attempted to access the service. Microsoft.ADHybridHealthService/services/ipAddressAggregateSettings/readReads alarm thresholds for bad IPs. Microsoft.ADHybridHealthService/services/ipAddressAggregateSettings/writeWrites alarm thresholds for bad IPs. Microsoft.ADHybridHealthService/services/metricmetadata/readGets the list of supported metrics for a given service.
For example Extranet Account Lockouts, Total Failed Requests, Outstanding Token Requests (Proxy), Token Requests /sec etc for ADFS service.
NTLM Authentications/sec, LDAP Successful Binds/sec, LDAP Bind Time, LDAP Active Threads, Kerberos Authentications/sec, ATQ Threads Total etc for ADDomainService.
Run Profile Latency, TCP Connections Established, Insights Agent Private Bytes,Export Statistics to Azure AD for ADSync service.Microsoft.ADHybridHealthService/services/metrics/groups/readGiven a service, this API gets the metrics information.
For example, this API can be used to get information related to: Extranet Account Lockouts, Total Failed Requests, Outstanding Token Requests (Proxy), Token Requests /sec etc for ADFederation service.
NTLM Authentications/sec, LDAP Successful Binds/sec, LDAP Bind Time, LDAP Active Threads, Kerberos Authentications/sec, ATQ Threads Total etc for ADDomain Service.
Run Profile Latency, TCP Connections Established, Insights Agent Private Bytes,Export Statistics to Azure AD for Sync Service.Microsoft.ADHybridHealthService/services/metrics/groups/average/readGiven a service, this API gets the average for metrics for a given service.
For example, this API can be used to get information related to: Extranet Account Lockouts, Total Failed Requests, Outstanding Token Requests (Proxy), Token Requests /sec etc for ADFederation service.
NTLM Authentications/sec, LDAP Successful Binds/sec, LDAP Bind Time, LDAP Active Threads, Kerberos Authentications/sec, ATQ Threads Total etc for ADDomain Service.
Run Profile Latency, TCP Connections Established, Insights Agent Private Bytes,Export Statistics to Azure AD for Sync Service.Microsoft.ADHybridHealthService/services/metrics/groups/sum/readGiven a service, this API gets the aggregated view for metrics for a given service.
For example, this API can be used to get information related to: Extranet Account Lockouts, Total Failed Requests, Outstanding Token Requests (Proxy), Token Requests /sec etc for ADFederation service.
NTLM Authentications/sec, LDAP Successful Binds/sec, LDAP Bind Time, LDAP Active Threads, Kerberos Authentications/sec, ATQ Threads Total etc for ADDomain Service.
Run Profile Latency, TCP Connections Established, Insights Agent Private Bytes,Export Statistics to Azure AD for Sync Service.Microsoft.ADHybridHealthService/services/monitoringconfiguration/writeAdd or updates monitoring configuration for a service. Microsoft.ADHybridHealthService/services/monitoringconfigurations/readGets the monitoring configurations for a given service. Microsoft.ADHybridHealthService/services/monitoringconfigurations/writeAdd or updates monitoring configurations for a service. Microsoft.ADHybridHealthService/services/premiumcheck/readThis API gets the list of all onboarded services for a premium tenant. Microsoft.ADHybridHealthService/services/reports/generateBlobUri/actionGenerates Risky IP report and returns a URI pointing to it. Microsoft.ADHybridHealthService/services/reports/blobUris/readGets all Risky IP report URIs for the last 7 days. Microsoft.ADHybridHealthService/services/reports/details/readGets report of top 50 users with bad password errors from last 7 days Microsoft.ADHybridHealthService/services/servicemembers/readReads the server instance in the service. Microsoft.ADHybridHealthService/services/servicemembers/deleteDeletes a server instance in the service. Microsoft.ADHybridHealthService/services/servicemembers/alerts/readReads the alerts for a server. Microsoft.ADHybridHealthService/services/servicemembers/credentials/readDuring server registration, this api is called to get the credentials for onboarding new servers. Microsoft.ADHybridHealthService/services/servicemembers/datafreshness/readFor a given server, this API gets a list of datatypes that are being uploaded by the servers and the latest time for each upload. Microsoft.ADHybridHealthService/services/servicemembers/exportstatus/readGets the Sync Export Error details for a given Sync Service. Microsoft.ADHybridHealthService/services/servicemembers/metrics/readGets the list of connectors and run profile names for the given service and service member. Microsoft.ADHybridHealthService/services/servicemembers/metrics/groups/readGiven a service, this API gets the metrics information.
For example, this API can be used to get information related to: Extranet Account Lockouts, Total Failed Requests, Outstanding Token Requests (Proxy), Token Requests /sec etc for ADFederation service.
NTLM Authentications/sec, LDAP Successful Binds/sec, LDAP Bind Time, LDAP Active Threads, Kerberos Authentications/sec, ATQ Threads Total etc for ADDomain Service.
Run Profile Latency, TCP Connections Established, Insights Agent Private Bytes,Export Statistics to Azure AD for Sync Service.Microsoft.ADHybridHealthService/services/servicemembers/serviceconfiguration/readGets service configuration for a given tenant. Microsoft.ADHybridHealthService/services/tenantwhitelisting/readGets feature allowlisting status for a given tenant.
Synchronize on-premises directories and enable single sign-on.
Azure service: Azure Active Directory B2C
[!div class="mx-tableFixed"]
Action Description Microsoft.AzureActiveDirectory/register/actionRegister subscription for Microsoft.AzureActiveDirectory resource provider Microsoft.AzureActiveDirectory/associatedBillingAccounts/writeCreate or update Associated Billing Account resource Microsoft.AzureActiveDirectory/associatedBillingAccounts/readView Associated Billing Account resource Microsoft.AzureActiveDirectory/associatedBillingAccounts/deleteDelete Associated Billing Account resource Microsoft.AzureActiveDirectory/b2cDirectories/writeCreate or update B2C Directory resource Microsoft.AzureActiveDirectory/b2cDirectories/readView B2C Directory resource Microsoft.AzureActiveDirectory/b2cDirectories/deleteDelete B2C Directory resource Microsoft.AzureActiveDirectory/b2ctenants/readLists all B2C tenants where the user is a member Microsoft.AzureActiveDirectory/ciamDirectories/writeCreate or update CIAM Directory resource Microsoft.AzureActiveDirectory/ciamDirectories/readView CIAM Directory resource Microsoft.AzureActiveDirectory/ciamDirectories/deleteDelete CIAM Directory resource Microsoft.AzureActiveDirectory/directories/writeCreate or update Directory resource Microsoft.AzureActiveDirectory/directories/readView Directory resource Microsoft.AzureActiveDirectory/directories/deleteDelete Directory resource Microsoft.AzureActiveDirectory/guestUsages/writeCreate or update Guest Usages resource Microsoft.AzureActiveDirectory/guestUsages/readView Guest Usages resource Microsoft.AzureActiveDirectory/guestUsages/deleteDelete Guest Usages resource Microsoft.AzureActiveDirectory/operations/readRead all API operations available for Microsoft.AzureActiveDirectory resource provider
An automatically managed identity in Microsoft Entra ID that authenticates to any service that supports Microsoft Entra
Azure service: Managed identities for Azure resources
[!div class="mx-tableFixed"]
Action Description Microsoft.ManagedIdentity/register/actionRegisters the subscription for the managed identity resource provider Microsoft.ManagedIdentity/identities/readGets an existing system assigned identity Microsoft.ManagedIdentity/operations/readLists operations available on Microsoft.ManagedIdentity resource provider Microsoft.ManagedIdentity/userAssignedIdentities/assign/actionRBAC action for assigning an existing user assigned identity to a resource Microsoft.ManagedIdentity/userAssignedIdentities/deleteDeletes an existing user assigned identity Microsoft.ManagedIdentity/userAssignedIdentities/listAssociatedResources/actionLists all associated resources for an existing user assigned identity Microsoft.ManagedIdentity/userAssignedIdentities/readGets an existing user assigned identity Microsoft.ManagedIdentity/userAssignedIdentities/writeCreates a new user assigned identity or updates the tags associated with an existing user assigned identity Microsoft.ManagedIdentity/userAssignedIdentities/revokeTokens/actionRevoked all the existing tokens on a user assigned identity Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/readGet or list Federated Identity Credentials Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/writeAdd or update a Federated Identity Credential Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/deleteDelete a Federated Identity Credential